
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@sketchxflow/dev-mcp
Advanced tools
SketchXFlow developer MCP server — for the SketchXFlow delivery team: pull client requirements, post updates, log time and move milestones from Claude, Cursor, and any MCP client. Staff API keys only.
The SketchXFlow developer MCP — for the SketchXFlow delivery team. Pull a client's frozen requirements, post progress updates, message the project room, log time and move milestones from Claude Code, Cursor, Claude Desktop, Codex or any MCP client.
This is the team's tool. You sign in once per machine, and the server refuses every call unless that key's account is an active member of the SketchXFlow team (contract dates included). A client who installs it gets a clear "this account is not on the team" — never another client's project.
Clients use @sketchxflow/mcp
instead: the design tools plus the sketchxflow_services_* tools that talk to
the consultant, finalise requirements and fetch proposal and payment links.
{
"mcpServers": {
"sketchxflow-dev": {
"command": "npx",
"args": ["-y", "@sketchxflow/dev-mcp"]
}
}
}
Claude Code, in one line:
claude mcp add sketchxflow-dev -s user -- npx -y @sketchxflow/dev-mcp
sketchxflow_dev_login, or:npx @sketchxflow/dev-mcp login
It shows a link and a short code. Open the link in a browser where you are signed
in to the staff console, check the code matches, approve. The machine is then
signed in as you: an API key named "Developer MCP · " is created on
your account and stored in ~/.sketchxflow/dev-mcp.json (readable only by you).
Revoke it any time in Account → API keys; npx @sketchxflow/dev-mcp logout
forgets it on this machine, and whoami says who is signed in.
Setting SKETCHXFLOW_API_KEY yourself still works (CI, shared runners) and
takes precedence over the signed-in key.
(VS Code uses a "servers" key; Codex uses [mcp_servers.sketchxflow-dev] in
~/.codex/config.toml.)
| Tool | What it does |
|---|---|
sketchxflow_dev_login / sketchxflow_dev_logout | Sign this machine in (link + code, approved in the staff console) or forget its key. |
sketchxflow_dev_version | Which version is running, whether a newer one is published, and whether your key is on the team. Free — call it first when a tool refuses. |
sketchxflow_dev_work | Live projects assigned to you, with progress and what needs attention (mine=false for every live project). |
sketchxflow_dev_pull | The frozen requirements as text, the priced modules, the milestones with dates and the latest client messages — everything needed to start building. |
sketchxflow_dev_update | Post a progress update the client sees in their project room. |
sketchxflow_dev_message | Message the client, or leave an internal note for the team (internal=true). |
sketchxflow_dev_log_time | Log hours against a module key or milestone. |
sketchxflow_dev_milestone | Start a milestone, or submit it for the client's review. |
A typical session: sketchxflow_dev_work → sketchxflow_dev_pull <project> →
build → sketchxflow_dev_update → sketchxflow_dev_log_time →
sketchxflow_dev_milestone submit.
| Variable | Required | Default | Purpose |
|---|---|---|---|
SKETCHXFLOW_API_KEY | no | — | Overrides the signed-in key (sk_live_…), for CI. |
SKETCHXFLOW_DEV_CREDENTIALS | no | ~/.sketchxflow/dev-mcp.json | Where the signed-in key is kept. |
SKETCHXFLOW_API_URL | no | https://sketchxflow.com | API base, for a staging server. |
SKETCHXFLOW_SKIP_UPDATE_CHECK | no | — | 1 stops the server asking npm whether a newer release is out. |
MIT
FAQs
SketchXFlow developer MCP server — for the SketchXFlow delivery team: pull client requirements, post updates, log time and move milestones from Claude, Cursor, and any MCP client. Staff API keys only.
We found that @sketchxflow/dev-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.