
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
codeflow-mcp
Advanced tools
MCP Server for CodeFlow - Generate and manage code flow documentation with Claude Code
MCP (Model Context Protocol) server for managing code flow documentation with Claude Code.
.cf documentation files for your codenpm install -g codeflow-mcp
Just configure Claude Code to use npx (see below).
Create a .mcp.json file in your project root:
macOS / Linux:
{
"mcpServers": {
"codeflow": {
"command": "npx",
"args": ["-y", "codeflow-mcp"]
}
}
}
Windows:
{
"mcpServers": {
"codeflow": {
"command": "cmd",
"args": ["/c", "npx", "-y", "codeflow-mcp"]
}
}
}
This file can be committed to git - it works on any machine.
If your flows are in a different location (e.g., monorepo with multiple projects), use the CODEFLOW_FLOWS_DIR environment variable:
{
"mcpServers": {
"codeflow": {
"command": "cmd",
"args": ["/c", "npx", "-y", "codeflow-mcp"],
"env": {
"CODEFLOW_FLOWS_DIR": "backend/FCC/products"
}
}
}
}
Example monorepo structure:
my-monorepo/
├── frontend/
├── backend/
│ └── FCC/
│ └── products/ ← Your flows here
│ ├── auth.cf
│ └── orders.cf
├── shared/
└── .mcp.json ← Config points to backend/FCC/products
Add to ~/.claude/settings.json:
{
"mcpServers": {
"codeflow": {
"command": "codeflow-mcp"
}
}
}
(Requires global installation first)
After configuring, open Claude Code in your project and use natural language:
> Get project info
> List all flows
> What files don't have flows yet?
> Read src/orders/createOrder.ts and generate a flow following the spec
> Update create-order.cf with the changes I made to createOrder.ts
| Tool | Description |
|---|---|
read_codeflow_spec | Read the CodeFlow specifications |
list_flows | List all .cf files in the project |
read_flow | Read a specific flow file |
save_flow | Create or update a .cf file |
save_analysis | Save analysis for a flow |
delete_flow | Delete a flow and its analysis |
get_project_info | Get project information |
| Tool | Description | Token Savings |
|---|---|---|
get_node | Read a single node from a flow | ~90% |
get_phase | Read a single phase (optionally with nodes) | ~90% |
update_node | Update specific fields of a node | ~85% |
add_node | Add a new node to a flow/phase | ~85% |
delete_node | Remove a node from flow, phases, and edges | ~95% |
update_phase | Update specific fields of a phase | ~85% |
update_metadata | Update only metadata + auto-changelog | ~95% |
patch_flow | Apply JSON Patch (RFC 6902) operations | ~90% |
validate_flow | Validate flow against CODEFLOW_SPEC_v2 | N/A |
| Tool | Description |
|---|---|
list_code_files | List code files in a directory |
read_code_file | Read a code file |
scan_undocumented | Find code without documentation |
// Before (v1.x): ~1200 tokens
read_flow("my-flow.cf") // 600 tokens to read
save_flow("my-flow.cf", <full JSON>) // 600 tokens to write
// After (v2.0): ~50 tokens
update_node("my-flow.cf", "n3", {
label: "New Label",
data: { description: "Updated description" }
})
// Multiple changes with JSON Patch: ~100 tokens
patch_flow("my-flow.cf", [
{ "op": "replace", "path": "/nodes/0/label", "value": "New" },
{ "op": "add", "path": "/metadata/tags/-", "value": "updated" }
])
Flows are saved in {project}/flows/:
your-project/
├── src/
│ └── orders/
│ └── createOrder.ts
├── flows/
│ ├── create-order.cf # Flow documentation
│ └── create-order.cf-analysis.json # Analysis (optional)
├── .mcp.json # MCP configuration
└── ...
The MCP includes the CodeFlow specifications:
CODEFLOW_SPEC_v2.md - Flow file formatCODEFLOW_ANALYSIS_SPEC_v1.md - Analysis file formatThese are automatically available via the read_codeflow_spec tool.
# Clone the repo
git clone https://github.com/juanisidoro/codeflow.git
cd codeflow
# Install dependencies
npm install
# Build
npm run build
# Run locally
npm start
MIT
FAQs
MCP Server for CodeFlow - Generate and manage code flow documentation with Claude Code
The npm package codeflow-mcp receives a total of 10 weekly downloads. As such, codeflow-mcp popularity was classified as not popular.
We found that codeflow-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.