
Research
/Security News
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
flutterflow-mcp
Advanced tools
MCP server for the FlutterFlow Project API — AI-assisted FlutterFlow development through Claude and other MCP-compatible clients
MCP server for the FlutterFlow Project API. Enables AI-assisted FlutterFlow development through Claude and other MCP-compatible clients.
This MCP excels at reading, exploring, and understanding your FlutterFlow projects. Here's what it's great at:
get_editing_guide) that walks through the correct steps before making any YAML changesIn short: Think of it as giving your AI assistant full read access to your FlutterFlow project, plus careful write access when needed.
You need a FlutterFlow API token to authenticate. Here's how to get one:
Note: The API token requires a paid FlutterFlow subscription (Standard plan or above). Free-tier accounts do not have API access.
Choose your AI client below and follow the setup instructions.
Run this command to add the MCP server:
claude mcp add flutterflow -e FLUTTERFLOW_API_TOKEN=your_token_here -- npx -y flutterflow-mcp
Replace your_token_here with the token you copied in step 1.
This adds the server to your project's .claude/settings.json. You can also manually edit the config:
{
"mcpServers": {
"flutterflow": {
"command": "npx",
"args": ["-y", "flutterflow-mcp"],
"env": {
"FLUTTERFLOW_API_TOKEN": "your_token_here"
}
}
}
}
Open Settings > Developer > Edit Config and add:
{
"mcpServers": {
"flutterflow": {
"command": "npx",
"args": ["-y", "flutterflow-mcp"],
"env": {
"FLUTTERFLOW_API_TOKEN": "your_token_here"
}
}
}
}
Replace your_token_here with your token. Restart Claude Desktop after saving.
Open Settings > MCP and add a new server with this configuration:
{
"mcpServers": {
"flutterflow": {
"command": "npx",
"args": ["-y", "flutterflow-mcp"],
"env": {
"FLUTTERFLOW_API_TOKEN": "your_token_here"
}
}
}
}
Add the following to your MCP configuration file (check your client's docs for the exact location):
{
"mcpServers": {
"flutterflow": {
"command": "npx",
"args": ["-y", "flutterflow-mcp"],
"env": {
"FLUTTERFLOW_API_TOKEN": "your_token_here"
}
}
}
}
Ask your AI assistant to list your FlutterFlow projects, inspect pages, or explore your app — it handles the rest.
Example prompts to get started:
This MCP is designed to make AI agents as effective as possible when working with FlutterFlow. Here's what makes it work well:
Instead of hitting the FlutterFlow API for every question, the MCP downloads your entire project once (sync_project) and caches it locally. After that, most tools read from the cache — making them instant and free of API rate limits. If you've made changes in FlutterFlow, just re-sync to refresh the cache.
AI models don't natively understand FlutterFlow's internal structure. This MCP ships with 21 reference documents covering every widget type, action, variable, theme setting, and editing pattern. The AI can look up exactly how a Button, Column, or Navigation action is structured — so it doesn't have to guess.
Before making any change, the AI can call get_editing_guide with a plain-English description of what it wants to do (e.g., "change the button color on the login page"). The MCP returns the exact steps, relevant documentation, and rules to follow — reducing the chance of mistakes.
Rather than one generic "read project" tool, the MCP provides 25 specialized tools — each designed for a specific task. Want to know where a component is used? There's a dedicated tool for that. Want to see all navigation actions pointing to a page? There's one for that too. This means the AI always picks the right tool for the job instead of downloading everything and searching through it.
This MCP can make changes to your FlutterFlow project, but edits should be treated with care:
These are limitations in FlutterFlow's own API. They affect any tool that connects to FlutterFlow, not just this MCP.
main.dart can't be updated — If you've unlocked main.dart for raw Dart editing, the AI can read it but can't push code changes. Startup/shutdown action lists can still be modified.AndroidManifest.xml, Info.plist, or build.gradle. Instead, you configure hooks and settings in FlutterFlow, which generates those files for you. The AI can read and modify those hooks.For the full technical details on each API limitation, see
docs/flutterflow-api-limitations.md.
| Tool | Description |
|---|---|
list_projects | List all FlutterFlow projects for your account |
list_project_files | List YAML file keys in a project (supports prefix filter) |
list_pages | List all pages with human-readable names, scaffold IDs, and folders |
search_project_files | Search file keys by keyword, prefix, or regex |
sync_project | Bulk download all project YAML to local cache for fast offline reads |
| Tool | Description |
|---|---|
get_page_by_name | Fetch a page by its human-readable name |
get_project_yaml | Download specific YAML files by file key |
get_page_summary | Quick page overview from cache — widget tree, actions, params, state |
get_component_summary | Quick component overview from cache — widget tree, actions, params |
find_component_usages | Find all pages and components where a given component is used |
find_page_navigations | Find all actions that navigate to a given page |
| Tool | Description |
|---|---|
get_theme | Theme colors, typography, breakpoints, and widget defaults |
get_app_state | App state variables, constants, and environment settings |
get_api_endpoints | API endpoint definitions — method, URL, variables, headers, response |
get_data_models | Data structs, enums, Firestore collections, and Supabase tables |
get_custom_code | Custom actions, functions, widgets, AI agents, and app-action components |
get_general_settings | App Details, App Assets, Nav Bar & App Bar settings |
get_project_setup | Firebase, Languages, Platforms, Permissions, Dependencies |
get_app_settings | Authentication, Push Notifications, Mobile/Web Deployment |
get_in_app_purchases | Stripe, Braintree, RevenueCat, Razorpay configuration |
get_integrations | Supabase, SQLite, GitHub, Algolia, Google Maps, AdMob, and more |
| Tool | Description |
|---|---|
get_editing_guide | Get the recommended workflow and docs for an editing task — call this before modifying any YAML |
get_yaml_docs | Search/retrieve FlutterFlow YAML reference docs by topic or file |
validate_yaml | Validate YAML content before pushing — always call before update_project_yaml |
update_project_yaml | Push YAML changes to a project |
| Resource | URI | Description |
|---|---|---|
| Docs Index | ff://docs | List all available YAML reference documentation files |
| Doc File | ff://docs/{path} | Read a specific YAML reference doc (e.g. ff://docs/04-widgets/button) |
| Prompt | Description |
|---|---|
generate-page | Generate a new page from a description |
modify-component | Modify an existing component |
inspect-project | Summarize project structure |
flutterflow-dev-workflow | Efficient workflow guide for AI-assisted FlutterFlow development |
This MCP ships with a comprehensive FlutterFlow YAML reference catalog that AI models can access at runtime:
get_yaml_docs tool — Search by topic (e.g. get_yaml_docs(topic: "Button")) or browse the full indexff://docs resources — Direct access to all 21 reference docs covering widgets, actions, variables, theming, and editing workflowsSee docs/ff-yaml/ for the full catalog.
Copy skills from skills/ into your project's .claude/skills/ directory:
ff-yaml-dev.md — Core workflow: reading, editing, and creating FlutterFlow pages/componentsff-widget-patterns.md — Quick reference for common widget YAML patterns and snippetsgit clone https://github.com/mohn93/ff-mcp.git
cd ff-mcp
npm install
npm run build
npm run dev # watch mode
MIT
FAQs
This package has moved to community-ff-mcp
We found that flutterflow-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.