# io.github.eliaskress/flowcheck (npm · @flowcheck/mcp-server)

Stripe payouts, Shopify orders, and bank transactions unified for reconciliation and cash flow

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@flowcheck/mcp-server`: 69/100 (this document), [markdown](https://verifymcp.io/servers/eliaskress-flowcheck/flowcheck-mcp-server.md), [page](https://verifymcp.io/servers/eliaskress-flowcheck/flowcheck-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@flowcheck/mcp-server`
- Version: `0.2.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 149 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1035 tokens (~57/item across 18 items; 18 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add eliaskress-flowcheck -- npx -y @flowcheck/mcp-server
```

### Codex

```bash
codex mcp add eliaskress-flowcheck -- npx -y @flowcheck/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "eliaskress-flowcheck": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@flowcheck/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add eliaskress-flowcheck --command npx --arg -y --arg @flowcheck/mcp-server
```

### Hermes

```yaml
mcp_servers:
  eliaskress-flowcheck:
    command: "npx"
    args: ["-y", "@flowcheck/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "eliaskress-flowcheck": {
      "command": "npx",
      "args": [
        "-y",
        "@flowcheck/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.30

### 2026-08-03 (score 66, +15)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-02 (score 51, +15)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] MCP protocol: unverified → pass

### 2026-08-01 (score 36, +8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (18)

### `flowcheck_register` (~42 tokens)

Register Account

Create a new FlowCheck account. Returns a registration token and checkout URL. No API key required.

Input parameters:

- `email` (string, required): Email address for the new account

### `flowcheck_get_registration_status` (~48 tokens)

Registration Status

Check registration status and retrieve the API key after checkout. The API key is only returned once. No API key required.

Input parameters:

- `token` (string, required): Registration token from flowcheck_register

### `flowcheck_get_balance` (~40 tokens)

Get Balance

Get combined Stripe and bank balances in one call. Returns available/pending Stripe balance and Plaid bank balance. All amounts are in cents (USD).

### `flowcheck_get_cashflow` (~50 tokens)

Get Cash Flow

Get daily inflow/outflow breakdown over a time window. Returns totals and per-day values. All amounts in cents.

Input parameters:

- `window` (string): Time window (default: 30d)

### `flowcheck_list_payouts` (~109 tokens)

List Payouts

List Stripe payouts with reconciliation status. Filter by status and date range. Returns paginated results with match confidence scores. Amounts in cents.

Input parameters:

- `cursor` (string): Pagination cursor from previous response
- `from` (string): Start date filter (YYYY-MM-DD)
- `limit` (number): Results per page (default 50, max 100)
- `status` (string): Filter by payout status
- `to` (string): End date filter (YYYY-MM-DD)

### `flowcheck_get_payout` (~35 tokens)

Get Payout

Get a single Stripe payout with matched bank transaction details and confidence score.

Input parameters:

- `id` (string, required): Stripe payout ID

### `flowcheck_list_transactions` (~90 tokens)

List Transactions

List bank transactions from Plaid. Deposits appear as negative amounts. Filter by date range. Paginated.

Input parameters:

- `cursor` (string): Pagination cursor from previous response
- `from` (string): Start date filter (YYYY-MM-DD)
- `limit` (number): Results per page (default 50, max 100)
- `to` (string): End date filter (YYYY-MM-DD)

### `flowcheck_get_reconciliation_summary` (~35 tokens)

Reconciliation Summary

Get 30-day reconciliation health score. Returns matched/unmatched counts, total amounts, and number of open discrepancies.

### `flowcheck_get_reconciliation` (~50 tokens)

Reconciliation Detail

Get detailed reconciliation for a specific payout. Shows confidence score breakdown (amount, date, description, bank ID) and the matched bank transaction.

Input parameters:

- `payout_id` (string, required): Stripe payout ID

### `flowcheck_list_discrepancies` (~87 tokens)

List Discrepancies

List open discrepancies: missing bank deposits, amount mismatches, and timing alerts. Filter by status and type.

Input parameters:

- `cursor` (string): Pagination cursor from previous response
- `limit` (number): Results per page (default 50, max 100)
- `status` (string): Filter by discrepancy status
- `type` (string): Filter by discrepancy type

### `flowcheck_get_position` (~42 tokens)

Financial Position

Get a 7-day financial summary designed for AI agents. Returns balances, payout counts, cash flow, health score, and open discrepancies in a single call.

### `flowcheck_get_alerts` (~37 tokens)

Active Alerts

Get active alerts and discrepancies. Returns severity-categorized alerts (high/medium/low) with summaries and related payout IDs.

### `flowcheck_connect_stripe` (~67 tokens)

Connect Stripe

Connect a Stripe account using a restricted API key. The key must have read access to Payouts and Balance. FlowCheck encrypts it with AES-256-GCM.

Input parameters:

- `restricted_key` (string, required): Stripe restricted API key (rk_live_... or rk_test_...)

### `flowcheck_create_plaid_link_token` (~39 tokens)

Create Plaid Link Token

Create a Plaid Link token to initiate bank connection in the browser. Use the returned link_token with the Plaid Link SDK.

### `flowcheck_exchange_plaid_token` (~55 tokens)

Exchange Plaid Token

Exchange a Plaid public token (from Link) for permanent access. Call this after the user completes Plaid Link in the browser.

Input parameters:

- `public_token` (string, required): Plaid public token from the Link flow

### `flowcheck_list_webhooks` (~22 tokens)

List Webhooks

List all registered webhook endpoints with their events and status.

### `flowcheck_create_webhook` (~73 tokens)

Create Webhook

Register a new HTTPS webhook endpoint. Returns a signing secret for HMAC-SHA256 verification. Available events: payout.matched, payout.discrepancy, payout.missing, balance.threshold

Input parameters:

- `events` (array, required): Events to subscribe to
- `url` (string, required): HTTPS webhook URL you own

### `flowcheck_delete_webhook` (~28 tokens)

Delete Webhook

Remove a registered webhook endpoint.

Input parameters:

- `id` (string, required): Webhook endpoint ID

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/eliaskress-flowcheck/flowcheck-mcp-server#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 66
- 2026-08-02: 51
- 2026-08-01: 36
- 2026-07-31: 28
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@flowcheck/mcp-server
- Socket report: https://socket.dev/npm/package/@flowcheck/mcp-server
- Repository: https://github.com/eliaskress/flowcheck-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/eliaskress-flowcheck/flowcheck-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/eliaskress-flowcheck/flowcheck-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/eliaskress-flowcheck/flowcheck-mcp-server