io.github.floomhq/floom

NPM · @FLOOMHQ/MCP-SERVER · SCANNED AUG 4

Deploy Python functions as web apps with auto-generated UI, REST API, and shareable links.

Available components

+23 this week 69 69 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83

No malware found by supply-chain analysis.Pass
CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 123 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1744 tokens (~54/item across 32 items; 32 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management30

Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @floomhq/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add floomhq-floom -- npx -y @floomhq/mcp-server

# add to Codex CLI

codex mcp add floomhq-floom -- npx -y @floomhq/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "floomhq-floom": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@floomhq/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add floomhq-floom --command npx --arg -y --arg @floomhq/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  floomhq-floom:
    command: "npx"
    args: ["-y", "@floomhq/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "floomhq-floom": {
      "command": "npx",
      "args": [
        "-y",
        "@floomhq/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 −1
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +49
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Licence: MIT functional
1 Aug 26 −1
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
31 Jul 26 −7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
27 Jul 26 46

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@floomhq/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-8j4g-w8fx-2239	CVE-2026-69207	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes

Dependencies 96 packages

96 packages in the resolved dependency tree · 96 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 32 exposed · ~1,744 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

create_from_template ~47

Create a new Floom project from a starter template.

Input Output Examples

Name	Type	Req	Description
name	string	—	Project name (defaults to template name)
template_id	string	yes	Template ID to create from

No output schema declared.

No examples provided.

create_schedule ~141

Create a cron schedule that automatically runs an endpoint at specified intervals.

Input Output Examples

Name	Type	Req	Description
cron	string	yes	Cron expression (e.g. "/5 * * " for every 5 minutes, "0 9 * *" for daily at 9am)
endpoint_id	string	yes	Endpoint ID to schedule (e.g. "post--generate")
input	object	—	JSON input to pass to the endpoint on each run
project_id	string	yes	Project ID
timeout_seconds	number	—	Max execution time per run (default: 60)
timezone	string	—	IANA timezone (default: UTC)

No output schema declared.

No examples provided.

create_share_link ~61

Create a public share link for a Floom endpoint. Share links allow anyone to run the endpoint without authentication.

Input Output Examples

Name	Type	Req	Description
endpoint_id	string	yes	Endpoint ID to share (e.g. "post--generate")
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

delete_context ~40

Remove a context entry from a Floom project.

Input Output Examples

Name	Type	Req	Description
context_id	string	yes	Context ID to remove
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

delete_project ~38

Delete a Floom project and all its data (versions, runs, secrets, storage).

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID to delete

No output schema declared.

No examples provided.

delete_schedule ~40

Delete a cron schedule from a Floom project.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID
schedule_id	string	yes	Schedule ID to delete

No output schema declared.

No examples provided.

deploy ~133

Deploy Python code to Floom and get a usable URL. Accepts raw Python source or a base64-encoded ZIP. Optionally include a floom.yaml config to declare endpoint schemas, secrets, and resource requirements.

Input Output Examples

Name	Type	Req	Description
code	string	yes	Python source code or base64-encoded ZIP bundle
config	object	—	floom.yaml configuration: declare endpoint schemas, required secrets, and resource settings
name	string	yes	Project name (lowercase, hyphens allowed)
requirements	array	—	Python package requirements (e.g. ["requests==2.31.0", "pandas"])

No output schema declared.

No examples provided.

deploy_from_github ~73

Deploy a Floom app directly from a GitHub repository URL.

Input Output Examples

Name	Type	Req	Description
github_ref	string	—	Branch or tag to deploy (default: main)
github_url	string	yes	GitHub repository URL (e.g. "https://github.com/user/repo")
name	string	yes	Project name

No output schema declared.

No examples provided.

disable_share_link ~50

Disable a share link for a Floom project. The link will no longer be accessible.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID
share_id	string	yes	Share link ID to disable

No output schema declared.

No examples provided.

disable_webhooks ~30

Disable public inbound webhooks for a Floom project.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

enable_webhooks ~52

Enable public inbound webhooks for a Floom project. Once enabled, external services can trigger runs via POST /v1/webhooks/:slug/:action without authentication.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

fetch_context ~72

Fetch external data from a URL and attach it as context to a Floom project. Context data enhances AI-powered endpoints.

Input Output Examples

Name	Type	Req	Description
name	string	yes	Context name (alphanumeric, hyphens, underscores)
project_id	string	yes	Project ID
url	string	yes	URL to fetch context from

No output schema declared.

No examples provided.

get_context ~38

Retrieve stored context data for a Floom project.

Input Output Examples

Name	Type	Req	Description
context_id	string	yes	Context ID
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

get_logs ~45

Get recent run logs for a Floom project.

Input Output Examples

Name	Type	Req	Description
limit	number	—	Number of recent runs to fetch (default 10)
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

get_project ~45

Get details for a Floom project including endpoint schemas and input parameters. Use this before calling run to see what inputs an endpoint expects.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

get_template ~30

Get details and code preview for a Floom starter template.

Input Output Examples

Name	Type	Req	Description
template_id	string	yes	Template ID

No output schema declared.

No examples provided.

list_contexts ~29

List all context entries for a Floom project.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

list_projects ~15

List all deployed Floom projects.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_schedules ~29

List all cron schedules for a Floom project.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

list_share_links ~29

List all share links for a Floom project.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

list_templates ~17

List available starter templates for Floom projects.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_versions ~44

List all versions of a Floom project. Shows which version is dev (latest deploy) and which is prod (promoted).

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

manage_secrets ~73

Manage secrets for a Floom project. Supports list, set, and delete operations.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
key	string	—	Secret key (required for set/delete)
project_id	string	yes	Project ID
value	string	—	Secret value (required for set)

No output schema declared.

No examples provided.

promote ~63

Promote a version to production. By default promotes the current dev version. Runs a health check; auto-rolls back if the check fails.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID
version_id	string	—	Version ID to promote (defaults to current dev version)

No output schema declared.

No examples provided.

refresh_context ~39

Re-fetch context data from its source URL.

Input Output Examples

Name	Type	Req	Description
context_id	string	yes	Context ID to refresh
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

rollback ~38

Rollback production to a previous version.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID
version_id	string	yes	Version ID to rollback to

No output schema declared.

No examples provided.

run ~203

Execute an action on a deployed Floom app. Preferred: use app_slug + action for simple invocation. Alternative: use project_id + endpoint_id + version_id for explicit control.

Input Output Examples

Name	Type	Req	Description
action	string	—	Action name (e.g. "count", "generate"). Used with app_slug.
app_slug	string	—	App slug for simple invocation (e.g. "my-app")
callback_url	string	—	URL to receive a POST with the run result when it completes (webhook)
endpoint_id	string	—	Endpoint ID (e.g. "post--generate_invoice"). Used with project_id.
json	object	—	JSON body to send to the endpoint
params	object	—	Query parameters
project_id	string	—	Project ID (alternative to app_slug)
timeout_seconds	number	—	Max execution time in seconds (default 60)
version_id	string	—	Version ID. Used with project_id.

No output schema declared.

No examples provided.

storage_delete ~37

Delete a stored value for a Floom project.

Input Output Examples

Name	Type	Req	Description
key	string	yes	Storage key
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

storage_get ~37

Retrieve a stored value for a Floom project.

Input Output Examples

Name	Type	Req	Description
key	string	yes	Storage key
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

storage_list ~31

List all stored keys for a Floom project with usage info.

Input Output Examples

Name	Type	Req	Description
project_id	string	yes	Project ID

No output schema declared.

No examples provided.

storage_set ~78

Store a persistent key-value pair for a Floom project. Values persist across runs and deploys.

Input Output Examples

Name	Type	Req	Description
key	string	yes	Storage key (alphanumeric, dots, underscores, hyphens; max 256 chars)
project_id	string	yes	Project ID
value	—	—	Value to store (any JSON-serializable data)

No output schema declared.

No examples provided.

update_project ~47

Update a Floom project name or slug.

Input Output Examples

Name	Type	Req	Description
name	string	—	New project name
project_id	string	yes	Project ID
slug	string	—	New project slug

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 4 Aug

Day	Score
27 Jul	46
28 Jul	46
30 Jul	28
31 Jul	21
1 Aug	20
2 Aug	69
3 Aug	70
4 Aug	69