io.github.floomhq/floom
NPM · @FLOOMHQ/MCP-SERVER · SCANNED SEP 20
Deploy Python functions as web apps with auto-generated UI, REST API, and shareable links.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 32 of 97 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 170 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1744 tokens (~54/item across 32 items; 32 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "deploy" implies "deploy" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.floomhq/floom MCP server?
io.github.floomhq/floom runs locally as an npm package, launched with npx -y @floomhq/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @floomhq/mcp-server
claude mcp add floomhq-floom -- npx -y @floomhq/mcp-server
{
"mcpServers": {
"floomhq-floom": {
"command": "npx",
"args": [
"-y",
"@floomhq/mcp-server"
]
}
}
} {
"servers": {
"floomhq-floom": {
"command": "npx",
"args": [
"-y",
"@floomhq/mcp-server"
]
}
}
} codex mcp add floomhq-floom -- npx -y @floomhq/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"floomhq-floom": {
"type": "local",
"command": [
"npx",
"-y",
"@floomhq/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add floomhq-floom --command npx --arg -y --arg @floomhq/mcp-server
mcp_servers:
floomhq-floom:
command: "npx"
args: ["-y", "@floomhq/mcp-server"] {
"McpServers": {
"floomhq-floom": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@floomhq/mcp-server"
]
}
}
} assistant mcp add floomhq-floom -t stdio -c npx -a -y @floomhq/mcp-server
{
"mcpServers": {
"floomhq-floom": {
"command": "npx",
"args": [
"-y",
"@floomhq/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- Security disclosure: unverified → pass ▲ functional
- 14 Sept 26 0
- Security disclosure: pass → unverified ▼ functional
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@floomhq/mcp-server@0.1.6
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 97 packages
| Packages resolved | 97 |
|---|---|
| Deprecated | 1 |
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_from_template ~47
Create a new Floom project from a starter template.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Project name (defaults to template name) |
| template_id | string | yes | Template ID to create from |
No output schema declared.
No examples provided.
create_schedule ~141
Create a cron schedule that automatically runs an endpoint at specified intervals.
| Name | Type | Req | Description |
|---|---|---|---|
| cron | string | yes | Cron expression (e.g. "*/5 * * * *" for every 5 minutes, "0 9 * * *" for daily at 9am) |
| endpoint_id | string | yes | Endpoint ID to schedule (e.g. "post--generate") |
| input | object | – | JSON input to pass to the endpoint on each run |
| project_id | string | yes | Project ID |
| timeout_seconds | number | – | Max execution time per run (default: 60) |
| timezone | string | – | IANA timezone (default: UTC) |
No output schema declared.
No examples provided.
create_share_link ~61
Create a public share link for a Floom endpoint. Share links allow anyone to run the endpoint without authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint_id | string | yes | Endpoint ID to share (e.g. "post--generate") |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
delete_context ~40
Remove a context entry from a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| context_id | string | yes | Context ID to remove |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
delete_project ~38
Delete a Floom project and all its data (versions, runs, secrets, storage).
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID to delete |
No output schema declared.
No examples provided.
delete_schedule ~40
Delete a cron schedule from a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
| schedule_id | string | yes | Schedule ID to delete |
No output schema declared.
No examples provided.
deploy ~133
Deploy Python code to Floom and get a usable URL. Accepts raw Python source or a base64-encoded ZIP. Optionally include a floom.yaml config to declare endpoint schemas, secrets, and resource requirements.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Python source code or base64-encoded ZIP bundle |
| config | object | – | floom.yaml configuration: declare endpoint schemas, required secrets, and resource settings |
| name | string | yes | Project name (lowercase, hyphens allowed) |
| requirements | array | – | Python package requirements (e.g. ["requests==2.31.0", "pandas"]) |
No output schema declared.
No examples provided.
deploy_from_github ~73
Deploy a Floom app directly from a GitHub repository URL.
| Name | Type | Req | Description |
|---|---|---|---|
| github_ref | string | – | Branch or tag to deploy (default: main) |
| github_url | string | yes | GitHub repository URL (e.g. "https://github.com/user/repo") |
| name | string | yes | Project name |
No output schema declared.
No examples provided.
disable_share_link ~50
Disable a share link for a Floom project. The link will no longer be accessible.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
| share_id | string | yes | Share link ID to disable |
No output schema declared.
No examples provided.
disable_webhooks ~30
Disable public inbound webhooks for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
enable_webhooks ~52
Enable public inbound webhooks for a Floom project. Once enabled, external services can trigger runs via POST /v1/webhooks/:slug/:action without authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
fetch_context ~72
Fetch external data from a URL and attach it as context to a Floom project. Context data enhances AI-powered endpoints.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Context name (alphanumeric, hyphens, underscores) |
| project_id | string | yes | Project ID |
| url | string | yes | URL to fetch context from |
No output schema declared.
No examples provided.
get_context ~38
Retrieve stored context data for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| context_id | string | yes | Context ID |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
get_logs ~45
Get recent run logs for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Number of recent runs to fetch (default 10) |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
get_project ~45
Get details for a Floom project including endpoint schemas and input parameters. Use this before calling run to see what inputs an endpoint expects.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
get_template ~30
Get details and code preview for a Floom starter template.
| Name | Type | Req | Description |
|---|---|---|---|
| template_id | string | yes | Template ID |
No output schema declared.
No examples provided.
list_contexts ~29
List all context entries for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
list_projects ~15
List all deployed Floom projects.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_schedules ~29
List all cron schedules for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
list_share_links ~29
List all share links for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
list_templates ~17
List available starter templates for Floom projects.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_versions ~44
List all versions of a Floom project. Shows which version is dev (latest deploy) and which is prod (promoted).
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
manage_secrets ~73
Manage secrets for a Floom project. Supports list, set, and delete operations.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| key | string | – | Secret key (required for set/delete) |
| project_id | string | yes | Project ID |
| value | string | – | Secret value (required for set) |
No output schema declared.
No examples provided.
promote ~63
Promote a version to production. By default promotes the current dev version. Runs a health check; auto-rolls back if the check fails.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
| version_id | string | – | Version ID to promote (defaults to current dev version) |
No output schema declared.
No examples provided.
refresh_context ~39
Re-fetch context data from its source URL.
| Name | Type | Req | Description |
|---|---|---|---|
| context_id | string | yes | Context ID to refresh |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
rollback ~38
Rollback production to a previous version.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
| version_id | string | yes | Version ID to rollback to |
No output schema declared.
No examples provided.
run ~203
Execute an action on a deployed Floom app. Preferred: use app_slug + action for simple invocation. Alternative: use project_id + endpoint_id + version_id for explicit control.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action name (e.g. "count", "generate"). Used with app_slug. |
| app_slug | string | – | App slug for simple invocation (e.g. "my-app") |
| callback_url | string | – | URL to receive a POST with the run result when it completes (webhook) |
| endpoint_id | string | – | Endpoint ID (e.g. "post--generate_invoice"). Used with project_id. |
| json | object | – | JSON body to send to the endpoint |
| params | object | – | Query parameters |
| project_id | string | – | Project ID (alternative to app_slug) |
| timeout_seconds | number | – | Max execution time in seconds (default 60) |
| version_id | string | – | Version ID. Used with project_id. |
No output schema declared.
No examples provided.
storage_delete ~37
Delete a stored value for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | Storage key |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
storage_get ~37
Retrieve a stored value for a Floom project.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | Storage key |
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
storage_list ~31
List all stored keys for a Floom project with usage info.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID |
No output schema declared.
No examples provided.
storage_set ~78
Store a persistent key-value pair for a Floom project. Values persist across runs and deploys.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | Storage key (alphanumeric, dots, underscores, hyphens; max 256 chars) |
| project_id | string | yes | Project ID |
| value | – | – | Value to store (any JSON-serializable data) |
No output schema declared.
No examples provided.
update_project ~47
Update a Floom project name or slug.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | New project name |
| project_id | string | yes | Project ID |
| slug | string | – | New project slug |
No output schema declared.
No examples provided.
What is the io.github.floomhq/floom MCP server?
io.github.floomhq/floom is an MCP server listed in the public MCP registry as io.github.floomhq/floom. Deploy Python functions as web apps with auto-generated UI, REST API, and shareable links. This page covers its npm package (@floomhq/mcp-server).
Is the io.github.floomhq/floom MCP server safe to use?
io.github.floomhq/floom scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.floomhq/floom MCP server expose?
io.github.floomhq/floom exposes 32 tools: deploy, run, list_projects, get_project, manage_secrets, and 27 more. Their descriptions and schemas cost roughly 1,744 tokens of context every time the server is loaded.
Is the io.github.floomhq/floom MCP server still maintained?
io.github.floomhq/floom is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.floomhq/floom MCP server under?
io.github.floomhq/floom declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.