Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.roadflow/roadflow

REMOTE · ROADFLOW.IO · SCANNED SEP 26

Create and edit roadmaps with JSON or markup; share edit and view links from AI agents.

Available components

0 this week 74 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security57
Transport & Reachability100
Schema Quality & AI Usability72
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 2722 tokens (~63/item across 43 items; 43 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage75
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 26% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "model_delete_parameter" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.roadflow/roadflow MCP server?

io.roadflow/roadflow is a hosted endpoint at https://roadflow.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · roadflow.io

# add to Claude Code
claude mcp add --transport http io-roadflow-roadflow 'https://roadflow.io/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "io-roadflow-roadflow": {
      "url": "https://roadflow.io/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "io-roadflow-roadflow": {
      "type": "http",
      "url": "https://roadflow.io/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.io-roadflow-roadflow]
url = "https://roadflow.io/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-roadflow-roadflow": {
      "type": "remote",
      "url": "https://roadflow.io/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add io-roadflow-roadflow --url 'https://roadflow.io/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  io-roadflow-roadflow:
    url: "https://roadflow.io/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "io-roadflow-roadflow": {
      "Transport": "http",
      "Url": "https://roadflow.io/mcp"
    }
  }
}
# add to Vellum
assistant mcp add io-roadflow-roadflow -t streamable-http -u 'https://roadflow.io/mcp'
// mcp.json
{
  "mcpServers": {
    "io-roadflow-roadflow": {
      "type": "http",
      "url": "https://roadflow.io/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 5 Sept 26 −4
    • Schema quality: 44 → 63 ▼ functional
    • Tool coverage: 100% → 26% ▼ functional
    • Destructive annotations: pass → 0 functional
    • New tool “model_delete_edge” functional
    • New tool “model_delete_observation” functional
    • New tool “model_delete_parameter” functional
    • New tool “model_discard” functional
    • New tool “model_evaluate” functional
    • New tool “model_get” functional
    • New tool “model_get_parameter” functional
    • New tool “model_list_dictionaries” functional
    • New tool “model_list_edges” functional
    • New tool “model_list_observations” functional
    • New tool “model_list_parameters” functional
    • New tool “model_new” functional
    • New tool “model_open” functional
    • New tool “model_patch_project” functional
    • New tool “model_status” functional
    • New tool “model_upsert_edge” functional
    • New tool “model_upsert_observation” functional
    • New tool “model_upsert_observations” functional
    • New tool “model_upsert_parameter” functional
    • New tool “model_upsert_parameters” functional
  • 2 Sept 26 0
    • Stability: 0.97 → pass security
  • 1 Sept 26 0
    • Schema quality: 595 → 1012 ▼ functional
    • Schema quality: excellent → good functional
    • New tool “artifacts_apply_json” functional
    • New tool “artifacts_create_shared” functional
    • New tool “artifacts_discard” functional
    • New tool “artifacts_export_json” functional
    • New tool “artifacts_get” functional
    • New tool “artifacts_get_version” functional
    • New tool “artifacts_list_versions” functional
    • New tool “artifacts_new” functional
    • New tool “artifacts_open_shared” functional
    • New tool “artifacts_status” functional
  • 30 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 4 Aug 26 0
    • Schema quality: 464 → 595 ▼ functional
    • Stability: unverified → 0.03 ▲ functional
    • New tool “roadflow_get_version” functional
    • New tool “roadflow_list_versions” functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 26 Sept 2026 · Probed https://roadflow.io/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=roadflow.io CN=YR1,O=Let's Encrypt,C=US 11 Sept 2026 10 Dec 2026 RSA 2048 SHA256-RSA 5df17652b5b419ef5c195d1dc0c4a6dc1e4
SANs: roadflow.io, www.roadflow.io
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of roadflow.io. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 57355 8 Verified
roadflow.io. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://roadflow.io/mcp Verified 200
http (plaintext) http://roadflow.io/mcp HTTPS enforced 301 https://roadflow.io:443/mcp
MCP tools · 43 exposed · ~2,722 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
artifacts_apply_json ~66

Replace (or merge) the Artifacts graph with normalized JSON. Shared edit mode auto-saves to the cloud.

NameTypeReqDescription
json––Full or partial graph state, or JSON string
mergeboolean–If true, merge nodes/labels arrays from payload onto current state

No output schema declared.

No examples provided.

artifacts_create_shared ~66

Persist the current Artifacts workspace to the cloud. Returns editUrl and viewUrl under /artifacts/.

NameTypeReqDescription
editIdstring–Optional edit id (default: random af-…)
viewIdstring–Optional view id (default: random af-…)

No output schema declared.

No examples provided.

artifacts_discard ~31

Clear the in-memory Artifacts workspace for this MCP session (does not delete cloud graphs or the Plans workspace).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

artifacts_export_json ~21

Export the current Artifacts workspace as JSON (serializeState).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

artifacts_get ~17

Return the current Artifacts workspace as JSON.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

artifacts_get_version ~70

Load one shared Artifacts version by relative index (-1 newest). Optional load=true replaces the MCP workspace (does not save).

NameTypeReqDescription
loadboolean–If true, replace the current MCP Artifacts workspace with this version
relintegeryesRelative version index: -1 = newest checkpoint

No output schema declared.

No examples provided.

artifacts_list_versions ~26

List shared Artifacts version checkpoints (newest first). Requires a shared edit workspace.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

artifacts_new ~47

Create an ephemeral in-memory Artifacts graph workspace. Optional seed JSON (serializeState shape: nodes + labels). No cloud id until artifacts_create_shared.

NameTypeReqDescription
json––Optional seed graph state

No output schema declared.

No examples provided.

artifacts_open_shared ~46

Load a cloud Artifacts graph by edit or view id. View links are read-only.

NameTypeReqDescription
idstringyeseditId or viewId from /artifacts/?id=…

No output schema declared.

No examples provided.

artifacts_status ~27

Return mode, ids, /artifacts/?id= URLs, and node/label counts.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

model_delete_edge ~32

Delete a manual edge by edgeId.

NameTypeReqDescription
edgeIdstringyes–
idstring––

No output schema declared.

No examples provided.

model_delete_observation ~63

Delete one fact by parameterId + scope/scopeKey + setId.

NameTypeReqDescription
idstring––
parameterIdstringyes–
scopeobject––
scopeKeystring––
setIdstring––

No output schema declared.

No examples provided.

model_delete_parameter ~33

Delete a parameter and its observations (cascade).

NameTypeReqDescription
idstring––
parameterIdstringyes–

No output schema declared.

No examples provided.

model_discard ~26

Unbind the Model project from this MCP session. Does not delete MySQL rows.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

model_evaluate ~118

Read-only computeModel. Does not write MySQL. View ids allowed. Default period is calendar start (not today). periodId and range* are mutually exclusive. Cell cap 2000.

NameTypeReqDescription
idstring––
includeEmptyboolean––
includeInputsboolean––
parameterIdsarray––
periodIdstring––
rangeEndstring––
rangeStartstring––
setIdstring––
sliceobject––

No output schema declared.

No examples provided.

model_get ~70

Hydrate records from MySQL. include=summary (default counts), dictionaries, parameters, observations, edges, or all. Prefer model_upsert_observation to change one fact — do not treat this as a blob to rewrite.

NameTypeReqDescription
idstring––
includestring–Default summary

No output schema declared.

No examples provided.

model_get_parameter ~46

One catalog row plus its observations (facts).

NameTypeReqDescription
idstring––
parameterIdstringyesStable id, e.g. PRJ.FACILITY_MW

No output schema declared.

No examples provided.

model_list_dictionaries ~41

Streams, axes (members), phases, parameter sets, chains, and calendar. Period members may be derived from calendar.

NameTypeReqDescription
idstring––

No output schema declared.

No examples provided.

model_list_edges ~65

Manual lineage edges only (SOURCE/FLOW/INTERFACE). FORMULA edges are derived from formulas on load — not stored.

NameTypeReqDescription
edgeTypestring––
fromIdstring––
idstring––
toIdstring––

No output schema declared.

No examples provided.

model_list_observations ~73

List facts. Filter by parameterId, setId, evidenceStatus. Sets are a column (Base/Downside/Upside), not an axis.

NameTypeReqDescription
evidenceStatusstring––
idstring––
parameterIdstring––
setIdstring––

No output schema declared.

No examples provided.

model_list_parameters ~64

List parameter catalog rows. Optional filters: streamId, role, layer, primaryOwner.

NameTypeReqDescription
idstring––
layerstring––
primaryOwnerstring––
rolestring––
streamIdstring––

No output schema declared.

No examples provided.

model_new ~207

Create a Model project in MySQL (parameter register). Allocates a view id (mv-…) when omitted and returns viewUrl. Optional seed: title, calendar, streams, axes, phases, parameterSets, chains, parameters, observations, edges. Does not persist CALC outputs or FORMULA edges. Binds this MCP session. UI: /model/?id=…

NameTypeReqDescription
axesarray––
calendar––{ granularity, start, end }
chainsarray––
edgesarray–Manual SOURCE/FLOW/INTERFACE only
observationsarray–Facts: parameterId, scope, setId, value, evidence, source
parameterSetsarray––
parametersarray–Catalog rows (parameterId, streamId, role, formula, attrs, …)
phasesarray––
streamsarray––
titlestring––
viewIdstring––

No output schema declared.

No examples provided.

model_open ~46

Bind this MCP session to an existing Model project (edit or view id). View ids are read-only.

NameTypeReqDescription
idstringyesProject edit id (mp-…) or view id

No output schema declared.

No examples provided.

model_patch_project ~123

Update title, calendar, viewId, streams, axes, phases, parameterSets, and/or chains. Send If-Match via rev. Replaces each provided dictionary in full.

NameTypeReqDescription
axesarray––
calendar–––
chainsarray––
idstring––
parameterSetsarray––
phasesarray––
revinteger–Expected project rev (If-Match)
streamsarray––
titlestring––
viewIdstring|null––

No output schema declared.

No examples provided.

model_status ~35

Counts, rev, and /model/?id= URLs for the bound project (or pass id).

NameTypeReqDescription
idstring––

No output schema declared.

No examples provided.

model_upsert_edge ~96

Create or patch a manual SOURCE, FLOW, or INTERFACE edge. FORMULA is rejected.

NameTypeReqDescription
conditionstring––
edgeIdstringyes–
edgeTypestring––
fromIdstring––
idstring––
labelstring––
ownerstring––
revinteger––
toIdstring––

No output schema declared.

No examples provided.

model_upsert_observation ~181

Create or replace one fact (parameterId + scope + setId). Example: Base P2 facility MW. Do not write CALC-computed values; only IN facts or CALC overrides (valueOverride). Pass rev for If-Match.

NameTypeReqDescription
evidenceStatusstring––
idstring––
parameterIdstringyes–
revinteger––
scopeobject–axisId → memberId, e.g. { "Phase_ID": "P2" }
scopeKeystring––
setIdstring–Base (default), Downside, Upside, or custom
source––{ sourceId, locator, date, owner, allowedUse }
value–––
valueLockedboolean––
valueOverrideboolean––

No output schema declared.

No examples provided.

model_upsert_observations ~89

Create or replace many facts (cap 400). Same body shape as model_upsert_observation. Rejects CALC outputs unless valueOverride. continueOnError returns per-row errors; otherwise one transaction.

NameTypeReqDescription
continueOnErrorboolean––
idstring––
observationsarrayyesFacts (parameterId, scope, setId, value, …)

No output schema declared.

No examples provided.

model_upsert_parameter ~224

Create or patch one parameter definition (not observations). Pass rev for If-Match on update.

NameTypeReqDescription
adjustmentKindstring––
assignedWsstring––
attrs––name, definition, unit, scopeAxes, SBC fields, comments, …
canonicalIdstring––
commentstring––
definitionstring––
domainIdstring––
economicClassstring––
formulastring––
idstring––
layerstring––
namestring––
parameterIdstringyes–
primaryOwnerstring––
prioritystring––
qtyParameterIdstring––
rateComponentsarray––
rateParameterIdstring––
revinteger––
rolestring––
scopeAxesarray––
streamIdstring––
unitstring––
valueTypestring––

No output schema declared.

No examples provided.

model_upsert_parameters ~78

Create or patch many catalog rows (cap 400). Same body shape as model_upsert_parameter. continueOnError returns per-row errors; otherwise one transaction.

NameTypeReqDescription
continueOnErrorboolean––
idstring––
parametersarrayyesCatalog rows (parameterId + same fields as model_upsert_parameter)

No output schema declared.

No examples provided.

roadflow_apply_json ~67

Replace workspace state with normalized JSON (serializeState shape). In shared edit mode, saves to the cloud automatically.

NameTypeReqDescription
json––Full or partial map state object, or JSON string
mergeboolean–If true, deep-ish merge timeline/display and replace roads from payload

No output schema declared.

No examples provided.

roadflow_apply_markup ~41

Replace roads via friendly markup (same as the editor panel). Shared edit mode auto-saves.

NameTypeReqDescription
markupstringyesFriendly roadflow markup text

No output schema declared.

No examples provided.

roadflow_create_shared ~90

Persist the current workspace to the cloud (permanent share). Returns editUrl (play/edit/share further) and viewUrl (visual canvas, read-only). Prefer viewUrl when the user only needs to see the map.

NameTypeReqDescription
editIdstring–Optional edit id (default: random rm-…)
viewIdstring–Optional view id (default: random rm-…)

No output schema declared.

No examples provided.

roadflow_discard ~26

Clear the in-memory workspace for this MCP session (does not delete cloud maps).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

roadflow_export_csv ~33

Export steps as CSV (road, goal, lane, step, notes, type, status, position, date).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

roadflow_export_json ~20

Export the current workspace as JSON (serializeState).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

roadflow_export_markup ~18

Export the current workspace as friendly markup.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

roadflow_get ~28

Return the current workspace as JSON and/or markup.

NameTypeReqDescription
formatstring–Default both

No output schema declared.

No examples provided.

roadflow_get_version ~93

Load one shared-map version by relative index (e.g. -1 newest, -2 previous). Returns JSON state. Does not change the live map or workspace unless load=true.

NameTypeReqDescription
loadboolean–If true, also replace the current MCP workspace with this version (does not save to cloud).
relintegeryesRelative version index: -1 = newest checkpoint, -2 = older, …

No output schema declared.

No examples provided.

roadflow_list_versions ~38

List shared-map version checkpoints (newest first). Relative indexes: -1 = newest. Requires a shared edit workspace (not view-only).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

roadflow_new ~64

Create an ephemeral in-memory roadflow workspace (default). Optional seed JSON and/or markup. No cloud id until create_shared.

NameTypeReqDescription
json––Optional seed state (same shape as serializeState)
markupstring–Optional friendly markup to apply after seed/empty

No output schema declared.

No examples provided.

roadflow_open_shared ~49

Load a cloud map by edit or view id into this session. View links are read-only.

NameTypeReqDescription
idstringyeseditId or viewId from a share URL (?id=…)

No output schema declared.

No examples provided.

roadflow_status ~28

Return mode, ids, URLs, and road/step counts for the current MCP session workspace.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Common questions

What is the io.roadflow/roadflow MCP server?

io.roadflow/roadflow is an MCP server listed in the public MCP registry as io.roadflow/roadflow. Create and edit roadmaps with JSON or markup; share edit and view links from AI agents. This page covers its hosted endpoint (https://roadflow.io/mcp).

Is the io.roadflow/roadflow MCP server safe to use?

io.roadflow/roadflow scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.roadflow/roadflow MCP server expose?

io.roadflow/roadflow exposes 43 tools: roadflow_new, roadflow_status, roadflow_get, roadflow_apply_json, roadflow_apply_markup, and 38 more. Their descriptions and schemas cost roughly 2,722 tokens of context every time the server is loaded.

Does the io.roadflow/roadflow MCP server require authentication?

No. We connected to io.roadflow/roadflow without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the io.roadflow/roadflow MCP server still maintained?

io.roadflow/roadflow is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.