Skip to content

Power Automate MCP Server by Flow Studio

by ninihen1 · remote · no sign-in to list tools · v1.0.0 · published by GitHub user ninihen1

Debug, build, and manage Power Automate cloud flows with AI agents

Deletes · 2Changes · 8

30 tools: 2 can delete or cancel things, 8 change things and 20 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http flowstudio https://mcp.flowstudio.app/mcp --header 'x-api-key: <your-x-api-key>'

Findings

Matches of fixed checks, with the text they matched.

1 info
  • The input schema at properties.includeTriggerUrl.description mentions "credential".

    Matched text

    inputSchema.properties.includeTriggerUrl.description: "...so return the HTTP trigger URL. It is a credential: anyone holding it can run the flow."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

30 tools

Deletes or cancels 2Claude Code: deny
  • cancel_live_flow_runCancel a currently running Power Automate flow run via the live PA API.No findings

    Why it is in this group

    • The name "cancel_live_flow_run" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a currently running Power Automate flow run via the live PA API. Use after get_live_flow_runs to obtain the run name. Only runs with status "Running" can be cancelled.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Cancel run
  • update_live_flowUpdate or create a flow.No findings

    Why it is in this group

    • The name "update_live_flow" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update or create a flow. Use `dryRun: true` to preview any change without writing. Omit flowName to create: definition and displayName are required. Give flowName to update: displayName and/or definition and/or connectionReferences. SURGICAL EDIT: pass `operations` — an ordered list of set/add/remove/merge ops on array-of-keys paths — to change one action or parameter without resending the whole definition. Provide EITHER operations OR definition; connectionReferences may accompany either and lands in the same save. WHOLE definition: call get_live_flow, mutate properties.definition, pass it here. RENAME: pass displayName alone. Power Automate rejects a PATCH carrying no flow content, so this re-saves the unchanged definition — the maker portal does the same. definition.description is required, and must be brief — we append " #flowstudio-mcp" to it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Create or update flow
Changes things 8Claude Code: ask
  • add_live_flow_to_solutionMove a flow into a solution.No findings

    Why it is in this group

    • The name "add_live_flow_to_solution" says "add": a word for a change.
    Description, as the server wrote it
    Move a flow into a solution. Refuses if the flow is already in one. solutionId is optional — omit for the default solution.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Add flow to solution
  • create_live_connectionCreate a connection, or sign an existing one in again (pass connectionName).No findings

    Why it is in this group

    • The name "create_live_connection" says "create": a word for a change.
    Description, as the server wrote it
    Create a connection, or sign an existing one in again (pass connectionName). Shows a sign-in card where the person signs in; you never sign in for them. Without the card, give the person signInLink to open. Connectors that use a key or account details instead of a sign-in are refused: create those in Power Automate.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Create connection
  • report_bugReport a Flow Studio MCP bug or missing capability, append text evidence, or check your reports.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report a Flow Studio MCP bug or missing capability, append text evidence, or check your reports. Free and available even after quota is reached. Do not include passwords, access tokens, secrets, or full flow definitions unless necessary.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Report a bug
  • resubmit_live_flow_runResubmit a failed or cancelled Power Automate flow run via the live PA API, re-using the original trigger payload.Reads text others writeNo findings

    Why it is in this group

    • The name "resubmit_live_flow_run" says "run": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Resubmit a failed or cancelled Power Automate flow run via the live PA API, re-using the original trigger payload. Discovers the trigger name from the flow definition automatically — no trigger name parameter needed.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Resubmit run
  • set_live_flow_stateStart or stop the flow you name.No findings

    Why it is in this group

    • The name "set_live_flow_state" says "set": a word for a change.
    Description, as the server wrote it
    Start or stop the flow you name. Reads the current state first and only calls Power Automate if a change is actually needed.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Turn flow on or off
  • test_live_connectionTest a connection, or run one operation on it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Test a connection, or run one operation on it. Without operationId it runs the connector's own connection test. With operationId it runs that operation and returns the raw reply: a GET operation, or a lookup the connector itself declares for a dropdown, list, schema or folder picker. Anything else is refused before a call is made. connectionName comes from list_live_connections; operation ids from describe_live_connector.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Test connection
  • trigger_live_flowRun a flow on demand — the same as the maker portal's "Run flow" button.Reads text others writeNo findings

    Why it is in this group

    • The name "trigger_live_flow" says "trigger": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Run a flow on demand — the same as the maker portal's "Run flow" button. Works with Request triggers (HTTP request, manual Button, PowerApps) and with scheduled RECURRENCE flows, which run immediately; a scheduled flow takes no inputs, so passing `body` to one is refused. Pass trigger inputs as `body`. Automated connector triggers only fire from their source event.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Run flow
  • update_store_flow[Requires Pro+ plan] Update governance/metadata fields on a flow record in the Power Clarity store (description, business impact, owner team, tags, monitor flag, notification setti…No findings

    Why it is in this group

    • The name "update_store_flow" says "update": a word for a change.
    Description, as the server wrote it
    [Requires Pro+ plan] Update governance/metadata fields on a flow record in the Power Clarity store (description, business impact, owner team, tags, monitor flag, notification settings, etc.). Only fields provided are updated (merge semantics). Writes to the cache — does not call the Power Automate API.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Update flow governance fields
Only reads 20Claude Code: allow
  • describe_live_connectorDescribe a live Power Platform connector/API and its operations.No findings

    Why it is in this group

    • The name "describe_live_connector" says "describe": a word for reading.
    Description, as the server wrote it
    Describe a live Power Platform connector/API and its operations. Use mode=summary (default) to get a compact operation catalog. Use operationId to describe one operation, including inputs, outputs, dynamic parameter metadata, nextTool hints to call resolve_live_parameters, and an authored hint + canonical example shape (when one exists) to copy into update_live_flow. Use search without connectorName/apiName to search operations across connectors and get connection-aware suggestions. Use mode=full only when raw OpenAPI connector metadata is required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Describe connector
  • get_live_flowFetch the full native Power Automate flow JSON from the PA API, including the complete flow definition (triggers, actions, parameters, outputs).1 finding

    Why it is in this group

    • The name "get_live_flow" says "get": a word for reading.

    Findings

    • Info

      The input schema at properties.includeTriggerUrl.description mentions "credential".

      Matched text

      inputSchema.properties.includeTriggerUrl.description: "...so return the HTTP trigger URL. It is a credential: anyone holding it can run the flow."

      What this check looks for
    Description, as the server wrote it
    Fetch the full native Power Automate flow JSON from the PA API, including the complete flow definition (triggers, actions, parameters, outputs). Returns the raw properties object exactly as the PA API returns it. Use this to inspect the full definition before calling update_live_flow with a modified definition.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get flow definition
  • get_live_flow_run_action_outputsRead the recorded inputs and outputs of actions in one flow run.No findings

    Why it is in this group

    • The name "get_live_flow_run_action_outputs" says "get": a word for reading.
    Description, as the server wrote it
    Read the recorded inputs and outputs of actions in one flow run. Without actionName: the top-level actions (optionally filtered by name). With actionName: every execution of that action across foreach iterations, each with repetitionIndexes, status, error, and resolved inputs/outputs. Use iterationIndex to pin one iteration; omit it for all. TRIGGER PAYLOADS: set trigger=true with a runName to get that run's trigger inputs and outputs. No Compose workaround is needed. TRIGGER CHECKS: pass checkId (from get_live_flow_runs -> triggerChecks.recent[].checkId) to read a trigger evaluation that never became a run — that is how you see WHY a trigger is failing. Do not supply runName with a checkId.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get run action inputs and outputs
  • get_live_flow_run_errorFetch error details for a specific flow run from the live Power Automate API.No findings

    Why it is in this group

    • The name "get_live_flow_run_error" says "get": a word for reading.
    Description, as the server wrote it
    Fetch error details for a specific flow run from the live Power Automate API. Lists every failed action with its error code and message to help diagnose what went wrong.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get run error
  • get_live_flow_runsFetch run history for a flow directly from Power Automate.No findings

    Why it is in this group

    • The name "get_live_flow_runs" says "get": a word for reading.
    Description, as the server wrote it
    Fetch run history for a flow directly from Power Automate. Returns { runs, runCount, triggerChecks }: each run has name, status, startTime, endTime, trigger name/code, and any top-level error. IMPORTANT — no runs does NOT mean the flow is healthy. A trigger that fires and evaluates to nothing, or fails to evaluate, records a TRIGGER CHECK and never becomes a run. When there are no runs (or when includeTriggerChecks is set) this tool also reports the trigger check history, so "nothing ran" can be told apart from "the trigger has been failing". Read triggerChecks.byStatus before concluding a flow is fine.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List flow runs
  • get_store_flow[Requires Pro+ plan] Get full details for a single Power Automate flow from the Power Clarity cache.No findings

    Why it is in this group

    • The name "get_store_flow" says "get": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] Get full details for a single Power Automate flow from the Power Clarity cache. Includes trigger URL, owners, state, run statistics, and governance metadata. Data is from the stored snapshot — not live from the Power Automate API.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get cached flow
  • get_store_flow_runs[Requires Pro+ plan] Get cached run history for a flow from the Power Clarity store.No findings

    Why it is in this group

    • The name "get_store_flow_runs" says "get": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] Get cached run history for a flow from the Power Clarity store. Defaults to the last 7 days. Returns startTime, endTime, status, duration (seconds), failedActions, and remediation hint per run. Data is from the stored snapshot — not live from the Power Automate API.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get cached run history
  • get_store_flow_summary[Requires Pro+ plan] Get aggregated run statistics for a flow from the Power Clarity cache: total runs, success count, failure count, success rate, fail rate, and average/max durat…No findings

    Why it is in this group

    • The name "get_store_flow_summary" says "get": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] Get aggregated run statistics for a flow from the Power Clarity cache: total runs, success count, failure count, success rate, fail rate, and average/max duration over a time window. Data is from the stored snapshot — not live from the Power Automate API.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get cached run summary
  • get_store_maker[Requires Pro+ plan] Get details for a single maker from the Power Clarity cache by their key (usually the AAD object ID).No findings

    Why it is in this group

    • The name "get_store_maker" says "get": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] Get details for a single maker from the Power Clarity cache by their key (usually the AAD object ID). Includes flow/app counts and whether the account has been deleted.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get maker
  • list_live_connectionsList Power Platform connections in an environment directly from Power Automate.No findings

    Why it is in this group

    • The name "list_live_connections" says "list": a word for reading.
    Description, as the server wrote it
    List Power Platform connections in an environment directly from Power Automate. Returns id, displayName, connectorName, environment, createdBy (full object), authenticatedUser, statuses, overallStatus, createdTime, expirationTime, and connectionParameters for each connection. Pass search=<term> to narrow the list and receive a paste-ready connectionReferenceTemplate plus action-side hostTemplate per connection — drop these into update_live_flow's connectionReferences and inputs.host without further edits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List connections
  • list_live_environmentsList all Power Platform environments you belong to, directly from Power Automate.No findings

    Why it is in this group

    • The name "list_live_environments" says "list": a word for reading.
    Description, as the server wrote it
    List all Power Platform environments you belong to, directly from Power Automate. Returns id, displayName, sku, location, and state for each environment. mode=all (default) and mode=member: every environment you are a member of. mode=admin: only those you administer; errors rather than guessing if admin access cannot be determined. isAdmin means you hold the ListAnyFlow permission there — the capability list_live_flows mode=admin needs. It is null, never false, when the platform did not tell us. isMember is true for every environment returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List environments
  • list_live_flowsList Power Automate flows in an environment.No findings

    Why it is in this group

    • The name "list_live_flows" says "list": a word for reading.
    Description, as the server wrote it
    List Power Automate flows in an environment. Returns id, displayName, state, triggerType, and lastModifiedTime for each flow. mode=owner (default): flows you own plus flows shared with you (personal + team), with full definitions. mode=admin: all flows in the environment (requires an admin account). mode=admin with includeDeleted=true also returns soft-deleted flows (state=Deleted) — the only way to find a deleted flow. If search is provided, results are filtered to flows whose displayName contains the search text. For large environments pagination is time-bounded — if nextLink is returned, pass it as continuationUrl to retrieve the next batch.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List flows
  • list_skillsSkill bundles: groups of the tools listed here that are used together for one task (diagnose-connection-references, build-flow, debug-flow, monitor-flow, discover, governance).No findings

    Why it is in this group

    • The name "list_skills" says "list": a word for reading.
    Description, as the server wrote it
    Skill bundles: groups of the tools listed here that are used together for one task (diagnose-connection-references, build-flow, debug-flow, monitor-flow, discover, governance). Returns each bundle's one-line description and tool names. Use it when unsure which tools fit a request; tool_search "skill:<name>" returns the bundle's full guidance and definitions. Non-billable.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List skill bundles
  • list_store_connections[Requires Pro+ plan] List all Power Platform connections from the Power Clarity cache.No findings

    Why it is in this group

    • The name "list_store_connections" says "list": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] List all Power Platform connections from the Power Clarity cache.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List cached connections
  • list_store_environments[Requires Pro+ plan] List all Power Platform environments from the Power Clarity cache.No findings

    Why it is in this group

    • The name "list_store_environments" says "list": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] List all Power Platform environments from the Power Clarity cache.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List cached environments
  • list_store_flows[Requires Pro+ plan] List Power Automate flows from the Power Clarity cache.No findings

    Why it is in this group

    • The name "list_store_flows" says "list": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] List Power Automate flows from the Power Clarity cache. Optionally filter by governance flags (monitor, notification rules). Returns key fields including trigger URL, state, and run failure rate. Data is from the stored snapshot — not live from the Power Automate API.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List cached flows
  • list_store_makers[Requires Pro+ plan] List all makers (citizen developers / AAD users) from the Power Clarity cache.No findings

    Why it is in this group

    • The name "list_store_makers" says "list": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] List all makers (citizen developers / AAD users) from the Power Clarity cache.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List makers
  • list_store_power_apps[Requires Pro+ plan] List all Power Apps canvas apps from the Power Clarity cache.No findings

    Why it is in this group

    • The name "list_store_power_apps" says "list": a word for reading.
    Description, as the server wrote it
    [Requires Pro+ plan] List all Power Apps canvas apps from the Power Clarity cache.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List cached apps
  • resolve_live_parametersResolve a connector action's inputs the way the flow designer does: dropdown options, list and table columns, folder and file pickers — every input in one call, or one with paramet…Reads private dataNo findings

    Why it is in this group

    • The name "resolve_live_parameters" says "resolve": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "resolve" and "table": it reads databases.
    Description, as the server wrote it
    Resolve a connector action's inputs the way the flow designer does: dropdown options, list and table columns, folder and file pickers — every input in one call, or one with parameterName. Reads only: it runs the lookups the designer runs, never an action. Pass values you have in parameters; pass a display name in match to get back the value to write into the flow. An input whose parent is not known yet has status "needs". Inputs inside an object are addressed by key (body/recipient/groupId). Omit connectionName and one is chosen.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Resolve action inputs

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:03 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
10
Protocol version
2025-03-26
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://mcp.flowstudio.app/.well-known/oauth-protected-resource
Authorization servers
https://mcp.flowstudio.app
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 10 tools that change things (2 destructive, 8 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.flowstudio.app/mcp: tools/list returned 30 tools to an anonymous client, including cancel_live_flow_run (destructive), update_live_flow (destructive), report_bug (write), update_store_flow (write), trigger_live_flow (write) and 5 more

    What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http flowstudio https://mcp.flowstudio.app/mcp --header 'x-api-key: <your-x-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__flowstudio__tool_search",
      "mcp__flowstudio__list_skills",
      "mcp__flowstudio__list_store_flows",
      "mcp__flowstudio__get_store_flow",
      "mcp__flowstudio__get_store_flow_runs",
      "mcp__flowstudio__get_store_flow_summary",
      "mcp__flowstudio__list_store_environments",
      "mcp__flowstudio__list_store_makers",
      "mcp__flowstudio__get_store_maker",
      "mcp__flowstudio__list_store_power_apps",
      "mcp__flowstudio__list_store_connections",
      "mcp__flowstudio__get_live_flow_runs",
      "mcp__flowstudio__get_live_flow_run_error",
      "mcp__flowstudio__get_live_flow_run_action_outputs",
      "mcp__flowstudio__get_live_flow",
      "mcp__flowstudio__list_live_environments",
      "mcp__flowstudio__list_live_flows",
      "mcp__flowstudio__list_live_connections",
      "mcp__flowstudio__describe_live_connector",
      "mcp__flowstudio__resolve_live_parameters"
    ],
    "ask": [
      "mcp__flowstudio__report_bug",
      "mcp__flowstudio__update_store_flow",
      "mcp__flowstudio__trigger_live_flow",
      "mcp__flowstudio__resubmit_live_flow_run",
      "mcp__flowstudio__set_live_flow_state",
      "mcp__flowstudio__add_live_flow_to_solution",
      "mcp__flowstudio__test_live_connection",
      "mcp__flowstudio__create_live_connection"
    ],
    "deny": [
      "mcp__flowstudio__cancel_live_flow_run",
      "mcp__flowstudio__update_live_flow"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as flowstudio. Review it before you use it.

Capability tags behind 3 rules
  • mcp__flowstudio__trigger_live_flow untrusted-input
  • mcp__flowstudio__resubmit_live_flow_run untrusted-input
  • mcp__flowstudio__resolve_live_parameters private-data