Power Automate MCP Server by Flow Studio
by ninihen1 · remote · no sign-in to list tools · v1.0.0 · published by GitHub user ninihen1
Debug, build, and manage Power Automate cloud flows with AI agents
30 tools: 2 can delete or cancel things, 8 change things and 20 only read.
Scanned Oct 21, 2026
- Deletes or cancels2Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things8Claude Code: ask: see these tools
- Only reads20Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http flowstudio https://mcp.flowstudio.app/mcp --header 'x-api-key: <your-x-api-key>'Findings
Matches of fixed checks, with the text they matched.
- Infoget_live_flow
The input schema at properties.includeTriggerUrl.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.includeTriggerUrl.description: "...so return the HTTP trigger URL. It is a credential: anyone holding it can run the flow."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
30 tools
Deletes or cancels 2Claude Code: deny
cancel_live_flow_runCancel a currently running Power Automate flow run via the live PA API.No findings
Why it is in this group
- The name "cancel_live_flow_run" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Cancel a currently running Power Automate flow run via the live PA API. Use after get_live_flow_runs to obtain the run name. Only runs with status "Running" can be cancelled.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- title: Cancel run
update_live_flowUpdate or create a flow.No findings
Why it is in this group
- The name "update_live_flow" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Update or create a flow. Use `dryRun: true` to preview any change without writing. Omit flowName to create: definition and displayName are required. Give flowName to update: displayName and/or definition and/or connectionReferences. SURGICAL EDIT: pass `operations` — an ordered list of set/add/remove/merge ops on array-of-keys paths — to change one action or parameter without resending the whole definition. Provide EITHER operations OR definition; connectionReferences may accompany either and lands in the same save. WHOLE definition: call get_live_flow, mutate properties.definition, pass it here. RENAME: pass displayName alone. Power Automate rejects a PATCH carrying no flow content, so this re-saves the unchanged definition — the maker portal does the same. definition.description is required, and must be brief — we append " #flowstudio-mcp" to it.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- title: Create or update flow
Changes things 8Claude Code: ask
add_live_flow_to_solutionMove a flow into a solution.No findings
Why it is in this group
- The name "add_live_flow_to_solution" says "add": a word for a change.
Description, as the server wrote it Move a flow into a solution. Refuses if the flow is already in one. solutionId is optional — omit for the default solution.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Add flow to solution
create_live_connectionCreate a connection, or sign an existing one in again (pass connectionName).No findings
Why it is in this group
- The name "create_live_connection" says "create": a word for a change.
Description, as the server wrote it Create a connection, or sign an existing one in again (pass connectionName). Shows a sign-in card where the person signs in; you never sign in for them. Without the card, give the person signInLink to open. Connectors that use a key or account details instead of a sign-in are refused: create those in Power Automate.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- title: Create connection
report_bugReport a Flow Studio MCP bug or missing capability, append text evidence, or check your reports.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Report a Flow Studio MCP bug or missing capability, append text evidence, or check your reports. Free and available even after quota is reached. Do not include passwords, access tokens, secrets, or full flow definitions unless necessary.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- title: Report a bug
resubmit_live_flow_runResubmit a failed or cancelled Power Automate flow run via the live PA API, re-using the original trigger payload.Reads text others writeNo findings
Why it is in this group
- The name "resubmit_live_flow_run" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Resubmit a failed or cancelled Power Automate flow run via the live PA API, re-using the original trigger payload. Discovers the trigger name from the flow definition automatically — no trigger name parameter needed.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- title: Resubmit run
set_live_flow_stateStart or stop the flow you name.No findings
Why it is in this group
- The name "set_live_flow_state" says "set": a word for a change.
Description, as the server wrote it Start or stop the flow you name. Reads the current state first and only calls Power Automate if a change is actually needed.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Turn flow on or off
test_live_connectionTest a connection, or run one operation on it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Test a connection, or run one operation on it. Without operationId it runs the connector's own connection test. With operationId it runs that operation and returns the raw reply: a GET operation, or a lookup the connector itself declares for a dropdown, list, schema or folder picker. Anything else is refused before a call is made. connectionName comes from list_live_connections; operation ids from describe_live_connector.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- title: Test connection
trigger_live_flowRun a flow on demand — the same as the maker portal's "Run flow" button.Reads text others writeNo findings
Why it is in this group
- The name "trigger_live_flow" says "trigger": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Run a flow on demand — the same as the maker portal's "Run flow" button. Works with Request triggers (HTTP request, manual Button, PowerApps) and with scheduled RECURRENCE flows, which run immediately; a scheduled flow takes no inputs, so passing `body` to one is refused. Pass trigger inputs as `body`. Automated connector triggers only fire from their source event.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- title: Run flow
update_store_flow[Requires Pro+ plan] Update governance/metadata fields on a flow record in the Power Clarity store (description, business impact, owner team, tags, monitor flag, notification setti…No findings
Why it is in this group
- The name "update_store_flow" says "update": a word for a change.
Description, as the server wrote it [Requires Pro+ plan] Update governance/metadata fields on a flow record in the Power Clarity store (description, business impact, owner team, tags, monitor flag, notification settings, etc.). Only fields provided are updated (merge semantics). Writes to the cache — does not call the Power Automate API.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Update flow governance fields
Only reads 20Claude Code: allow
describe_live_connectorDescribe a live Power Platform connector/API and its operations.No findings
Why it is in this group
- The name "describe_live_connector" says "describe": a word for reading.
Description, as the server wrote it Describe a live Power Platform connector/API and its operations. Use mode=summary (default) to get a compact operation catalog. Use operationId to describe one operation, including inputs, outputs, dynamic parameter metadata, nextTool hints to call resolve_live_parameters, and an authored hint + canonical example shape (when one exists) to copy into update_live_flow. Use search without connectorName/apiName to search operations across connectors and get connection-aware suggestions. Use mode=full only when raw OpenAPI connector metadata is required.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Describe connector
get_live_flowFetch the full native Power Automate flow JSON from the PA API, including the complete flow definition (triggers, actions, parameters, outputs).1 finding
Why it is in this group
- The name "get_live_flow" says "get": a word for reading.
Findings
- Info
The input schema at properties.includeTriggerUrl.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.includeTriggerUrl.description: "...so return the HTTP trigger URL. It is a credential: anyone holding it can run the flow."
Description, as the server wrote it Fetch the full native Power Automate flow JSON from the PA API, including the complete flow definition (triggers, actions, parameters, outputs). Returns the raw properties object exactly as the PA API returns it. Use this to inspect the full definition before calling update_live_flow with a modified definition.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get flow definition
get_live_flow_run_action_outputsRead the recorded inputs and outputs of actions in one flow run.No findings
Why it is in this group
- The name "get_live_flow_run_action_outputs" says "get": a word for reading.
Description, as the server wrote it Read the recorded inputs and outputs of actions in one flow run. Without actionName: the top-level actions (optionally filtered by name). With actionName: every execution of that action across foreach iterations, each with repetitionIndexes, status, error, and resolved inputs/outputs. Use iterationIndex to pin one iteration; omit it for all. TRIGGER PAYLOADS: set trigger=true with a runName to get that run's trigger inputs and outputs. No Compose workaround is needed. TRIGGER CHECKS: pass checkId (from get_live_flow_runs -> triggerChecks.recent[].checkId) to read a trigger evaluation that never became a run — that is how you see WHY a trigger is failing. Do not supply runName with a checkId.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get run action inputs and outputs
get_live_flow_run_errorFetch error details for a specific flow run from the live Power Automate API.No findings
Why it is in this group
- The name "get_live_flow_run_error" says "get": a word for reading.
Description, as the server wrote it Fetch error details for a specific flow run from the live Power Automate API. Lists every failed action with its error code and message to help diagnose what went wrong.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get run error
get_live_flow_runsFetch run history for a flow directly from Power Automate.No findings
Why it is in this group
- The name "get_live_flow_runs" says "get": a word for reading.
Description, as the server wrote it Fetch run history for a flow directly from Power Automate. Returns { runs, runCount, triggerChecks }: each run has name, status, startTime, endTime, trigger name/code, and any top-level error. IMPORTANT — no runs does NOT mean the flow is healthy. A trigger that fires and evaluates to nothing, or fails to evaluate, records a TRIGGER CHECK and never becomes a run. When there are no runs (or when includeTriggerChecks is set) this tool also reports the trigger check history, so "nothing ran" can be told apart from "the trigger has been failing". Read triggerChecks.byStatus before concluding a flow is fine.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List flow runs
get_store_flow[Requires Pro+ plan] Get full details for a single Power Automate flow from the Power Clarity cache.No findings
Why it is in this group
- The name "get_store_flow" says "get": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] Get full details for a single Power Automate flow from the Power Clarity cache. Includes trigger URL, owners, state, run statistics, and governance metadata. Data is from the stored snapshot — not live from the Power Automate API.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get cached flow
get_store_flow_runs[Requires Pro+ plan] Get cached run history for a flow from the Power Clarity store.No findings
Why it is in this group
- The name "get_store_flow_runs" says "get": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] Get cached run history for a flow from the Power Clarity store. Defaults to the last 7 days. Returns startTime, endTime, status, duration (seconds), failedActions, and remediation hint per run. Data is from the stored snapshot — not live from the Power Automate API.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get cached run history
get_store_flow_summary[Requires Pro+ plan] Get aggregated run statistics for a flow from the Power Clarity cache: total runs, success count, failure count, success rate, fail rate, and average/max durat…No findings
Why it is in this group
- The name "get_store_flow_summary" says "get": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] Get aggregated run statistics for a flow from the Power Clarity cache: total runs, success count, failure count, success rate, fail rate, and average/max duration over a time window. Data is from the stored snapshot — not live from the Power Automate API.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get cached run summary
get_store_maker[Requires Pro+ plan] Get details for a single maker from the Power Clarity cache by their key (usually the AAD object ID).No findings
Why it is in this group
- The name "get_store_maker" says "get": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] Get details for a single maker from the Power Clarity cache by their key (usually the AAD object ID). Includes flow/app counts and whether the account has been deleted.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Get maker
list_live_connectionsList Power Platform connections in an environment directly from Power Automate.No findings
Why it is in this group
- The name "list_live_connections" says "list": a word for reading.
Description, as the server wrote it List Power Platform connections in an environment directly from Power Automate. Returns id, displayName, connectorName, environment, createdBy (full object), authenticatedUser, statuses, overallStatus, createdTime, expirationTime, and connectionParameters for each connection. Pass search=<term> to narrow the list and receive a paste-ready connectionReferenceTemplate plus action-side hostTemplate per connection — drop these into update_live_flow's connectionReferences and inputs.host without further edits.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List connections
list_live_environmentsList all Power Platform environments you belong to, directly from Power Automate.No findings
Why it is in this group
- The name "list_live_environments" says "list": a word for reading.
Description, as the server wrote it List all Power Platform environments you belong to, directly from Power Automate. Returns id, displayName, sku, location, and state for each environment. mode=all (default) and mode=member: every environment you are a member of. mode=admin: only those you administer; errors rather than guessing if admin access cannot be determined. isAdmin means you hold the ListAnyFlow permission there — the capability list_live_flows mode=admin needs. It is null, never false, when the platform did not tell us. isMember is true for every environment returned.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List environments
list_live_flowsList Power Automate flows in an environment.No findings
Why it is in this group
- The name "list_live_flows" says "list": a word for reading.
Description, as the server wrote it List Power Automate flows in an environment. Returns id, displayName, state, triggerType, and lastModifiedTime for each flow. mode=owner (default): flows you own plus flows shared with you (personal + team), with full definitions. mode=admin: all flows in the environment (requires an admin account). mode=admin with includeDeleted=true also returns soft-deleted flows (state=Deleted) — the only way to find a deleted flow. If search is provided, results are filtered to flows whose displayName contains the search text. For large environments pagination is time-bounded — if nextLink is returned, pass it as continuationUrl to retrieve the next batch.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List flows
list_skillsSkill bundles: groups of the tools listed here that are used together for one task (diagnose-connection-references, build-flow, debug-flow, monitor-flow, discover, governance).No findings
Why it is in this group
- The name "list_skills" says "list": a word for reading.
Description, as the server wrote it Skill bundles: groups of the tools listed here that are used together for one task (diagnose-connection-references, build-flow, debug-flow, monitor-flow, discover, governance). Returns each bundle's one-line description and tool names. Use it when unsure which tools fit a request; tool_search "skill:<name>" returns the bundle's full guidance and definitions. Non-billable.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List skill bundles
list_store_connections[Requires Pro+ plan] List all Power Platform connections from the Power Clarity cache.No findings
Why it is in this group
- The name "list_store_connections" says "list": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] List all Power Platform connections from the Power Clarity cache.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List cached connections
list_store_environments[Requires Pro+ plan] List all Power Platform environments from the Power Clarity cache.No findings
Why it is in this group
- The name "list_store_environments" says "list": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] List all Power Platform environments from the Power Clarity cache.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List cached environments
list_store_flows[Requires Pro+ plan] List Power Automate flows from the Power Clarity cache.No findings
Why it is in this group
- The name "list_store_flows" says "list": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] List Power Automate flows from the Power Clarity cache. Optionally filter by governance flags (monitor, notification rules). Returns key fields including trigger URL, state, and run failure rate. Data is from the stored snapshot — not live from the Power Automate API.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List cached flows
list_store_makers[Requires Pro+ plan] List all makers (citizen developers / AAD users) from the Power Clarity cache.No findings
Why it is in this group
- The name "list_store_makers" says "list": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] List all makers (citizen developers / AAD users) from the Power Clarity cache.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List makers
list_store_power_apps[Requires Pro+ plan] List all Power Apps canvas apps from the Power Clarity cache.No findings
Why it is in this group
- The name "list_store_power_apps" says "list": a word for reading.
Description, as the server wrote it [Requires Pro+ plan] List all Power Apps canvas apps from the Power Clarity cache.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: List cached apps
resolve_live_parametersResolve a connector action's inputs the way the flow designer does: dropdown options, list and table columns, folder and file pickers — every input in one call, or one with paramet…Reads private dataNo findings
Why it is in this group
- The name "resolve_live_parameters" says "resolve": a word for reading.
What it can reach
- private-dataThe description's first sentence says "resolve" and "table": it reads databases.
Description, as the server wrote it Resolve a connector action's inputs the way the flow designer does: dropdown options, list and table columns, folder and file pickers — every input in one call, or one with parameterName. Reads only: it runs the lookups the designer runs, never an action. Pass values you have in parameters; pass a display name in match to get back the value to write into the flow. An input whose parent is not known yet has status "needs". Inputs inside an object are addressed by key (body/recipient/groupId). Omit connectionName and one is chosen.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Resolve action inputs
tool_searchFind a tool listed here instead of guessing its name, and get its definition.No findings
Why it is in this group
- The name "tool_search" says "search": a word for reading.
Description, as the server wrote it Find a tool listed here instead of guessing its name, and get its definition. Query forms: (1) "skill:<name>" — a whole bundle; call list_skills for the names; (2) "select:name1,name2" — exact tools; (3) free text like "cancel run" — ranked against name and description. Non-billable.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Search tools
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write2
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 15:03 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 10
- Protocol version
- 2025-03-26
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://mcp.flowstudio.app/.well-known/oauth-protected-resource
- Authorization servers
- https://mcp.flowstudio.app
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- no
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 10 tools that change things (2 destructive, 8 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mcp.flowstudio.app/mcp: tools/list returned 30 tools to an anonymous client, including cancel_live_flow_run (destructive), update_live_flow (destructive), report_bug (write), update_store_flow (write), trigger_live_flow (write) and 5 more
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http flowstudio https://mcp.flowstudio.app/mcp --header 'x-api-key: <your-x-api-key>'Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__flowstudio__tool_search",
"mcp__flowstudio__list_skills",
"mcp__flowstudio__list_store_flows",
"mcp__flowstudio__get_store_flow",
"mcp__flowstudio__get_store_flow_runs",
"mcp__flowstudio__get_store_flow_summary",
"mcp__flowstudio__list_store_environments",
"mcp__flowstudio__list_store_makers",
"mcp__flowstudio__get_store_maker",
"mcp__flowstudio__list_store_power_apps",
"mcp__flowstudio__list_store_connections",
"mcp__flowstudio__get_live_flow_runs",
"mcp__flowstudio__get_live_flow_run_error",
"mcp__flowstudio__get_live_flow_run_action_outputs",
"mcp__flowstudio__get_live_flow",
"mcp__flowstudio__list_live_environments",
"mcp__flowstudio__list_live_flows",
"mcp__flowstudio__list_live_connections",
"mcp__flowstudio__describe_live_connector",
"mcp__flowstudio__resolve_live_parameters"
],
"ask": [
"mcp__flowstudio__report_bug",
"mcp__flowstudio__update_store_flow",
"mcp__flowstudio__trigger_live_flow",
"mcp__flowstudio__resubmit_live_flow_run",
"mcp__flowstudio__set_live_flow_state",
"mcp__flowstudio__add_live_flow_to_solution",
"mcp__flowstudio__test_live_connection",
"mcp__flowstudio__create_live_connection"
],
"deny": [
"mcp__flowstudio__cancel_live_flow_run",
"mcp__flowstudio__update_live_flow"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as flowstudio. Review it before you use it.
Capability tags behind 3 rules
- mcp__flowstudio__trigger_live_flow untrusted-input
- mcp__flowstudio__resubmit_live_flow_run untrusted-input
- mcp__flowstudio__resolve_live_parameters private-data
