# io.roadflow/roadflow Create and edit roadmaps with JSON or markup; share edit and view links from AI agents. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** io.roadflow - **License:** Unknown - **Endpoints:** streamable-http https://roadflow.io/mcp - **Source:** https://roadflow.io/mcp - **Endpoint health:** reachable (last checked 2026-09-23T12:12:41.808Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 3 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-23T12:12:41.808Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 43 declared. Observed from a live `tools/list` probe. - `roadflow_new` — Create an ephemeral in-memory roadflow workspace (default). Optional seed JSON and/or markup. No cloud id until create_shared. - `roadflow_status` — Return mode, ids, URLs, and road/step counts for the current MCP session workspace. - `roadflow_get` — Return the current workspace as JSON and/or markup. - `roadflow_apply_json` — Replace workspace state with normalized JSON (serializeState shape). In shared edit mode, saves to the cloud automatically. - `roadflow_apply_markup` — Replace roads via friendly markup (same as the editor panel). Shared edit mode auto-saves. - `roadflow_open_shared` — Load a cloud map by edit or view id into this session. View links are read-only. - `roadflow_create_shared` — Persist the current workspace to the cloud (permanent share). Returns editUrl (play/edit/share further) and viewUrl (visual canvas, read-only). Prefer viewUrl w - `roadflow_export_json` — Export the current workspace as JSON (serializeState). - `roadflow_export_markup` — Export the current workspace as friendly markup. - `roadflow_export_csv` — Export steps as CSV (road, goal, lane, step, notes, type, status, position, date). - `roadflow_list_versions` — List shared-map version checkpoints (newest first). Relative indexes: -1 = newest. Requires a shared edit workspace (not view-only). - `roadflow_get_version` — Load one shared-map version by relative index (e.g. -1 newest, -2 previous). Returns JSON state. Does not change the live map or workspace unless load=true. - `roadflow_discard` — Clear the in-memory workspace for this MCP session (does not delete cloud maps). - `artifacts_new` — Create an ephemeral in-memory Artifacts graph workspace. Optional seed JSON (serializeState shape: nodes + labels). No cloud id until artifacts_create_shared. - `artifacts_status` — Return mode, ids, /artifacts/?id= URLs, and node/label counts. - `artifacts_get` — Return the current Artifacts workspace as JSON. - `artifacts_apply_json` — Replace (or merge) the Artifacts graph with normalized JSON. Shared edit mode auto-saves to the cloud. - `artifacts_open_shared` — Load a cloud Artifacts graph by edit or view id. View links are read-only. - `artifacts_create_shared` — Persist the current Artifacts workspace to the cloud. Returns editUrl and viewUrl under /artifacts/. - `artifacts_export_json` — Export the current Artifacts workspace as JSON (serializeState). - `artifacts_list_versions` — List shared Artifacts version checkpoints (newest first). Requires a shared edit workspace. - `artifacts_get_version` — Load one shared Artifacts version by relative index (-1 newest). Optional load=true replaces the MCP workspace (does not save). - `artifacts_discard` — Clear the in-memory Artifacts workspace for this MCP session (does not delete cloud graphs or the Plans workspace). - `model_new` — Create a Model project in MySQL (parameter register). Allocates a view id (mv-…) when omitted and returns viewUrl. Optional seed: title, calendar, streams, axes - `model_open` — Bind this MCP session to an existing Model project (edit or view id). View ids are read-only. - `model_status` — Counts, rev, and /model/?id= URLs for the bound project (or pass id). - `model_get` — Hydrate records from MySQL. include=summary (default counts), dictionaries, parameters, observations, edges, or all. Prefer model_upsert_observation to change o - `model_discard` — Unbind the Model project from this MCP session. Does not delete MySQL rows. - `model_patch_project` — Update title, calendar, viewId, streams, axes, phases, parameterSets, and/or chains. Send If-Match via rev. Replaces each provided dictionary in full. - `model_list_parameters` — List parameter catalog rows. Optional filters: streamId, role, layer, primaryOwner. - `model_get_parameter` — One catalog row plus its observations (facts). - `model_upsert_parameter` — Create or patch one parameter definition (not observations). Pass rev for If-Match on update. - `model_upsert_parameters` — Create or patch many catalog rows (cap 400). Same body shape as model_upsert_parameter. continueOnError returns per-row errors; otherwise one transaction. - `model_delete_parameter` — Delete a parameter and its observations (cascade). - `model_list_observations` — List facts. Filter by parameterId, setId, evidenceStatus. Sets are a column (Base/Downside/Upside), not an axis. - `model_upsert_observation` — Create or replace one fact (parameterId + scope + setId). Example: Base P2 facility MW. Do not write CALC-computed values; only IN facts or CALC overrides (valu - `model_upsert_observations` — Create or replace many facts (cap 400). Same body shape as model_upsert_observation. Rejects CALC outputs unless valueOverride. continueOnError returns per-row - `model_delete_observation` — Delete one fact by parameterId + scope/scopeKey + setId. - `model_list_edges` — Manual lineage edges only (SOURCE/FLOW/INTERFACE). FORMULA edges are derived from formulas on load — not stored. - `model_upsert_edge` — Create or patch a manual SOURCE, FLOW, or INTERFACE edge. FORMULA is rejected. - …and 3 more ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"roadflow\": {\n \"type\": \"http\",\n \"url\": \"https://roadflow.io/mcp\"\n }\n }\n}" ``` ## Blast radius Extensive blast radius — deletes data; runs on someone else's infrastructure. - Floor 35, ceiling 59 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.roadflow%2Froadflow - Install plan: https://forgeregistry.com/api/v1/packages/io.roadflow%2Froadflow/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.roadflow%2Froadflow - HTML page: https://forgeregistry.com/registry/io.roadflow%2Froadflow - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.