Install
$ agentstack add mcp-cyanheads-workflows-mcp-server ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
@cyanheads/workflows-mcp-server Store, query, and create YAML workflow playbooks for LLM agents via MCP. STDIO or Streamable HTTP. 4 Tools
[](./CHANGELOG.md) [](./LICENSE) [](https://github.com/users/cyanheads/packages/container/package/workflows-mcp-server) [](https://modelcontextprotocol.io/) [](https://www.npmjs.com/package/@cyanheads/workflows-mcp-server) [](https://www.typescriptlang.org/) [](https://bun.sh/)
[](https://github.com/cyanheads/workflows-mcp-server/releases/latest/download/workflows-mcp-server.mcpb) [](https://cursor.com/en/install-mcp?name=workflows-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBjeWFuaGVhZHMvd29ya2Zsb3dzLW1jcC1zZXJ2ZXIiXX0=) [](https://vscode.dev/redirect?url=vscode:mcp/install?%7B%22name%22%3A%22workflows-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40cyanheads%2Fworkflows-mcp-server%22%5D%7D)
[](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
Tools
Four tools covering the full workflow library lifecycle — discovery, retrieval, and creation for both permanent and temporary workflows:
| Tool | Description | |:-----|:------------| | workflow_list | List all permanent workflows in the index, with optional category and tag filters. | | workflow_get | Retrieve a complete workflow definition by name, with global instructions prepended. | | workflow_create | Write a new permanent workflow YAML to the library. | | workflow_create_temp | Write a temporary one-shot workflow, indexed but excluded from list results. |
workflow_list
List permanent workflows from the in-memory index.
- Optional category filter (case-insensitive substring match)
- Optional tag filter (AND match — all listed tags must be present)
- Set
includeTools: trueto surface the uniqueserver/toolpairs used across each workflow's steps - Temporary workflows are excluded; results sorted by name then version descending
workflow_get
Retrieve a complete workflow by name, including the global instructions document.
- Semver-aware: omit
versionto get the highest available match; specify a version for an exact lookup - Returns the full workflow YAML structure with all steps and metadata
- Injects the
global_instructions.mdcontent asglobalInstructions— apply these when executing the workflow;nullwhen the file is absent - Temporary workflows are accessible here even though excluded from
workflow_list - Template placeholders (
{{input.foo}},{{steps.X.output.Y}}) are returned verbatim — the server never interpolates them
workflow_create
Write a new permanent workflow to the library.
- Workflow stored at
categories//-workflow.yaml - Rejects if
name@versionalready exists — bump the version to create a new revision - Server stamps
created_dateandlast_updated_dateautomatically - Index and snapshot rebuilt after write; filesystem watcher also fires (idempotent, debounced)
workflow_create_temp
Write a throwaway workflow to the temp/ directory.
- No conflict check — temp workflows are intentionally ephemeral and overwriteable
- Indexed and accessible via
workflow_getbut excluded fromworkflow_listresults - Useful for one-shot plans, short-lived scaffolding, or session-specific orchestration steps
Features
Built on @cyanheads/mcp-ts-core:
- Declarative tool definitions — single file per primitive, framework handles registration and validation
- Unified error handling — handlers throw, framework catches, classifies, and formats
- Pluggable auth:
none,jwt,oauth - Swappable storage backends:
in-memory,filesystem,Supabase,Cloudflare KV/R2/D1 - Structured logging with optional OpenTelemetry tracing
- STDIO and Streamable HTTP transports
Workflow library:
- In-memory index keyed by
name@version, built at startup fromworkflows-yaml/categories/recursively - Semver-aware lookup — latest version returned when version is omitted
- Filesystem watcher (Node.js
fs.watchrecursive) rebuilds the index on any add/change/remove; debounced to avoid thrash - YAML validated at index time — invalid files are skipped and logged, never crash the server
_index.jsonsnapshot written on every rebuild for external tooling and debugging- Configurable
WORKFLOWS_DIR,GLOBAL_INSTRUCTIONS_PATH, and debounce interval
Agent-friendly output:
workflow_getalways includesglobalInstructionsalongside the workflow — no second call needed- Discriminated
sourcefield (permanent|temp) on everyworkflow_getresponse - Typed error contracts with structured
reasoncodes (not_found,version_not_found,already_exists,index_unavailable) so callers can branch on error type rather than parsing messages workflow_listwithincludeTools: truesurfaces all MCP server/tool dependencies at a glance
Getting started
No API keys required. The server reads from a local workflows-yaml/ directory by default.
Add the following to your MCP client configuration file:
{
"mcpServers": {
"workflows-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/workflows-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"WORKFLOWS_DIR": "/absolute/path/to/your/workflows-yaml"
}
}
}
}
Or with npx (no Bun required):
{
"mcpServers": {
"workflows-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/workflows-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"WORKFLOWS_DIR": "/absolute/path/to/your/workflows-yaml"
}
}
}
}
Or with Docker:
{
"mcpServers": {
"workflows-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-v", "/absolute/path/to/your/workflows-yaml:/workflows-yaml",
"-e", "WORKFLOWS_DIR=/workflows-yaml",
"ghcr.io/cyanheads/workflows-mcp-server:latest"
]
}
}
}
For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcp
Seed workflows
The repository ships a workflows-yaml/ directory with example workflows organized under categories/. These are ready to use as a starting point. The workflows-yaml/global_instructions.md file contains instructions the server prepends to every workflow_get response — edit it to set global guidance for your agent.
Prerequisites
- Bun v1.3.2 or higher (or Node.js v24+).
- A local directory containing YAML workflow files (or use the bundled
workflows-yaml/seed).
Installation
- Clone the repository:
git clone https://github.com/cyanheads/workflows-mcp-server.git
- Navigate into the directory:
cd workflows-mcp-server
- Install dependencies:
bun install
- Configure environment:
cp .env.example .env
# edit .env if needed — most settings have defaults
Configuration
| Variable | Description | Default | |:---------|:------------|:--------| | WORKFLOWS_DIR | Absolute or relative path to the workflows root directory. | ./workflows-yaml | | GLOBAL_INSTRUCTIONS_PATH | Path to the global instructions markdown file. Derives from WORKFLOWS_DIR when not set. | /global_instructions.md | | WATCHER_DEBOUNCE_MS | Milliseconds to debounce filesystem change events before rebuilding the index. | 500 | | MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio | | MCP_HTTP_PORT | Port for HTTP server. | 3010 | | MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none | | MCP_LOG_LEVEL | Log level (RFC 5424). | info | | OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See [.env.example](./.env.example) for the full list of optional overrides.
Running the server
Local development
- Build and run:
```sh # One-time build bun run rebuild
# Run the built server bun run start:stdio # or bun run start:http ```
- Run checks and tests:
``sh bun run devcheck # Lint, format, typecheck, security bun run test # Vitest test suite bun run lint:mcp # Validate MCP definitions against spec ``
Docker
docker build -t workflows-mcp-server .
docker run --rm \
-v /path/to/workflows-yaml:/workflows-yaml \
-e WORKFLOWS_DIR=/workflows-yaml \
-p 3010:3010 \
workflows-mcp-server
The Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/workflows-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
Project structure
| Directory | Purpose | |:----------|:--------| | src/index.ts | createApp() entry point — registers tools and inits the workflow index service. | | src/config/ | Server-specific environment variable parsing and validation with Zod. | | src/mcp-server/tools/ | Tool definitions (*.tool.ts). | | src/services/workflow-index/ | WorkflowIndexService — YAML parsing, index build, watcher, semver lookup, write helpers. | | tests/ | Unit and integration tests mirroring src/. | | workflows-yaml/ | Seed workflow library — categories/ for permanent workflows, temp/ for throwaway ones, global_instructions.md for agent-global guidance. |
Development guide
See [CLAUDE.md](./CLAUDE.md) for development guidelines and architectural rules. The short version:
- Handlers throw, framework catches — no
try/catchin tool logic - Use
ctx.logfor request-scoped logging - Register new tools via the barrel in
src/mcp-server/tools/definitions/index.ts - Filesystem operations go through
WorkflowIndexService, not directly in tool handlers
Contributing
Issues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run test
License
Apache-2.0 — see [LICENSE](LICENSE) for details.
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: cyanheads
- Source: cyanheads/workflows-mcp-server
- License: Apache-2.0
- Homepage: https://www.npmjs.com/package/@cyanheads/workflows-mcp-server
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.