Agent access & MCP

What MCP means in Mockflow

An Agent Access Key connects one approved MCP client to Mockflow. A client might be Codex, Claude Code, Visual Studio Code, or MCP Inspector. The key is limited to the workspace information you choose. It does not give the client your normal browser session.

Keys are read-only by default. A read-only client can see basic details about a selected diagram, such as its title and status. It can read the saved architecture, scenarios, run evidence, and other approved material only after the diagram has a checkpoint. It cannot read or change the working draft.

Create an Agent Access Key

1. 1Open your account menu, choose Settings, then open Agent Access Keys.
2. 2Select Create Agent Access Key and give it a name that identifies the client and purpose.
3. 3Choose only the diagrams and kinds of information needed for the task. Start with structure only unless the client genuinely needs approved examples or real values.
4. 4Keep the key read-only unless the client must change a draft. Write-capable keys need extra confirmation and expire within 14 days.
5. 5Create the key and copy it into the client's secure secret setting. The plaintext key is shown once.

Connect the client

Use the Mockflow MCP server address and store the key in the secure credential feature provided by your client. Never put the plaintext key in a repository, project file, URL, screenshot, ticket, or chat.

Supported client matrix

The table lists the client versions Mockflow has tested. A newer client may also work, but use a tested range when predictable setup is important.

Configure a supported client

Choose your client below and follow its steps. The examples use a placeholder for the key so the secret does not end up in copied project files.

# Load MOCKFLOW_AGENT_ACCESS_KEY from your approved secret store.
npx @modelcontextprotocol/inspector@0.21.2 \
  --cli "https://mockflow.app/mcp/v2" \
  --transport http \
  --header "Authorization: Bearer ${MOCKFLOW_AGENT_ACCESS_KEY}"

{
  "mcpServers": {
    "mockflow": {
      "type": "http",
      "url": "https://mockflow.app/mcp/v2",
      "headers": {
        "Authorization": "Bearer ${MOCKFLOW_AGENT_ACCESS_KEY}"
      }
    }
  }
}

{
  "servers": {
    "mockflow": {
      "type": "http",
      "url": "https://mockflow.app/mcp/v2",
      "headers": {
        "Authorization": "Bearer ${input:mockflow-agent-access-key}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "mockflow-agent-access-key",
      "description": "Mockflow agent access key",
      "password": true
    }
  ]
}

# Load MOCKFLOW_AGENT_ACCESS_KEY from your approved secret store.
codex mcp add mockflow \
  --url "https://mockflow.app/mcp/v2" \
  --bearer-token-env-var "MOCKFLOW_AGENT_ACCESS_KEY"

Choose the smallest useful access

Select the fewest diagrams and information types that let the client complete its task. Structure-only access is enough for understanding components and connections. Approved examples are useful for explaining a known case. Real stored values should be used only when an owner has confirmed that the client is allowed to see them.

A read-only key can follow the newest checkpoint or stay fixed to one particular checkpoint. Follow the newest checkpoint when the client should see later reviewed changes. Fix the key to one checkpoint when a review must keep using exactly the same saved version.

Checkpoints and MCP access

A checkpoint is the boundary between working privately in a draft and making a stable version available to read-only MCP access. Creating a diagram does not create a checkpoint automatically.

Optional guarded editing

Guarded editing may be available in your Mockflow environment. It is off by default and needs three separate choices: a short-lived key with the right editing access, selected diagrams, and the workspace switch that allows MCP draft changes.

With write access, a client can author a complete new diagram from your description or update a permitted draft. It can add and arrange components, connect them, describe scenarios, and fill in supporting diagram information. It can read the current working draft even when the diagram has no checkpoint. Mockflow still checks every proposed change and rejects work that no longer matches the latest saved draft.

Some environments can also allow a permitted client to run a scenario for temporary debugging. Creating or changing a draft does not approve or publish it.

A client can validate the exact saved graph using its current draft marker, without downloading and sending the full document back. Validation errors identify all bounded input problems by public field path, so missing, unknown, or mistyped fields can be corrected in one pass.

Example prompts

Tell the client what you want the system to do, which important parts or failure routes to include, and whether it should create a new diagram or improve an existing one. Ask it to keep the result as a draft and explain its changes so you can review them in Mockflow.

Rotate, narrow, or revoke access

Settings shows active, expired, and revoked keys. You can make a key read-only, narrow what it can reach, rotate it to issue a replacement, or revoke it completely. Revocation stops the next request and cannot be undone.

Errors and troubleshooting

Continue learning

Read Scenarios and Runs & events to understand the system story an approved client may be allowed to read.