Is the Michal Lefler Secureflows MCP server down?

• Added "type":"string" to untyped parameters: body. Change to number/boolean/array where that's what you accept. (verify)

{
  "name": "auth_session_callback",
  "description": "**Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header.\n\n1. Verifies **`firebaseToken`** (Firebase ID token).\n2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`).\n3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for\n   **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional\n   **`payload`** (URL-encoded JSON **object**, d",
  "inputSchema": {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "connection",
      "query"
    ],
    "properties": {
      "auth": {
        "type": "object",
        "properties": {}
      },
      "body": {
        "type": "string"
      },
      "query": {
        "type": "object",
        "required": [
          "firebaseToken",
          "client_redirect_uri",
          "workspace_name",
          "app_id"
        ],
        "properties": {
          "state": {
            "type": "string"
          },
          "app_id": {
            "type": "string"
          },
          "payload": {
            "type": "string",
            "description": "JSON object as a string (e.g. `{\"a\":1}`), URL-encoded. Must parse to a JSON object (not an array or primitive).\nDefault when omitted is `{}`. Must not be combined with `session_token` on the same request.\n"
          },
          "ttl_seconds": {
            "type": "integer",
            "maximum": 604800,
            "minimum": 0,
            "description": "Session lifetime in seconds (default 0 = unlimited; allowed values: 0 or 60–604800)"
          },
          "firebaseToken": {
            "type": "string"
          },
          "session_token": {
            "type": "string",
            "description": "Previous session JWT (may be expired); signature must validate. When present, the server renews this\nsession instead of creating a new one. Must not be combined with `payload` on the same request.\nURL-encode the value; very long URLs may exceed browser or proxy limits.\n"
          },
          "workspace_name": {
            "type": "string"
          },
          "client_redirect_uri": {
            "type": "string",
            "format": "uri"
          }
        }
      },
      "params": {
        "type": "object",
        "properties": {}
      },
      "connection": {
        "type": "object",
        "required": [
          "host"
        ],
        "properties": {
          "host": {
            "type": "string",
            "format": "uri",
            "description": "secureFlows base URL, for example https://api.example.com"
          },
          "appId": {
            "type": "string",
            "description": "Optional secureFlows app id used as a default for hosted login tools"
          },
          "workspaceName": {
            "type": "string",
            "description": "Optional workspace name used as a default for tools that need it"
          }
        }
      }
    }
  },
  "title": "Session login callback (redirect)"
}

• Added "type":"string" to untyped parameters: body. Change to number/boolean/array where that's what you accept. (verify)
• Added readOnlyHint: false, destructiveHint: true, idempotentHint: true (inferred from the name). (verify)

{
  "name": "delete_sessions_delete_key",
  "description": "Removes `key` from the session payload and returns `true` if the key existed.\n\nSource: DELETE /api/v1/sessions/delete/{key}\nRequires `auth.sessionToken` and forwards it as a Bearer token.\nPrefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.",
  "inputSchema": {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "connection",
      "params"
    ],
    "properties": {
      "auth": {
        "type": "object",
        "required": [
          "sessionToken"
        ],
        "properties": {
          "sessionToken": {
            "type": "string",
            "description": "secureFlows session token"
          }
        }
      },
      "body": {
        "type": "string"
      },
      "query": {
        "type": "object",
        "properties": {}
      },
      "params": {
        "type": "object",
        "required": [
          "key"
        ],
        "properties": {
          "key": {
            "type": "string",
            "description": "Payload key to delete"
          }
        }
      },
      "connection": {
        "type": "object",
        "required": [
          "host"
        ],
        "properties": {
          "host": {
            "type": "string",
            "format": "uri",
            "description": "secureFlows base URL, for example https://api.example.com"
          },
          "appId": {
            "type": "string",
            "description": "Optional secureFlows app id used as a default for hosted login tools"
          },
          "workspaceName": {
            "type": "string",
            "description": "Optional workspace name used as a default for tools that need it"
          }
        }
      }
    }
  },
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "idempotentHint": true
  },
  "title": "Delete a key from the session payload"
}

• Added "type":"string" to untyped parameters: body. Change to number/boolean/array where that's what you accept. (verify)
• Added readOnlyHint: true (inferred from the name). (verify)

{
  "name": "get_auth_logout",
  "description": "Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`).\n\nUse this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a\n**first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when\nthird-party cookies are blocked.\n\n**Critical client rules:**\n- Clear your in-app `sessionToken` state **before** navigating.\n- **Never** include `session_token` inside `redirect_uri` (that would silently renew and ",
  "inputSchema": {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "connection",
      "query"
    ],
    "properties": {
      "auth": {
        "type": "object",
        "properties": {}
      },
      "body": {
        "type": "string"
      },
      "query": {
        "type": "object",
        "required": [
          "session_token",
          "redirect_uri"
        ],
        "properties": {
          "redirect_uri": {
            "type": "string",
            "format": "uri",
            "description": "Where to redirect after logout completes"
          },
          "session_token": {
            "type": "string",
            "description": "SESSION JWT to invalidate (URL-encoded)"
          }
        }
      },
      "params": {
        "type": "object",
        "properties": {}
      },
      "connection": {
        "type": "object",
        "required": [
          "host"
        ],
        "properties": {
          "host": {
            "type": "string",
            "format": "uri",
            "description": "secureFlows base URL, for example https://api.example.com"
          },
          "appId": {
            "type": "string",
            "description": "Optional secureFlows app id used as a default for hosted login tools"
          },
          "workspaceName": {
            "type": "string",
            "description": "Optional workspace name used as a default for tools that need it"
          }
        }
      }
    }
  },
  "annotations": {
    "readOnlyHint": true
  },
  "title": "Log out (browser redirect helper; first-party cookie clearing)"
}