Repository navigation
AppFlowy MCP 2.0.1
This patch ships the reviewed authentication, retry-safety and maintenance fixes.
- Reject persisted OAuth tokens for removed allow-list members; require a verified Google email and AppFlowy scope.
- Preserve resource binding and honor narrowed scopes during token refresh.
- Write OAuth state through private temporary files and omit credential-bearing validation details from logs.
- Correct mutation-tool retry hints, DateTime validation, doctor results, custom loopback ports and malformed token handling.
- Remove unused/duplicate code and obsolete documentation; organize tests and provide durable architecture and maintainer guidance.
OAuth sessions without a stored subject or the AppFlowy scope require a new sign-in. Removed allow-list members cannot reuse stored tokens. Shared-secret and stdio users keep their existing connection configuration.
Validated with 122 offline tests, Linux/Windows clean installs, Docker stdio/HTTP, the commercial 0.20.5 disposable lifecycle/browser suite, and the decoder matrix. SaaS and real Google/AI deployment checks remain separately documented limits.
PyPI remains disabled. Public amd64/arm64 container and official MCP Registry publication succeeded.
uvx --from git+https://github.com/Rahulk644/Appflowy-MCP-Server@v2.0.1 appflowy-mcp --env-file /absolute/path/to/.envSee migration notes and compatibility.
docker run --rm -i --env-file .env ghcr.io/rahulk644/appflowy-mcp-server:2.0.1 appflowy-mcp