(CODUX-105) Expose MCP node-flow automation

docs-web/architecture/mcp-server.md

@@ -95,6 +95,7 @@ router
   .register("manage_scheduler",   h.handleManageScheduler)
   .register("scheduler_code_ux",          h.handleScheduler)
   .register("manage_agents",      h.handleManageAgents)
+  .register("manage_node_flows",  h.handleManageNodeFlows)
   .register("manage_memory",      h.handleManageMemory)
   .register("manage_skills",      h.handleManageSkills)
   .register("manage_settings",    h.handleManageSettings)
@@ -157,6 +158,7 @@ Each tool has an entry in `settings.mcpTools` (`McpToolToggle[]`). Defaults:
   { "name": "manage_scheduler",    "enabled": true, "isInternal": true },
   { "name": "scheduler_code_ux",           "enabled": true, "isInternal": true },
   { "name": "manage_agents",       "enabled": true, "isInternal": true },
+  { "name": "manage_node_flows",   "enabled": true, "isInternal": true },
   { "name": "manage_memory",       "enabled": true, "isInternal": true },
   { "name": "manage_skills",       "enabled": true, "isInternal": true },
   { "name": "search_knowledge",    "enabled": true, "isInternal": true },
@@ -197,6 +199,13 @@ skill markdown import/export, agent storage attachment management, and the autho
 `SkillActions`. `search_skills` is registered separately as a retrieval tool and returns concise
 ranked summaries with IDs and metadata. Full markdown retrieval stays behind `manage_skills`.
 
+## Node flow dispatch
+
+`manage_node_flows` routes through `NodeFlowActions` and delegates to `NodeFlowService` for graph
+validation, CRUD persistence, runtime execution, run inspection, and flow-backed agent skill
+attachments. The MCP layer applies optional widget schemas into submitted graph specs and masks
+secret-shaped graph/run fields in responses.
+
 ## Connection registry
 
 The `ConnectionRegistry` tracks every MCP client that connects. Each entry records:

docs-web/content/docs/architecture-mcp-server.mdx

@@ -95,6 +95,7 @@ router
   .register("manage_scheduler",   h.handleManageScheduler)
   .register("scheduler_code_ux",          h.handleScheduler)
   .register("manage_agents",      h.handleManageAgents)
+  .register("manage_node_flows",  h.handleManageNodeFlows)
   .register("manage_memory",      h.handleManageMemory)
   .register("manage_skills",      h.handleManageSkills)
   .register("manage_settings",    h.handleManageSettings)
@@ -157,6 +158,7 @@ Each tool has an entry in `settings.mcpTools` (`McpToolToggle[]`). Defaults:
   { "name": "manage_scheduler",    "enabled": true, "isInternal": true },
   { "name": "scheduler_code_ux",           "enabled": true, "isInternal": true },
   { "name": "manage_agents",       "enabled": true, "isInternal": true },
+  { "name": "manage_node_flows",   "enabled": true, "isInternal": true },
   { "name": "manage_memory",       "enabled": true, "isInternal": true },
   { "name": "manage_skills",       "enabled": true, "isInternal": true },
   { "name": "search_knowledge",    "enabled": true, "isInternal": true },
@@ -197,6 +199,13 @@ skill markdown import/export, agent storage attachment management, and the autho
 `SkillActions`. `search_skills` is registered separately as a retrieval tool and returns concise
 ranked summaries with IDs and metadata. Full markdown retrieval stays behind `manage_skills`.
 
+## Node flow dispatch
+
+`manage_node_flows` routes through `NodeFlowActions` and delegates to `NodeFlowService` for graph
+validation, CRUD persistence, runtime execution, run inspection, and flow-backed agent skill
+attachments. The MCP layer applies optional widget schemas into submitted graph specs and masks
+secret-shaped graph/run fields in responses.
+
 ## Connection registry
 
 The `ConnectionRegistry` tracks every MCP client that connects. Each entry records:

docs-web/content/docs/developer-management-actions.mdx

@@ -1,7 +1,7 @@
 # Management actions
 
 Code UX exposes **one MCP tool per management domain** — `manage_projects`, `manage_sprints`,
-`manage_tasks`, `manage_quicksprints`, `manage_scheduler`, `manage_agents`, `manage_memory`,
+`manage_tasks`, `manage_quicksprints`, `manage_scheduler`, `manage_agents`, `manage_node_flows`, `manage_memory`,
 `manage_settings`, `manage_preview`, `manage_chat_providers`, and `manage_telemetry` — each with a set of
 **actions**. This page is the complete matrix. (See [MCP tools](/docs/developer-mcp-tools) for the tool list and
 schemas.)

docs-web/content/docs/developer-mcp-tools.mdx

@@ -2,7 +2,7 @@
 
 Code UX is also an MCP server. When connected, it advertises a set of **management tools** that an
 MCP client (or another agent) can call to drive projects, sprints, tasks, agents, memory, persistent
-skills, settings, previews, chat connectors, and telemetry. This page is the exact contract: the tool list, each
+skills, node flows, settings, previews, chat connectors, and telemetry. This page is the exact contract: the tool list, each
 tool's `action` enum, input shape, approval rules, and the error model.
 
 > **Server identity:** the server identifies as `code-ux`, with the version matching the installed
@@ -47,6 +47,7 @@ action-specific fields, and an optional `approval` object for destructive action
 | `manage_scheduler` | orchestration | Create and run scheduled sprints, quicksprints, and messages. |
 | `scheduler_code_ux` | orchestration | Agent-owned wakeups and task reruns with restricted list/schedule/cancel actions. |
 | `manage_agents` | agents & memory | Manage agent presets and sync them to project markdown. |
+| `manage_node_flows` | agents & memory | Manage reusable node workflows, run them, and attach them as agent skills. |
 | `manage_memory` | agents & memory | Inspect, search, promote, and re-embed short/long-term memory. |
 | `manage_skills` | agents & memory | Manage persistent skill storages, skill markdown, and agent storage attachments. |
 | `search_knowledge` | agents & memory | Semantic search over the knowledge base subscribed to the caller. |
@@ -69,6 +70,7 @@ Every tool requires `runtimeRoles: ["project_manager"]` and is enabled by defaul
 | `manage_scheduler` | `list`, `create`, `update`, `delete`, `run_due`, `schedule_sprint`, `schedule_quicksprint`, `schedule_chat` |
 | `scheduler_code_ux` | `list`, `schedule_wakeup`, `schedule_task`, `cancel` |
 | `manage_agents` | `list`, `get`, `create`, `update`, `delete`, `sync` |
+| `manage_node_flows` | `list`, `get`, `create`, `update`, `delete`, `validate`, `run`, `list_runs`, `get_run`, `attach_to_agent`, `detach_from_agent` |
 | `manage_memory` | `list`, `get`, `count`, `create`, `update`, `delete`, `search`, `promote`, `get_map`, `model_status`, `start_reembed` |
 | `manage_skills` | `authoring_prompt`, `list_storages`, `get_storage`, `create_storage`, `update_storage`, `delete_storage`, `reset_storage`, `list_agent_storages`, `attach_storage`, `detach_storage`, `list_skills`, `get_skill`, `create_skill`, `update_skill`, `delete_skill`, `import_markdown`, `export_markdown` |
 | `manage_settings` | `get_system`, `get_project_override`, `resolve_project_effective`, `get_sprint_override`, `resolve_sprint_effective`, `replace_system_settings`, `patch_system_setting`, `replace_project_settings`, `patch_project_setting`, `reset_project_settings`, `replace_sprint_settings`, `patch_sprint_setting`, `reset_sprint_settings`, `export_settings_bundle`, `apply_settings_bundle` |
@@ -98,6 +100,20 @@ entries created through `manage_scheduler`, or entries created by another agent.
 does not expose `run_due`, arbitrary updates, recurrence editing, sprint or quicksprint scheduling,
 memory remediation, or global scheduler destructive controls.
 
+## Node flows
+
+`manage_node_flows` exposes project node workflows through MCP. It supports graph validation, CRUD,
+runtime execution, run inspection, and flow-backed agent skill attachments.
+
+Create and update calls validate the structured graph before repository writes. `run` delegates to the
+node-flow runtime through `NodeFlowService.runFlow`, and `delete` requires the normal approval
+handshake. Responses mask secret-shaped graph data, inputs, and outputs before returning them to MCP
+clients.
+
+Agents should build Code UX-adapted node flows rather than cloning n8n workflows one-to-one. Graphs
+should include dynamic widget schemas for editable graph inputs and node fields; callers can provide
+`widgets` as a graph-level `{ fields: [...] }` schema or as node-id keys mapped to node widget schemas.
+
 ## Approval handshake (destructive actions)
 
 Destructive and mutating actions require a two-step confirmation. The first call returns an approval

docs-web/content/docs/developer-settings-reference.mdx

@@ -292,6 +292,7 @@ Both reflection loops are disabled by default. When enabled, planning and QA str
   { "name": "manage_quicksprints", "enabled": true, "isInternal": true },
   { "name": "manage_scheduler",    "enabled": true, "isInternal": true },
   { "name": "manage_agents",       "enabled": true, "isInternal": true },
+  { "name": "manage_node_flows",   "enabled": true, "isInternal": true },
   { "name": "manage_memory",       "enabled": true, "isInternal": true },
   { "name": "search_knowledge",    "enabled": true, "isInternal": true },
   { "name": "manage_settings",     "enabled": true, "isInternal": true },

docs-web/content/docs/registry.ts

@@ -248,14 +248,14 @@ export const docsRegistry: Record<DocsSlug, DocsRegistryEntry> = {
     path: '/docs/developer-mcp-tools',
     section: 'Developer Reference',
     title: "MCP tools",
-    description: "Code UX is also an MCP server. When connected, it advertises a set of management tools that an MCP client (or another agent) can call to drive projects, sprints, tasks, agents, memory, persistent skills, settings, pre...",
+    description: "Code UX is also an MCP server. When connected, it advertises a set of management tools that an MCP client (or another agent) can call to drive projects, sprints, tasks, agents, node flows, memory, persistent skills...",
   },
   'developer-management-actions': {
     id: 'developer-management-actions',
     path: '/docs/developer-management-actions',
     section: 'Developer Reference',
     title: "Management actions",
-    description: "Code UX exposes one MCP tool per management domain — manage_projects, manage_sprints, manage_tasks, manage_quicksprints, manage_scheduler, manage_agents, manage_memory, manage_settings, manage_preview, manage_chat_pro...",
+    description: "Code UX exposes one MCP tool per management domain — manage_projects, manage_sprints, manage_tasks, manage_quicksprints, manage_scheduler, manage_agents, manage_node_flows, manage_memory, manage_settings, manage_preview...",
   },
   'developer-http-api': {
     id: 'developer-http-api',

docs-web/content/docs/user-mcp-clients.mdx

@@ -125,6 +125,7 @@ domain**, plus `search_knowledge`:
 | `manage_quicksprints` | Manage quicksprint templates and execute them. |
 | `manage_scheduler` | Create and run scheduled sprints, quicksprints, and messages. |
 | `manage_agents` | Manage agent presets and sync them to project markdown. |
+| `manage_node_flows` | Manage reusable node workflows, run them, and attach them as agent skills. |
 | `manage_memory` | Inspect, search, promote, and re-embed memory. |
 | `search_knowledge` | Semantic search over the caller's subscribed knowledge base. |
 | `manage_settings` | Get/resolve/patch/replace/reset system, project, and sprint settings. |

docs-web/developer/management-actions.md

@@ -1,7 +1,7 @@
 # Management actions
 
 Code UX exposes **one MCP tool per management domain** — `manage_projects`, `manage_sprints`,
-`manage_tasks`, `manage_quicksprints`, `manage_scheduler`, `manage_agents`, `manage_memory`,
+`manage_tasks`, `manage_quicksprints`, `manage_scheduler`, `manage_agents`, `manage_node_flows`, `manage_memory`,
 `manage_settings`, `manage_preview`, `manage_chat_providers`, and `manage_telemetry` — each with a set of
 **actions**. This page is the complete matrix. (See [MCP tools](/docs/developer-mcp-tools) for the tool list and
 schemas.)

docs-web/developer/mcp-tools.md

@@ -2,7 +2,7 @@
 
 Code UX is also an MCP server. When connected, it advertises a set of **management tools** that an
 MCP client (or another agent) can call to drive projects, sprints, tasks, agents, memory, persistent
-skills, settings, previews, chat connectors, and telemetry. This page is the exact contract: the tool list, each
+skills, node flows, settings, previews, chat connectors, and telemetry. This page is the exact contract: the tool list, each
 tool's `action` enum, input shape, approval rules, and the error model.
 
 > **Server identity:** the server identifies as `code-ux`, with the version matching the installed
@@ -47,6 +47,7 @@ action-specific fields, and an optional `approval` object for destructive action
 | `manage_scheduler` | orchestration | Create and run scheduled sprints, quicksprints, and messages. |
 | `scheduler_code_ux` | orchestration | Agent-owned wakeups and task reruns with restricted list/schedule/cancel actions. |
 | `manage_agents` | agents & memory | Manage agent presets and sync them to project markdown. |
+| `manage_node_flows` | agents & memory | Manage reusable node workflows, run them, and attach them as agent skills. |
 | `manage_memory` | agents & memory | Inspect, search, promote, and re-embed short/long-term memory. |
 | `manage_skills` | agents & memory | Manage persistent skill storages, skill markdown, and agent storage attachments. |
 | `search_knowledge` | agents & memory | Semantic search over the knowledge base subscribed to the caller. |
@@ -69,6 +70,7 @@ Every tool requires `runtimeRoles: ["project_manager"]` and is enabled by defaul
 | `manage_scheduler` | `list`, `create`, `update`, `delete`, `run_due`, `schedule_sprint`, `schedule_quicksprint`, `schedule_chat` |
 | `scheduler_code_ux` | `list`, `schedule_wakeup`, `schedule_task`, `cancel` |
 | `manage_agents` | `list`, `get`, `create`, `update`, `delete`, `sync` |
+| `manage_node_flows` | `list`, `get`, `create`, `update`, `delete`, `validate`, `run`, `list_runs`, `get_run`, `attach_to_agent`, `detach_from_agent` |
 | `manage_memory` | `list`, `get`, `count`, `create`, `update`, `delete`, `search`, `promote`, `get_map`, `model_status`, `start_reembed` |
 | `manage_skills` | `authoring_prompt`, `list_storages`, `get_storage`, `create_storage`, `update_storage`, `delete_storage`, `reset_storage`, `list_agent_storages`, `attach_storage`, `detach_storage`, `list_skills`, `get_skill`, `create_skill`, `update_skill`, `delete_skill`, `import_markdown`, `export_markdown` |
 | `manage_settings` | `get_system`, `get_project_override`, `resolve_project_effective`, `get_sprint_override`, `resolve_sprint_effective`, `replace_system_settings`, `patch_system_setting`, `replace_project_settings`, `patch_project_setting`, `reset_project_settings`, `replace_sprint_settings`, `patch_sprint_setting`, `reset_sprint_settings`, `export_settings_bundle`, `apply_settings_bundle` |
@@ -98,6 +100,20 @@ entries created through `manage_scheduler`, or entries created by another agent.
 does not expose `run_due`, arbitrary updates, recurrence editing, sprint or quicksprint scheduling,
 memory remediation, or global scheduler destructive controls.
 
+## Node flows
+
+`manage_node_flows` exposes project node workflows through MCP. It supports graph validation, CRUD,
+runtime execution, run inspection, and flow-backed agent skill attachments.
+
+Create and update calls validate the structured graph before repository writes. `run` delegates to the
+node-flow runtime through `NodeFlowService.runFlow`, and `delete` requires the normal approval
+handshake. Responses mask secret-shaped graph data, inputs, and outputs before returning them to MCP
+clients.
+
+Agents should build Code UX-adapted node flows rather than cloning n8n workflows one-to-one. Graphs
+should include dynamic widget schemas for editable graph inputs and node fields; callers can provide
+`widgets` as a graph-level `{ fields: [...] }` schema or as node-id keys mapped to node widget schemas.
+
 ## Approval handshake (destructive actions)
 
 Destructive and mutating actions require a two-step confirmation. The first call returns an approval

docs-web/developer/settings-reference.md

@@ -292,6 +292,7 @@ Both reflection loops are disabled by default. When enabled, planning and QA str
   { "name": "manage_quicksprints", "enabled": true, "isInternal": true },
   { "name": "manage_scheduler",    "enabled": true, "isInternal": true },
   { "name": "manage_agents",       "enabled": true, "isInternal": true },
+  { "name": "manage_node_flows",   "enabled": true, "isInternal": true },
   { "name": "manage_memory",       "enabled": true, "isInternal": true },
   { "name": "search_knowledge",    "enabled": true, "isInternal": true },
   { "name": "manage_settings",     "enabled": true, "isInternal": true },

docs-web/user/mcp-clients.md

@@ -125,6 +125,7 @@ domain**, plus `search_knowledge`:
 | `manage_quicksprints` | Manage quicksprint templates and execute them. |
 | `manage_scheduler` | Create and run scheduled sprints, quicksprints, and messages. |
 | `manage_agents` | Manage agent presets and sync them to project markdown. |
+| `manage_node_flows` | Manage reusable node workflows, run them, and attach them as agent skills. |
 | `manage_memory` | Inspect, search, promote, and re-embed memory. |
 | `search_knowledge` | Semantic search over the caller's subscribed knowledge base. |
 | `manage_settings` | Get/resolve/patch/replace/reset system, project, and sprint settings. |

docs/mcp/runtime-and-dispatch.md

@@ -95,7 +95,7 @@ This allows all log lines emitted during a tool call to share a single `correlat
   - Defines strict argument interfaces for every MCP tool.
   - Provides `register` and `dispatch` APIs with compile-time tool/argument matching.
 - Management dispatch target: `ManagementToolHandler`
-  - Routes dedicated management tools such as `manage_projects`, `manage_memory`, and `manage_skills` to domain action classes.
+  - Routes dedicated management tools such as `manage_projects`, `manage_memory`, `manage_node_flows`, and `manage_skills` to domain action classes.
   - Routes retrieval tools such as `search_knowledge` and `search_skills` separately, so agents can receive retrieval without broader management authority.
   - Applies stateful approval fingerprints to destructive management actions before mutation.
 - Core dispatch target: `CoreToolHandler`
@@ -115,6 +115,17 @@ Runtime behavior:
 - Search scoping is project-owned. `storageId` limits retrieval to one storage; otherwise `agentPresetId` limits retrieval to the agent's attached storages; otherwise all project storages are eligible.
 - Search results return ranked summaries with IDs and metadata. Full markdown retrieval remains behind `manage_skills` (`export_markdown` or `get_skill` with `includeContent: true`).
 
+## Node Flow Tools
+
+`manage_node_flows` uses `NodeFlowService` as the MCP backend boundary. The action layer parses MCP payloads, applies optional widget schemas into the graph, masks secret-shaped response fields, and delegates graph validation, persistence, run inspection, runtime execution, and agent skill attachments to the service.
+
+Runtime behavior:
+
+- `create` and `update` validate graph specs before repository writes.
+- `run` calls the configured node-flow runtime through `NodeFlowService.runFlow`.
+- `delete` uses the same stateful approval handshake as other destructive management actions.
+- `attach_to_agent` and `detach_from_agent` manage flow-backed skill attachments for agent presets; the agent still needs explicit MCP access if it should call `manage_node_flows` itself.
+
 ## Custom MCP Defaults
 
 Dashboard settings include custom MCP servers that local CLI providers may receive at execution time.