Security
Security model
flowifai is an approval layer for cooperative MCP tool paths. It keeps downstream service credentials local while the backend handles policy, approval, audit, and registered tool metadata.
Credential boundary
Credentials configured in your local MCP server, such as API keys and service tokens, stay in the local tools sandbox with that server. The flowifai enrollment credential is separate: the broker uses it to authenticate outbound calls to the backend.
Local tools host
MCP server credentials, real tool execution, broker service, wrapper-facing broker endpoint, and local flowifai config.
flowifai cloud
Policy, approval tickets, audit records, registered tool metadata, setup lifecycle events, and billing/auth state.
What the backend can receive
The backend may receive and store registered tool names, descriptions, input schemas, arguments needed for policy and approval, approval decisions, audit metadata, lifecycle events, and execution results. Any value included in tool arguments or execution results, including accidental secrets, may therefore be sent to and stored by the backend.
Broker and wrapper
The broker is the local trust anchor. It owns the enrollment credential and launches the real MCP server. The wrapper is an untrusted stdio shim for the agent and owns no flowifai credential. The broker's wrapper-facing reachability endpoints are not authenticated, so same-host setups should bind the broker to loopback and split-host setups should use an SSH or equivalent authenticated encrypted loopback tunnel.
Pull-only cloud model
The backend never initiates a connection into your machine. The broker asks the backend for policy and approval decisions through outbound requests, and the local broker performs the actual tool execution through the MCP server you configured.
Audit and policy
Adjudications, approvals, denials, execution outcomes, and lifecycle events are written to an append-only audit log. Policy is default-deny, matches by tool and optionally by argument predicates, and fails closed on policy engine errors.
What flowifai is not
flowifai is not a VM sandbox, EDR product, network firewall, or guarantee that a compromised agent cannot act through some other path. It gates the MCP path you route through the wrapper and broker. If an agent also has direct API keys, shell access, or another ungated tool path, those paths remain outside flowifai control.
Retention and deletion posture
Audit and approval records exist so operators can review what happened. Public launch plans keep pricing and billing simple while retention controls mature; if your evaluation needs a specific deletion or retention commitment, contact the team before routing sensitive production workflows.