Skip to main content
Glama

secureflows-mcp

by io.github.michal-lefler

Log out (browser redirect helper; first-party cookie clearing)

get_auth_logout

Browser-friendly logout endpoint for cross-site clients (e.g. apps running on localhost).

Use this as a top-level navigation (not XHR/fetch) so Clear-Site-Data is applied in a first-party context on secure-flows.com, making cookie/session clearing reliable even when third-party cookies are blocked.

Critical client rules:

  • Clear your in-app sessionToken state before navigating.

  • Never include session_token inside redirect_uri (that would silently renew and defeat logout).

This endpoint (best-effort / idempotent for browser UX):

  • Invalidates the provided session_token by incrementing tokenRevision when the token still matches an active session (no new token is issued).

  • If the session is already expired/revoked or the revision was superseded by renew, still completes logout UX (does not return 401 solely for that reason).

  • Revokes Firebase refresh tokens for the session’s stored Firebase UID when known.

  • Sets Clear-Site-Data: "cookies".

  • Redirects the browser to redirect_uri.

Source: GET /api/v1/auth/logout No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
authNo
bodyNo
queryYes
paramsNo
connectionYes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the behavioral burden. It discloses side effects (token revision increment, Firebase refresh token revocation, Clear-Site-Data setting), idempotent best-effort behavior, and the fact that expired sessions still complete logout without returning 401.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but well-structured with clear section headers and bullets. Every sentence adds value, from the critical client rules to the behavioral guarantees, and the most important usage constraint is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers prerequisites, required parameters, security-relevant client behavior, error edge cases, and redirect behavior. Since there is no output schema, the explanation that the endpoint redirects to redirect_uri is sufficient. No critical calling information appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite low schema coverage, the description adds meaningful semantics for the key parameters: session_token is the JWT to invalidate and redirect_uri is the post-logout destination. It also warns against putting session_token inside redirect_uri and gives guidance about using connection.workspaceName and connection.appId as stable config.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies this as a browser-friendly logout endpoint for cross-site clients, using a specific verb (logout) and resource (auth session). It distinguishes itself from likely alternatives by emphasizing top-level navigation and Clear-Site-Data behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives strong usage context: use as top-level navigation, not XHR/fetch, and in first-party context to ensure cookie clearing. It does not explicitly name alternative tools such as post_auth_logout, so it lacks a direct when-not-to-use reference, but the practical guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All secureflows-mcp toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.7/5.0
Disambiguation2/5

Several tools cover nearly identical actions with subtle differences: post_sessions, post_sessions_get_or_create, and post_sessions_renew_session_token all create/reuse sessions; get_auth_logout and post_auth_logout both log out; and the two revoke endpoints overlap heavily. An agent would struggle to pick the correct variant without reading detailed descriptions.

Naming Consistency2/5

Naming mixes HTTP-verb prefixes (get_, post_, delete_) with domain-specific verbs (auth_session_callback, secureflows_build_login_url), and get_sessions_get_key is redundant and awkward. The pattern is inconsistent across the set even though individual chunks are readable.

Tool Count3/5

18 tools is on the heavy side for what is essentially session lifecycle management plus a few helper utilities. Many tools could be consolidated (e.g., one logout tool, one revoke tool, one key-access pattern), making the surface feel fragmented.

Completeness4/5

The session lifecycle is well covered: create, renew, revoke, logout, get payload, set/delete keys, identity, and self-service listing are all present. Minor gaps include no direct TTL adjustment after creation and no admin-level session management, but the core workflows are complete.

Resources