Power Automate MCP
Power Automate MCP
로컬 MCP 서버로, AI 에이전트가 개인 Power Automate 클라우드 흐름을 검사하고 편집할 수 있게 해줍니다 — 자신의 Microsoft 계정으로 인증하며, 관리자 동의나 유료 구독이 필요 없습니다.
이 프로젝트가 존재하는 이유는, 호스팅 대안 서비스들이 Microsoft가 이미 귀하의 계정에 무료로 노출하는 API를 감싸는 데 월 사용료를 청구하기 때문이며, Power Automate 포털은 변경 사항을 설명하면 에이전트가 안전장치 아래에서 적용해 주는 방식을 선호할 때 좋지 않은 인터페이스이기 때문입니다. 이 저장소는 해당 API가 실제로 어떻게 작동하는지에 대한 리버스 엔지니어링 기록을 작동하는 도구로 패키징한 것입니다.
개인 프로젝트이며, 있는 그대로 제공됩니다. 의존하기 전에 안정성 참고와 docs/SECURITY.md를 읽으십시오.
Microsoft와 제휴하거나 보증하지 않습니다.
흥미로운 부분: IT 부서에 요청하지 않고 인증하는 방법
"코드에서 Power Automate 관리" 튜토리얼은 모두 Entra ID에 앱을 등록하고 관리자에게 Dynamics CRM user_impersonation 또는 Flows.Manage.All에 대한 동의를 받으라고 안내합니다. 잠긴 기업 테넌트에서 그 요청은 불가능합니다 — 상시 서비스 주체(service principal)를 부여하는 것이며, 관리자들은 (당연히) 거절합니다.
이 프로젝트는 Microsoft가 대화형 도구용으로 제공하는 퍼블릭 퍼스트파티 클라이언트 ID를 사용하여 이를 완전히 우회합니다:
51f81489-12ee-4a9e-aaae-a2591f45987d ("Dynamics 365 Example Client", of XrmToolBox fame)**OAuth 2.0 디바이스 코드 그랜트(device-code grant)**를 통해 구동되는 이 방식은 위임된 로그인입니다: 토큰은 귀하의 신원과 권한을 담고 있으며, 승인할 서비스 주체가 없고 동의 화면도 나타나지 않습니다. 포털에서 이미 보유한 권한과 정확히 동일한 권한으로 노트북에서 Power Automate와 통신할 수 있습니다 — 그 이상도 그 이하도 아닙니다.
토큰 대상(audience)에는 문서화할 가치가 있는 덜 알려진 특이점이 하나 있습니다:
https://service.flow.microsoft.com//user_impersonation
^^ two slashes, on purpose레거시 리소스 URI는 슬래시로 끝나고 v2 범위 구문은 /user_impersonation을 추가하여 이중 슬래시가 생성됩니다. 일부 테넌트는 단일 슬래시 형태를 거부합니다. 그 문자열 하나가 작동하는 로그인과 불투명한 AADSTS 오류의 차이입니다.
Related MCP server: MCP Power Automate
또 다른 흥미로운 부분: 서로 다른 흐름을 보는 두 개의 API
두 개의 REST 백엔드가 있으며 상호 교환할 수 없습니다:
|
| |
상태 | 문서화되지 않음, 미지원 | 공식, 문서화됨 ( |
개인 흐름 인식 | 예 | 아니요 — Dataverse 없이는 404 |
솔루션 흐름 인식 | 예 | 예 |
사용 용도 | 모든 것 (개인 흐름) | 연결됨, 비활성 상태 |
가장 많은 연구 비용이 든 교훈: 지원되는 API는 개인 흐름을 전혀 볼 수 없습니다. 흐름이 Dataverse 솔루션에 있어야 합니다. 따라서 일반 사용자가 포털에서 만드는 흐름을 관리하는 모든 도구 — 유료 MCP를 포함하여 — 는 미지원 서비스 API를 사용할 수밖에 없습니다. 이 프로젝트는 그 트레이드오프를 숨기지 않고 명시적으로 만듭니다.
src/client/flow-api.ts는 두 기본 URL을 하나의 스위치 뒤에 유지하므로, 나중에 솔루션으로 이동하는 흐름(또는 서비스 API가 결국 깨지는 미래)은 재작성이 아닌 상수 하나의 변경으로 처리됩니다.
안정성 참고 (꼭 읽으십시오)
api.flow.microsoft.com은 Microsoft가 문서화하지 않고 지원하지 않습니다. 통지 없이 형태가 바뀌거나 사라질 수 있으며, 그럴 때 이 도구는 작동을 멈춥니다. 그 위험이 바로 유료 서비스가 귀하를 대신해 흡수하는 데 비용을 청구하는 부분입니다. 직접 수리하는 개인 도구로서는 훌륭한 거래입니다. 중요한 업무용으로는 그렇지 않습니다. 그에 맞게 선택하십시오.
모든 것은 귀하로 실행됩니다. 계정에 대한 액세스를 잃으면 도구가 작동을 멈춥니다 — 그 뒤에는 서비스 신원이 없습니다.
설치
요구 사항: Node 18+ (내장 fetch용) 및 pnpm. Power Automate를 사용할 수 있는 Microsoft 회사/학교 계정 — 그 이상은 필요 없습니다.
git clone https://github.com/karenrebecag/PowerAutomate_MCP.git
cd PowerAutomate_MCP
pnpm install
pnpm build자격 증명 — 한 번 로그인
편집할 구성 파일도, 붙여넣을 비밀번호도 없습니다. 인증은 자신의 Microsoft 계정에 대한 대화형 디바이스 코드 로그인입니다:
pnpm loginURL과 짧은 코드가 출력됩니다:
Power Automate MCP — sign in
1. Open: https://microsoft.com/devicelogin
2. Code: ABCD-EFGH
Waiting for you to finish signing in...URL을 열고 코드를 입력한 후, 관리하려는 흐름이 있는 계정으로 로그인하고 승인합니다. 성공하면 리프레시 토큰이 .pa-token에 기록됩니다 (권한 0600, gitignored). 서버는 그로부터 단기 액세스 토큰을 자동으로 발급합니다 — 만료될 때까지 다시 요청하지 않습니다 (비활성 약 90일). 계정을 전환하거나 만료된 토큰에서 복구하려면 pnpm login을 다시 실행하십시오.
선택적 환경 변수
변수 | 기본값 | 설정 시점 |
|
| 계정이 여러 테넌트에 속한 경우 특정 테넌트 GUID를 고정합니다. |
| 패키지 옆의 | 리프레시 토큰을 다른 곳에 저장합니다. |
검증 (선택 사항이지만 권장)
pnpm probe는 Phase 0을 실행합니다 — 귀하의 테넌트에 대해 모든 읽기 엔드포인트를 호출하고 실제 응답을 scratch/(gitignored)에 덤프합니다. 환경에서 경로가 404를 반환하면 사용 중에 발견하는 대신 여기서 확인할 수 있습니다. 쓰기 작업은 없습니다.
pnpm probeMCP 클라이언트에 등록
클라이언트의 구성에 서버를 추가하십시오. Claude Code의 경우 ~/.mcp.json입니다:
{
"mcpServers": {
"power-automate": {
"command": "node",
"args": ["/absolute/path/to/PowerAutomate_MCP/dist/index.js"]
}
}
}dist/index.js에 대한 절대 경로를 사용하십시오. 서버는 자체 위치를 기준으로 .pa-token을 찾으므로 클라이언트에서 작업 디렉터리나 환경 변수를 설정할 필요가 없습니다. 클라이언트를 다시 시작하고(또는 서버를 다시 연결하면) 일곱 개의 도구가 나타납니다. 클라이언트 없이 터미널에서 빠르게 확인:
printf '%s\n%s\n%s\n' \
'{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"c","version":"1"}}}' \
'{"jsonrpc":"2.0","method":"notifications/initialized"}' \
'{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' \
| node dist/index.js도구
도구 | 쓰기? | 기능 |
| 아니요 | 계정이 볼 수 있는 모든 환경. 환경 ID를 찾으려면 여기서 시작하십시오. |
| 아니요 | 환경의 클라우드 흐름 (요약 필드). |
| 아니요 | 전체 편집 가능한 정의 + 연결 참조. |
| 아니요 | 최근 실행 기록: 상태, 코드, 타이밍. |
| 아니요 | 한 실행의 작업별 분석; 실패한 작업의 입력/출력 링크를 추적합니다. 디버깅 보기. |
| 예 | 흐름 시작 / 중지. |
| 예 | 정의 객체에서 흐름 생성 또는 편집. |
일반적인 에이전트 워크플로
실패 검사 / 디버깅
list_environments
list_flows(environmentId)
get_flow_runs(environmentId, flowId)
get_run_actions(environmentId, flowId, runName) → see which action failed정의를 안전하게 변경
get_flow(environmentId, flowId) → copy properties.definition
… edit the definition object …
create_or_update_flow(..., dryRun: true) → default; shows wouldSend
create_or_update_flow(..., dryRun: false) → only after explicit OK두 쓰기 도구 모두 명시적으로 선택하기 전에는(dryRun: false / confirm: true) 어떤 것도 변경하지 않습니다. 이를 성가신 것이 아니라 기능으로 취급하십시오 — 잘못된 정의 하나가 실행 중인 자동화를 망가뜨릴 수 있습니다.
예시 대화 (이 도구의 용도)
사용자: "신규 리드에 영업 알림"이 오늘 아침에 왜 실패했지?
에이전트: (list_environments → list_flows → get_flow_runs → get_run_actions) 09:14 실행이
HTTP_To_CRM작업에서 401로 실패했습니다. 토큰 연결 참조는 여전히 흐름에 있으며, 다운스트림 API가 호출을 거부했습니다.사용자: 연결을 고칠 때까지 흐름을 꺼.
에이전트: (set_flow_state 미리 보기 → 승인 후 confirm: true) 흐름이 중지되었습니다.
이 루프에서 Power Automate 디자이너를 열 필요가 없습니다. 에이전트는 포털에서 이미 보유한 것과 동일한 권한을 사용합니다.
프로젝트 구조
src/
auth/ device-code login + silent refresh (the interesting bit)
client/ thin HTTP wrapper over the two REST backends
core/ shared MCP result helpers
tools/ one file per MCP tool (added after Phase 0 confirms shapes)
server.ts MCP server wiring
index.ts stdio transport entry point
scripts/
probe-endpoints.ts Phase 0 reconnaissance — run before trusting any tool
docs/
SECURITY.md tokens, disk artifacts, blast radius
DEVELOPMENT.md how to extend tools without guessing routes구축 방법 (스펙 / 프로브 기반)
Phase 0 —
pnpm probe는 라이브 테넌트의 읽기 경로를 호출하고 실제 JSON을scratch/(gitignored)에 저장합니다.도구는 해당 형태에 대해서만 타입이 지정되고 구현됩니다.
404를 반환하거나 잘못 보이는 경로는 제거됩니다 (예: 독립형
list_connections는 v1에 없음; 참조는 여전히get_flow에 표시됨).쓰기 작업은 미리 보기 기본값으로 제공되어 에이전트가 실수로 첫 시도에 정의를 적용할 수 없습니다.
자세한 내용: docs/DEVELOPMENT.md.
상태
작동 중. 일곱 개의 도구(읽기 5개, 쓰기 2개)가 각각 라이브 테넌트에서 Phase 0으로 캡처한 응답에 맞춰 구현되었습니다. pnpm verify(타입 검사 + 린트 + 포맷 + 테스트)가 로컬 게이트입니다.
v1에 없음: 흐름 삭제, 데스크톱 흐름, 테넌트 관리자 API, 독립형 연결 목록.
문서
문서 | 내용 |
토큰 파일, 위임된 폭발 반경, 커밋하지 말아야 할 것 | |
프로브 우선 워크플로, 스크립트, 도구 추가 | |
이 저장소에서 작업하는 코딩 에이전트를 위한 엄격한 규칙 |
라이선스 및 의도
MIT. 개인적이고 교육적인 리버스 엔지니어링 프로젝트입니다. 다른 사람들이 이 API가 어떻게 작동하는지 배우고 그 위에 자신만의 개인 도구를 구축할 수 있도록 공유합니다. 자신의 계정과 조직의 정책 범위 내에서 사용하십시오.
Microsoft와 제휴하거나 보증하지 않습니다.
Available Tools
7 toolscreate_or_update_flowA
Create a new flow or update an existing one from a definition object. dryRun is the default — pass dryRun:false to actually write. Get the definition shape from get_flow.
| Name | Required | Description | Default |
|---|---|---|---|
| dryRun | No | Default true — preview only. Pass false to actually write. | |
| flowId | No | Flow ID to update. Omit to CREATE a new flow. | |
| definition | Yes | The workflow definition object (properties.definition from get_flow). | |
| displayName | No | Display name. Required when creating. | |
| environmentId | Yes | Environment ID. | |
| connectionReferences | No | Connection references map (properties.connectionReferences from get_flow). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, so a write is expected, but the description adds a crucial behavioral detail—the write is skipped by default and only happens when dryRun:false is passed. It does not disclose overwrite semantics or potential side effects beyond those annotations, but the default behavior is important and clearly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The main operation is front-loaded, and the dryRun default and definition source reference are compactly included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a create-or-update tool with no output schema, the description covers the essential action, the write-default safety mechanism, and how to obtain the definition shape. It does not explicitly explain update-discovery behavior and id handling, but those are largely covered by parameter schema and the description as a whole is sufficient for basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to restate parameter meanings. It adds a light mention of dryRun default and references get_flow for the definition shape, both also reflected in the schema, so it provides marginal additional value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and object: 'Create a new flow or update an existing one from a definition object.' It clearly states both the operation and the resource and distinguishes this from get_flow pointing to a definition source.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage guidance: dry-run is the default and passing dryRun:false performs the actual write, and it directs the user to get_flow for the definition shape. It does not explicitly enumerate alternatives or when not to use this tool, but the context is fairly unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_flowARead-only
Full flow definition (triggers, actions, parameters) and connection references.
| Name | Required | Description | Default |
|---|---|---|---|
| flowId | Yes | Flow ID (the `name` field from list_flows). | |
| environmentId | Yes | Environment ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds the detail that connection references are included, which is useful, but it does not disclose behavioral details such as response shape, error cases, or whether the flow is executed. This is acceptable given the annotations but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, information-dense sentence that front-loads the core purpose and enumerates the key contents without filler. Every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-by-ID tool, the description adequately covers what the tool returns: full flow definition and connection references. There is no output schema, but the description mitigates this by naming the major response components. It does not mention error behavior or prerequisites, but those are not critical for this low-complexity operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both environmentId and flowId are fully documented in the input schema, including the note that flowId corresponds to the name field from list_flows. The description adds no additional parameter-level meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact resource and scope: a full flow definition including triggers, actions, parameters, and connection references. This clearly distinguishes the tool from siblings like get_flow_runs and get_run_actions, which focus on runs rather than definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'full flow definition' makes the intended use obvious: retrieve the complete definition of one flow rather than a list of flows or run-level data. It does not explicitly name alternatives or list exclusions, but the scope is clear enough for an agent to select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_flow_runsBRead-only
Recent run history for a flow: status, code and timing per run.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max runs (default 20). | |
| flowId | Yes | Flow ID. | |
| environmentId | Yes | Environment ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds the return fields but does not disclose ordering, freshness, pagination behavior, or any caveats about the returned history.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence states the resource and the key output dimensions without filler. Every word contributes to understanding what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with fully documented parameters, the description is mostly complete. It mentions the key returned aspects, though it could have added ordering or recency behavior; 'Recent' plus the top parameter makes this workable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with flowId, environmentId, and top all individually documented. The description adds no parameter-level meaning beyond restating the general concept, so the schema carries the burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource (flow run history) and the data it returns (status, code, timing per run). It is clear enough to distinguish from get_flow, though it does not explicitly contrast with the similar sibling get_run_actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives like get_flow or get_run_actions, and no mention of prerequisites or context. Usage is only implied by the tool name and the general description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_run_actionsARead-only
Per-action breakdown of one run — the debugging view. Follows inputs/outputs links for failed actions by default (or a named action, or all).
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes | Run ID from get_flow_runs. | |
| flowId | Yes | Flow ID. | |
| includeIO | No | Follow inputs/outputs links for: failed actions (default), all, or none. | |
| actionName | No | Only this action; follows its I/O links. | |
| environmentId | Yes | Environment ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint=true and openWorldHint=true, lowering the burden on the description. The description adds genuinely useful context beyond annotations: the default behavior of following inputs/outputs links for failed actions, which an agent cannot infer from structured data. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with zero waste. The primary purpose is front-loaded ('Per-action breakdown... debugging view') and the behavioral detail is delivered efficiently in the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a moderate 5-parameter surface with full schema coverage, read-only annotations, and no output schema required, the description explains the purpose and the key default behavior. Nothing essential an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter (runId, flowId, includeIO, actionName, environmentId) is already documented in the schema. The description's mention of 'failed actions by default (or a named action, or all)' mirrors the includeIO enum already present in the schema, adding little semantic value beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource ('per-action breakdown of one run') with an explicit framing ('the debugging view'). It clearly distinguishes itself from siblings like get_flow_runs (which returns the run list) and get_flow (single flow definition) — this tool drills to the action level of one run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'debugging view' label implies when to use it, and the action-level scope contrasts with the run-level siblings. However, no alternative is named explicitly and there's no when-not-to-use guidance, so usage is only implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_environmentsARead-only
List every Power Platform environment the signed-in account can see.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered. The description adds the 'every' and 'signed-in account' scope, which complements the openWorldHint by clarifying the visibility boundary, but does not go into details like pagination or environment properties.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single clear sentence with zero waste; the key scoping ('every', 'signed-in account') is front-loaded. Perfectly sized for a no-parameter list tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple list operation, but the lack of an output schema and absence of any mention of return format or filtering capabilities leaves minor gaps. However, given the simplicity, it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters; the schema is empty with 100% coverage, so there is nothing to document. The description adds no parameter meaning, but with no params, this is a baseline high score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists every Power Platform environment visible to the signed-in account—a specific verb (list) and resource (environments). It distinguishes from siblings like list_flows which target a different resource type, though it doesn't explicitly name the sibling for comparison.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description and 'signed-in account' context imply it's for browsing available environments, but there is no explicit when-to-use guidance or mention of alternatives among siblings. It's clear enough for obvious cases but lacks explicit routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_flowsARead-only
List cloud flows in an environment (summary fields, not the full definition).
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max flows to return. | |
| environmentId | Yes | Environment ID from list_environments. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=true in annotations, the read-only nature is already declared; the description adds that the result contains summary fields rather than full flow definitions, which is a meaningful output-behavior disclosure. It does not detail pagination or default limits, but the schema's top parameter covers the limit behavior and no contradictions exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with a parenthetical carries the core purpose, scope, and an output caveat with no filler. The actionable verb is front-loaded and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, read-only list operation, the description plus schema covers the required environmentId and the optional max count, and the summary-fields caveat gives the agent enough to choose the tool and interpret the response at a high level. There is no output schema, and the description does not enumerate exactly which summary fields are returned or any paging behavior, so a small completeness gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline applies. The description adds no parameter-level detail beyond the schema, which already explains environmentId as coming from list_environments and top as the max number of flows to return.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a concrete resource ('cloud flows'), and a scope ('in an environment'), immediately distinguishing it from get_flow, which returns a single flow's full definition. The parenthetical clarifies that output is summary fields, not full definitions, removing ambiguity about its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates this is the tool to use when you need an inventory/summary of cloud flows within a specific environment, and the 'not the full definition' caveat implies when not to use it. It does not explicitly name a sibling like get_flow as the alternative, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_flow_stateA
Turn a flow on (start) or off (stop). Previews by default; pass confirm:true to apply.
| Name | Required | Description | Default |
|---|---|---|---|
| state | Yes | Turn the flow on (start) or off (stop). | |
| flowId | Yes | Flow ID. | |
| confirm | No | Must be true to actually apply. Omit to preview the intended change. | |
| environmentId | Yes | Environment ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly discloses the critical behavioral gate: it previews by default and only actually mutates state when confirm:true is passed. Given annotations readOnlyHint=false and openWorldHint=true, this adds the key safety-relevant context an agent needs before invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler: the primary action is front-loaded, followed by the essential preview/confirm caveat. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple four-parameter tool: it states the operation, the states, and the confirmation mechanism. It does not describe what the preview output looks like, but since there is no output schema this is a partial gap rather than a serious omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all parameters, including the meaning of confirm and the start/stop enum. The description adds no new parameter-level information; it merely restates the behavior already captured in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the action ('Turn a flow on/off'), the resource (flow), and the two valid states (start/stop). This makes it clearly distinct from siblings such as list_flows, get_flow, and create_or_update_flow, which concern discovery, reading, or definition changes rather than operational state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage is implied: invoke this tool when you want to start or stop a flow, and the preview behavior supports a safe exploratory workflow. However, the description does not explicitly name alternatives such as create_or_update_flow for definition changes, nor does it mention when not to use this tool or what prerequisites must exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
create_or_update_flow - First observed
get_flow - First observed
get_flow_runs - First observed
get_run_actions - First observed
list_environments - First observed
list_flows - First observed
set_flow_state
TDQS
Scored across 7 tools
Each tool targets a distinct resource/action combination: environments, flow lists, full flow definitions, run history, per-action run details, flow state, and create/update. No two tools overlap in purpose; an agent can easily select the correct tool for a given task.
The naming follows a clear verb_noun pattern with verbs like list_, get_, set_, and create_or_update_. The only minor inconsistency is the use of both list_ and get_ for read operations, which could cause slight ambiguity (e.g., list_flows vs get_flow), but the distinction between summary and full definition is established in descriptions.
Seven tools is an appropriate, focused set for a Power Automate management server. The scope is clear, and each tool serves a necessary function without redundancy. This size is large enough to be useful yet small enough to avoid confusion.
The toolset covers the main lifecycle operations for flows: listing, retrieving, updating, setting state, and inspecting runs/actions. A notable missing operation is the ability to delete a flow, and there is no explicit way to list all runs across flows, but the core workflows of inspection and modification are well-covered.
Maintenance
Related MCP Connectors
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Connect any AI agent to 1,000+ apps and 27,000+ actions through one remote MCP server (OAuth).
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Open-source Zapier/n8n alternative as an MCP server: agents build, run and debug your workflows.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceDebug, build, and manage Microsoft Power Automate cloud flows with AI agents. Get action-level error details, build flows from natural language, trigger and resubmit runs, and operate across multiple tenants. Requires a Flow Studio MCP subscription — get an API key at https://mcp.flowstudio.app34MIT
- AlicenseBqualityFmaintenanceLocal-first MCP server and Chromium extension for AI-assisted Microsoft Power Automate work, enabling users to inspect, validate, edit, run, review, and revert cloud flows using a browser session.2465 npm26MIT
- AlicenseNot gradedqualityDmaintenanceA self-hosted MCP server that enables AI assistants to inspect and manage Microsoft Power Automate cloud flows and Dataverse records locally, using your own Azure identity.MIT
- AlicenseAqualityBmaintenanceAn MCP server that lets agents inspect, operate, and author Microsoft Power Automate cloud flows from a CLI/agent context.1866 npm2MIT