Labsco
MCP SERVER

Appflowy MCP

by CAREEMER ↗

Give an MCP client scoped access to a self-hosted AppFlowy: walk the page tree, edit blocks in place through the same CRDT path the web client uses, and work database rows — with each token fenced to the pages you allow.

Team Wikis & Documentation Platforms
Summary
Two layers of auth kept apart: the server holds one AppFlowy login, and each client gets a token that reaches only the subtree you granted it.

Enforcement is by ancestry — for any page a tool touches the server walks up the folder tree, and the call proceeds only if it reaches one of the token's allowed roots. Block edits go through the same Yjs/CRDT web-update path as the official web client, which is also why Update database row and Delete database row act on an existing row by its id: REST exposes no route to edit or delete a row by UUID. One setting undoes the fence — APPFLOWY_MCP_REQUIRE_AUTH set to false with no tokens configured grants full access to anyone who can reach the port, so leave it on unless the port is on a trusted network.

What it is

A self-hosted MCP server for AppFlowy that logs in once as a service account and hands each client an opaque token bounded to the workspaces and page subtrees you name.

What you get
  • The page tree, pruned to what the token may see: Get workspace list and Get workspace folder return only allowed subtrees, and Create new page, Update page and Get page details create, rename, lock and read pages under an allowed parent.
  • Block-level editing rather than whole-page rewrites: Get page blocks lists a page's blocks in order, Insert block places a new one at any position — including an image referenced from a public URL — Edit block text replaces rich content in place with its formatting preserved, Delete block removes a leaf, and Append content to page adds to the end.
  • Databases without opening a grid: Create database makes a grid, board or calendar under a parent, Get workspace databases and Get database fields describe it, Add database field adds a text, number, select or date column, and List database rows, Get database row, Create database row, Update database row and Delete database row work the rows, with cells keyed by field name or id.
  • Trash and favourites as ordinary calls: Move page to trash, Restore page from trash and Delete page from trash cover the lifecycle, alongside Get trash, Get favorite pages and Toggle favorite page.
  • Scopes shaped like the tree: a scope is a path of AppFlowy ids whose last id roots the allowed subtree, one token may carry several disjoint grants, and an empty scope list means everything the service account can see.
Requirements

An AppFlowy Cloud base URL in APPFLOWY_BASE_URL and a service account — APPFLOWY_EMAIL with APPFLOWY_PASSWORD, or a pre-minted APPFLOWY_ACCESS_TOKEN, which takes precedence. Clients never see those credentials: each presents its own token as a bearer header over streamable HTTP at /mcp.

Setup effort

One command plus a key — npx -y mcp-remote https://appflowy-mcp.example.com/mcp, then supply credentials