Mcpflo

MCPFlo

A visual testing tool for MCP (Model Context Protocol) servers. Think Bruno, but for MCP.

MCPFlo is a desktop app for testing MCP servers by hand. Connect to one or more servers, browse the tools, resources, and prompts they expose, and invoke them with real inputs — then inspect the exact response that came back. It's built for developers writing or integrating MCP servers who want to see what a capability actually does without wiring it into an AI client first.

---

Why

When you're building an MCP server, the hard part isn't writing the tool — it's checking that it behaves. Your options today are limited:

• Hand-write a throwaway script that spins up a client and calls the tool
• Drop the server into an AI client like Claude Desktop and hope the model calls the tool the way you intended, with no clear view of what it sent or received

Both are slow and opaque. MCPFlo gives you a direct, deterministic way to call a single tool, read a resource, or render a prompt — with the raw request and response in front of you, no model in the loop, no tokens spent.

---

Features

Everything below is implemented and working today.

Connect

• Multiple simultaneous servers. Connect to as many servers as you want and browse them side by side. Each runs over its own pooled connection, with a disconnect action per server — and spawned processes are cleaned up when a server is removed or the app quits.
• stdio and Streamable HTTP transports. Spawn a local server over stdio, or connect to a remote one over Streamable HTTP. HTTP connections support custom request headers (e.g. an Authorization: Bearer … token) for token-authed servers.
• OAuth 2.1 for Streamable HTTP. OAuth-protected servers are signed in to automatically the first time you expand them, using the authorization-code + PKCE flow: MCPFlo opens your system browser, captures the redirect on a loopback listener (RFC 8252), and reconnects. Clients register automatically via Dynamic Client Registration, with a manual Client ID fallback when a server doesn't support it. An Auth panel in the server detail view shows your current session — token status, expiry, scopes — with sign-out a click away.
• Secrets encrypted at rest. OAuth tokens, environment variables, and request headers are encrypted with the OS keychain (safeStorage) and never leave the main process — the UI layer only ever sees server IDs.
• Protocol version override. Pin a connection to a specific MCP protocol version when you need to test how a server negotiates.

Browse

• Capability tree. View every tool, resource, and prompt across all connected servers in a grouped tree, with expand/collapse-all controls.
• Unified filter. A single search box (⌘K) filters tools, resources, and prompts across every server at once.
• Server detail view. Select a server to see it at a glance: connection status and actions, its full capability list, and a context-budget card that estimates how many tokens the server's tool, resource, and prompt definitions consume in a model's context window — segment by segment.
• Cancellable discovery. A slow capability fetch can be cancelled mid-flight instead of blocking the row.

Invoke