CheckFlow MCP Server
The CheckFlow MCP server lets an AI assistant — Claude, or any other client that speaks the Model Context Protocol — work in your CheckFlow workspace. Connect it once, and you can ask your assistant in plain language to start a checklist, tell you what is overdue, fill in a task, build a template from a written procedure or tidy up a Data Set, and it does so through the same operations as the REST API.
The MCP server is available on the Enterprise plan. The REST API is available on every plan.
What You Can Ask For
The server offers 145 tools, grouped into families. A few examples of what an assistant can do with them:
| You ask | The assistant |
|---|---|
| "What's on my plate this week?" | Reads your Tasks grid, filtered to tasks due this week. |
| "Start an Invoice Review for INV-2041, due Friday, and assign the approval to Sarah." | Creates the checklist from the Invoice Review template with its parameters, sets the due date and assigns the task. |
| "Mark the bank details check as done and note that the IBAN was verified by phone." | Fills in the task's fields, adds a comment and completes the task. |
| "Which supplier onboardings have been stuck for more than two weeks?" | Searches checklists and reads their activity. |
| "Turn this procedure document into a template." | Reads the authoring guide, composes a template document, validates it, fixes what the validator reports and publishes it. |
| "Add these twelve suppliers to the Suppliers Data Set." | Creates the records in one bulk call. |
| "Set up a checklist every Monday at 9 am for the weekly stock check." | Creates a schedule. |
| Tool family | Tools | Covers |
|---|---|---|
| Checklists | 15 | Listing, searching, creating, completing, archiving, sharing and tagging checklists. |
| Checklist Tasks | 26 | Completing tasks, fields and tables, files, assignees, due dates, comments, snoozes, tags. |
| Standalone Tasks | 25 | Raising and managing tasks outside checklists, with sub-tasks, comments and files. |
| Workspace, People and Tasks Grid | 12 | Members, groups, tags, the Tasks grid and its saved views. |
| Template Authoring | 30 | The workspace summary, the schema and authoring guide, templates, versions, permissions, upgrades and drafts. |
| Data Sets | 21 | Data Sets, fields, records, views and CSV import and export. |
| Schedules | 9 | Recurring schedules and their runs. |
| Webhooks | 7 | Webhook subscriptions, deliveries and replays. |
The server also publishes one resource, the template authoring guide, which a client can attach to a conversation. See How the MCP Server Works.
Who the Assistant Acts As
The server authenticates with a CheckFlow API key, and every key acts as one member of the workspace — or as the workspace itself. Your assistant works with that member's identity and access. It sees what they can see, its changes are recorded in their name, and it is refused where the API refuses them — see Who a Key Acts As for the permission checks that apply.
For a personal assistant, create a key that acts as you. That way "my tasks" means your tasks, snoozes hide tasks from your own Tasks grid, and the activity feed shows your name against the changes you asked for. A key that acts as the workspace cannot use the tools about a person, such as the Tasks grid and snoozing.
Keeping It Safe
An AI assistant with an API key can make real changes to your workspace, and a model can misunderstand a request. Before you connect one:
- Use a key that acts as the least powerful member who can do the job. Everything the assistant does is limited to what that member could do in the app, and managing webhooks needs an Administrator. A key that acts as the workspace is not limited by member permissions but cannot use the tools about a person, so read Who a Key Acts As before you choose. Avoid giving an assistant an Administrator's key unless it needs one.
- Give each assistant its own key, named for it on the Team page, so that you can see when it was last used and revoke it on its own.
- Keep your client's confirmation prompts on. Every tool tells the client whether it only reads, whether it changes something and whether the change is destructive. Twenty tools are marked destructive — among them deleting a checklist, a standalone task, a Data Set or its records, replacing a Data Set's records from CSV, publishing a new template version and upgrading running checklists — and most clients ask before running them.
- Treat the key as a secret. Store it in your client's secret or environment settings rather than in a shared configuration file.
- Revoke the key on the Team page if you stop using the assistant or suspect the key has been exposed.
Deleting a checklist, a standalone task, a Data Set or its records through the MCP server is as permanent as doing it in the app. Read what the assistant proposes before you approve a destructive tool.
Requirements
- A workspace on the Enterprise plan. A workspace on another plan is refused with the code
ENTERPRISE_PLAN_REQUIRED; you can check your plan withGET /v3/auth/test, which reportsisEnterprise. - An API key, created by an Administrator on the API & Integrations tab of the Team page.
- An MCP client that supports the Streamable HTTP transport and lets you add a custom request header — or a bridge that adds one for it. See Connecting a Client.
Server Addresses
| Region | MCP endpoint |
|---|---|
| United States | https://api.checkflow.io/mcp |
| Europe | https://api-eu.checkflow.io/mcp |
Use the address for the region your workspace is in. A key sent to the other region's server is refused with WRONG_REGION, and the message names the address to use instead.
Related Pages
- Connecting a Client — step-by-step setup for Claude Desktop, Claude Code, Cursor, VS Code and MCP Inspector.
- How the MCP Server Works — the protocol, errors, retries and limits.
- Authentication — how API keys work and who they act as.
- CheckFlow API v3 — the REST API behind every tool.