Goflow MCP

A hosted Model Context Protocol server for the Goflow API. Add it to Claude or Codex and ask about your sales, profit, orders, products and inventory in plain language. It covers all 104 documented Goflow operations across 68 paths (spec v1, 45 tag groups).

Reports it can pull

Goflow's own report API covers inventory only, so these are computed by walking the orders and purchasing feeds. Ask in plain language — the server has a goflow_capabilities tool that lists them back with the exact call for each.

Money is net of tax, and profit is net sales less cost of goods, channel fees and the freight actually paid. Every answer states the window it covered, the statuses it excluded and whether the scan was capped — and reconciles its revenue against Goflow's own per-order subtotal.

What you need

Your own Goflow subdomain (the acme in acme.goflow.com) and a Goflow API token. Nothing else — there is no account to create here, and no client id or secret to ask us for.

You'll also be asked for your email address. 68 of Goflow's 104 operations are marked beta — including all of products, reports and purchasing — and a beta endpoint refuses any request that doesn't carry a contact address. It isn't a password or a second token: Goflow uses it to warn you before a beta schema changes. Leave it out and a good token still can't read your own catalog, so this server falls back to sadya@goflow.com — but give your own, or the notices go to someone else.

We store none of it. There is no database behind this server: your credentials are sealed into the token your client holds and travel back to us on each request. To revoke access, rotate your API token in Goflow — that cuts off everything holding it, here and everywhere else.

Claude — web, desktop and mobile

1. Settings → Connectors → Add custom connector.
2. Paste https://goflow-mcp.u.jpapps.net/mcp as the URL, and click Add. Leave Advanced settings alone — the OAuth client id and secret there are optional, and this server doesn't use them.
3. Click Connect. Claude opens a page here that asks for your Goflow subdomain and API token, checks them against Goflow, and sends you back.

Claude Code

The same flow, from the terminal:

claude mcp add --transport http goflow https://goflow-mcp.u.jpapps.net/mcp

Then run /mcp in Claude Code to sign in. To skip the browser entirely, put your credentials straight into .mcp.json instead — subdomain, token and email in one header, separated by colons:

{
  "mcpServers": {
    "goflow": {
      "type": "http",
      "url": "https://goflow-mcp.u.jpapps.net/mcp",
      "headers": {
        "Authorization": "Bearer YOUR-SUBDOMAIN:YOUR_GOFLOW_TOKEN:you@yourcompany.com"
      }
    }
  }
}

Anything else

Any client that can set a request header can use that same single-header form: Authorization: Bearer <subdomain>:<token>:<email>. The older three-header form — Authorization: Bearer <token> alongside X-Goflow-Subdomain and X-Beta-Contact — still works and will keep working.

For a client that can do neither OAuth nor headers, run mcp-remote as a local stdio proxy; it runs the OAuth flow on your own machine. Needs Node installed.

{
  "mcpServers": {
    "goflow": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://goflow-mcp.u.jpapps.net/mcp"]
    }
  }
}

Codex

# ~/.codex/config.toml
[mcp_servers.goflow]
url = "https://goflow-mcp.u.jpapps.net/mcp"
bearer_token_env_var = "GOFLOW_TOKEN"

bearer_token_env_var is the name of an environment variable, not the token. Don't paste your Goflow token into the config file — Codex rejects an inline bearer_token on this transport, and a token in a file is a token you'll leak. Set that variable in the shell that launches Codex instead:

export GOFLOW_TOKEN=YOUR-SUBDOMAIN:your-goflow-token:you@yourcompany.com

Codex reads it from there and sends it as Authorization: Bearer. Because the subdomain travels inside that value, there is no http_headers block to get wrong.

Check it works

curl -X POST https://goflow-mcp.u.jpapps.net/mcp \
  -H "Authorization: Bearer YOUR-SUBDOMAIN:YOUR_GOFLOW_TOKEN:you@yourcompany.com" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

Rather than one tool per endpoint, three generic tools read the OpenAPI spec at runtime, so the whole API stays reachable. The usual path for anything without a dedicated tool is search → describe → request.

Before you connect