← Back to Skills Marketplace

Flower

Name: Flower
Author: parker-xferops

by xferops · GitHub ↗ · v1.0.4

cross-platform ⚠ suspicious

607

Downloads

Stars

Active Installs

Versions

Install in OpenClaw

/install flower

Description

Manage projects and tasks with the Flower project management API via MCP. Use when creating, updating, or searching tasks/tickets, managing projects and colu...

README (SKILL.md)

Flower MCP

Project management via MCP (Model Context Protocol).

Setup

Install the MCP server:

npx -y @xferops/flower-mcp

Configure in your MCP client (e.g., ~/.mcporter/mcporter.json):

{
  "mcpServers": {
    "flower": {
      "command": "npx",
      "args": ["-y", "@xferops/flower-mcp"],
      "env": {
        "FLOWER_URL": "https://flower.xferops.com",
        "FLOWER_TOKEN": "your-api-token"
      }
    }
  }
}

Get your API token from Flower → Settings → API Tokens.

Tools (25 total)

Teams & Projects

flower_list_teams — List all teams
flower_get_project — Get project with columns and tasks
flower_list_projects — List projects in a team

Tasks

flower_list_tasks — List tasks (filter by projectId, columnId, assigneeId)
flower_get_task — Get task details
flower_create_task — Create task (projectId, columnId, title required)
flower_update_task — Update task fields
flower_delete_task — Delete a task
flower_move_task — Move to different column
flower_search_tasks — Search by title, description, or ticket number

Columns

flower_list_columns — List columns in a project
flower_create_column — Create a column
flower_update_column — Update column name/position
flower_delete_column — Delete a column

Comments

flower_list_comments — List comments on a task
flower_create_comment — Add a comment
flower_update_comment — Edit a comment
flower_delete_comment — Delete a comment

Users & Members

flower_list_users — List all users
flower_get_current_user — Get authenticated user
flower_list_team_members — List team members
flower_add_team_member — Add user to team
flower_remove_team_member — Remove from team

Notifications

flower_get_notification_preferences — Get notification settings
flower_update_notification_preferences — Update settings

Common Patterns

Find a ticket by number

mcporter call flower.flower_search_tasks query="#123"

Create a task

mcporter call flower.flower_create_task \
  projectId=\x3Cid> \
  columnId=\x3Cid> \
  title="Task title" \
  description="Details" \
  priority=HIGH \
  type=BUG

Move task to different column

mcporter call flower.flower_move_task \
  taskId=\x3Cid> \
  columnId=\x3Cnew-column-id>

Add a comment

mcporter call flower.flower_create_comment \
  taskId=\x3Cid> \
  content="Comment text"

Field Values

Priority: LOW, MEDIUM, HIGH, URGENT

Type: TASK, BUG, STORY

PR fields: prUrl, prNumber, prRepo (for GitHub PR linking)

Usage Guidance

This skill appears to be a normal Flower↔MCP integration, but take these precautions before installing: - Verify the package @xferops/flower-mcp on npm (publisher, recent releases, download count, source repository) before running `npx -y` — npx will fetch and run code from the network. - Treat FLOWER_TOKEN as a secret: confirm where it will be stored (the instructions put it into `~/.mcporter/mcporter.json`) and whether that file is appropriately protected. - Ask the skill publisher for a source/homepage or a pinned package version to avoid accidental upgrades to malicious code. - Prefer running npx without `-y` initially so you can inspect what is downloaded, or install a specific vetted version instead of a floating/latest fetch. - Because the registry metadata did not declare required env vars or a primary credential, be skeptical: the omission could be an oversight or sloppy packaging — ask the author to update the metadata to declare FLOWER_TOKEN and FLOWER_URL. If you need this integration and can verify the npm package and protect your token, the skill is usable; otherwise hold off until the publisher provides verifiable source and correct metadata.

Capability Analysis

Type: OpenClaw Skill Name: flower Version: 1.0.4 The skill bundle is designed to integrate with the Flower project management API. The `SKILL.md` provides clear instructions for setting up and using the skill, including installing a dependency via `npx @xferops/flower-mcp` and configuring an API token for `https://flower.xferops.com`. All instructions and tool definitions are consistent with the stated purpose of project management and lack any indicators of prompt injection, data exfiltration, unauthorized execution, or other malicious intent. The use of `npx` for a specific, named dependency is a standard pattern for skill setup and does not inherently indicate malice within the skill's own logic.

Capability Assessment

✓ Purpose & Capability

The name, description, and listed tools (projects, tasks, columns, comments, users, notifications) are coherent: this is a Flower project-management client intended to be used via an MCP server. The SKILL.md describes relevant operations and parameters.

⚠ Instruction Scope

The SKILL.md instructs the agent/user to run `npx -y @xferops/flower-mcp` and to configure an MCP client with environment values including FLOWER_URL and FLOWER_TOKEN. Those runtime actions go beyond passive documentation: they download/run an npm package and require storing an API token in a config file. The instructions do not reference any unrelated files or credentials, but they do instruct persisting a token into `~/.mcporter/mcporter.json` which has confidentiality implications and should be called out.

⚠ Install Mechanism

There is no formal install spec in the registry, but SKILL.md tells users to execute `npx -y @xferops/flower-mcp`. That will fetch and run code from the npm registry at runtime (supply-chain risk). This install method is common for ad-hoc tools but should be verified (package name, author, versions). The skill should ideally declare this dependency in metadata or provide a vetted release URL.

⚠ Credentials

The instructions require FLOWER_URL and FLOWER_TOKEN (the Flower API token) but the registry metadata lists no required environment variables or primary credential. The token is a sensitive secret; the skill's manifest should declare it. The variables requested are appropriate for the stated purpose, but the omission in metadata is a mismatch and increases the chance users will inadvertently expose credentials.

✓ Persistence & Privilege

always is false and there are no requests to modify other skills or system-wide settings. The only persistent change suggested is adding an MCP server entry (including the token) to the user's `~/.mcporter/mcporter.json`, which is reasonable for a client integration but has confidentiality implications noted above.

How to Use

Make sure OpenClaw is installed (local or Docker)
Run the install command in chat: /install flower
After installation, invoke the skill by name or use /flower
Provide required inputs per the skill's parameter spec and get structured output

Version History

v1.0.4

Release 1.0.4

v1.0.3

Release 1.0.3

v1.0.0

Initial release - Flower MCP for project management

Metadata

Slug flower

Version 1.0.4

License —

All-time Installs 0

Active Installs 0

Total Versions 3

Frequently Asked Questions

What is Flower?

Manage projects and tasks with the Flower project management API via MCP. Use when creating, updating, or searching tasks/tickets, managing projects and colu... It is an AI Agent Skill for Claude Code / OpenClaw, with 607 downloads so far.

How do I install Flower?

Run "/install flower" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Flower free?

Yes, Flower is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Flower support?

Flower is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Flower?

It is built and maintained by xferops (@parker-xferops); the current version is v1.0.4.

More Skills