claude-flow
Spec Support Unverified Confidence: Good (0.85)claude-flow is an MCP server published by ruvnet; its MCP spec-revision support has not been verified yet. It is a community implementation. Last verified 2026-08-07.
Does claude-flow support the current MCP specification (2026-07-28)?
Undetermined. We have not verified which MCP specification revision claude-flow supports (as of 2026-08-07).
Is claude-flow a first-party (official) MCP server?
No. claude-flow is a community-published MCP server from ruvnet, not a first-party vendor server (last verified 2026-08-07).
How do I connect to claude-flow?
claude-flow is available via the package npm:claude-flow, the official MCP Registry under io.github.ruvnet/claude-flow, the source repository at https://github.com/ruvnet/ruflo. Authentication: none. Transports: stdio.
When were claude-flow's facts last verified?
2026-08-07. Each fact on this page links to the sources used to verify it.
claude-flow is a community agent-orchestration harness by the developer
rUv (GitHub ruvnet), exposing MCP tooling for multi-agent workflows. The
project has since been renamed to "ruflo": the repository is now
ruvnet/ruflo and the package publishes to npm as ruflo, though the
older claude-flow npm package still exists and the official MCP
Registry record still lists the claude-flow name at a September 2025
alpha version.
The name matters for one reason beyond bookkeeping: the project carries a critical vulnerability. CVE-2026-59726 (GHSA-c4hm-4h84-2cf3), an unauthenticated remote code execution in the ruflo MCP bridge's default docker-compose deployment, is rated CVSS 10.0 and was patched in ruflo 3.16.3. It is covered in our news.
Authority is community: the publisher is an individual, not the vendor
of any fronted service, and the name "claude-flow" carries no Anthropic
affiliation. No surface names a supported MCP specification revision, so
spec_status is unknown.
How widely adopted is claude-flow?
Ranked #15 in The MCP 500 with Adoption Index 82.54 (snapshot , methodology v1).
| Measurement | Value | Source |
|---|---|---|
| Official MCP Registry | yes | API · |
| npm downloads (weekly) | 9,667 | API · |
| GitHub stars | 67,869 | API · |
| GitHub forks | 8,127 | API · |
| Last push | 2026-08-14T23:30:57Z | API · |
| Repository archived | no | API · |
How was this verified, and what are the sources?
Verified · method: repo-readme
· confidence 0.85 (Good).
- Official MCP Registry record io.github.ruvnet/claude-flow version 2.0.0-alpha.107 (published 2025-09-10) - npm package claude-flow, stdio transport; the record is nearly a year old and predates the project's rename to ruflo - accessed
- ruvnet/ruflo repository - the former claude-flow project, now named "ruflo" (package.json name claude-flow at version 3.34.0, npm also published as ruflo); owner is the personal account ruvnet (rUv), an agent meta-harness for multi-agent swarms and workflows; no MCP SDK dependency in package.json - accessed
- GitHub security advisory GHSA-c4hm-4h84-2cf3 / CVE-2026-59726, "Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment" - critical, CVSS 10.0, published 2026-07-01; npm package ruflo vulnerable below 3.16.3, patched in 3.16.3 - accessed