flowR

io.github.flowr-analysis由 GitHub 账号 flowr-analysis 发布v0.1.3更新于 Oct 29, 2026

Static dataflow analysis, program slicing, linting, and dependency extraction for R code.

已验证STDIO仅桌面开发者工具数据与分析

概览

AI 生成的概览

flowR 提供一个 query 工具,让助手在不运行代码的情况下对 R 代码做静态分析:切片、lint、依赖提取与签名检索。

可以做什么
  • 静态分析 R 代码:程序切片找出影响某变量的代码、lint 结果、依赖提取
  • 检索 R 包签名,并依据签名数据库推测包版本
  • 通过同一个 query 工具执行 flowR Query API 的其他查询
适用场景
适合助手需要处理 R 源码的场景:理解数据流、找出影响某个值的代码、对脚本做 lint、列出依赖或查询包签名,且无需安装 R 或执行代码。
运行要求
通过 npm 包 @eagleoutice/flowr-mcp 以 stdio 在本地运行(npx),需要 Node.js,无需安装 R。首次启动会从 flowR 发布页下载约 66 MB 的签名数据库到 ~/.cache/flowr 并校验哈希。远程客户端需以 HTTP 方式启动并置于 HTTPS 之后,可设置 PORT、HOST 和 FLOWR_MCP_PATH。
安装前请注意
服务器不会运行被分析的代码,但 linter 的 checkUrls 选项会让它访问代码中的 URL。HTTP 模式下它把代码视为不可信并限制文件访问、网络、进程和 R,但密钥路径(FLOWR_MCP_PATH)是远程客户端唯一支持的访问控制,公开实例建议加限流。首次启动会下载数据库。

安装

在 SourceWeft 中

  1. 打开 控制台中的 flowR,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

flowR MCP Server

A Model Context Protocol server with a single query tool that lets LLM clients analyze R code with flowR: slicing, linting, dependencies, version guessing, signature database search, and every other query of the Query API. No R installation is needed.

On its first start, the server downloads flowR's signature database (about 66 MB) from the flowR releases into ~/.cache/flowr and checks its hash. Version guessing and signature search need this database. Everything else also works offline. The server never runs the analyzed code. It contacts no other server, unless a query asks the linter to check the URLs in the code (checkUrls, which is never allowed over HTTP).

In Claude Code, one plugin installs both this server and the flowR skill:

text
/plugin install flowr --marketplace flowr-analysis/flowr

Other local clients start it over stdio:

shell
claude mcp add flowr -- npx -y --omit=optional --ignore-scripts @eagleoutice/flowr-mcp      # Claude Codecodex mcp add flowr -- npx -y --omit=optional --ignore-scripts @eagleoutice/flowr-mcp       # OpenAI Codexgemini mcp add flowr npx -y --omit=optional --ignore-scripts @eagleoutice/flowr-mcp         # Gemini CLI

or, configured by JSON (Claude Desktop, Cursor, VS Code, ...):

json
{ "mcpServers": { "flowr": { "command": "npx", "args": ["-y", "--omit=optional", "--ignore-scripts", "@eagleoutice/flowr-mcp"] } } }

The flags keep the install small. They skip the optional dependencies flowR does not need here, and they run no install scripts. The package's npm-shrinkwrap.json pins every dependency.

Remote clients (ChatGPT, claude.ai, ...) need the server running over HTTP behind HTTPS:

shell
npx -y --omit=optional --ignore-scripts @eagleoutice/flowr-mcp --http 1042cloudflared tunnel --url http://localhost:1042

Then add https://<host>/mcp as a connector (in ChatGPT, this needs developer mode). Without a port, the server uses $PORT or 1042. It listens on 127.0.0.1 unless HOST says otherwise, for example HOST=0.0.0.0 in a container. Setting FLOWR_MCP_PATH=/mcp/<random> replaces /mcp with a secret path. A secret path is the only access control that every remote client supports.

Over HTTP, the server treats the code as untrusted:

  • It never reads its own files: there is no files argument, source() is ignored, and the config query is refused.
  • It runs in flowR's secure mode, without network access, processes, or R.
  • It keeps stack traces to itself.
  • It refuses requests from browser pages and requests over 1 MB.
  • It runs one analysis at a time, with at most 16 waiting, and stops each after 30 seconds or 2 GB of memory.
  • It cuts answers at 50000 characters.

Put a rate limit in front of a public instance.

SKILL.md is an agent skill (Claude, Codex, Gemini CLI, ...) that says when and how to use flowR, with or without this server. To use it, copy it to, for example, ~/.claude/skills/flowr/SKILL.md.

来源:mcp/README.md,提交 e2b2464

工具

1

query

Statically analyze R code and search R package signatures with flowR queries (https://github.com/flowr-analysis/flowr/wiki/Query-API). Common ones: {"type":"static-slice","criteria":["12@x"]} for the code affecting x in line 12, {"type":"linter"} for lint findings, {"type":"dependencies"} for loaded libraries, read and written files, {"type":"guess-dep-versions"} for the package versions the code works with, {"type":"call-context","callName":"^read_"} for calls, and, needing no code, {"type":"signature","package":"dplyr","function":"across"} to search signatures and versions (globs allowed), {"type":"function-info","name":"filter"} for the packages exporting a function. A query with wrong arguments is answered with its schema. Types: call-context (Call-Context Query), config (Config Query), control-flow (Control-Flow Query), call-graph (Call-Graph Query), dataflow (Dataflow Query), does-call (Does-Call Query), dataflow-lens (Dataflow Lens Query), absint (Abstract Interpretation Query), files (Files Query), id-map (Id-Map Query), normalized-ast (Normalized AST Query), dataflow-cluster (Dataflow Cluster Query), static-slice (Static Slice Query), provenance (Provenance Query), input-sources (Input Sources Query), dependencies (Dependencies Query), location-map (Location Map Query), search (Search Query), happens-before (Happens-Before Query), inspect-exception (Inspect Exceptions of Functions Query), inspect-higher-order (Inspect Higher-Order Functions Query), inspect-recursion (Inspect Recursive Functions Query), inspect-fn-props (Inspect Argument Roles Query), resolve-value (Resolve Value Query), project (Project Query), signature (Signature Query), origin (Origin Query), linter (Linter Query), dice (Dice Query), guess-dep-versions (Guess Dependency Versions Query), function-info (Function Info Query)

输入参数codefilesqueries必填

版本历史

2
  1. v0.1.3最新Oct 22, 2026
  2. v0.1.0Oct 20, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分
  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分