Offer resources

Tools let an AI agent act on your API. Resources let it read context. A resource exposes structured data to MCP clients through the standard resources/list, resources/templates/list, and resources/read operations — the client decides how to use it (passing it to the model, searching it, or selecting a subset).

FlowCP supports two kinds of resource:

• Static resources — author-written content (markdown, JSON, plain text) served from a fixed URI, e.g. doc://house-style. Good for guidelines, reference material, and other content that doesn't change per request.

• Endpoint resources — resource templates generated from your read-only GET endpoints, e.g. app://orders/{id}. When a client reads a concrete URI like app://orders/42, FlowCP performs a live fetch through the backing tool, in the end user's own authorization context.

How clients consume a resource

When a resource is enabled, the runtime advertises it to connected MCP clients:

• A static resource appears in resources/list and returns its stored content on resources/read.

• An endpoint resource appears in resources/templates/list as a template. The client fills in the URI variables (e.g. an order id) and calls resources/read; FlowCP maps each variable to the backing tool's input, invokes it, and returns the live response. URI variables can offer completion suggestions so users discover valid values as they type.

User-context fetch and fail-closed

Endpoint resources follow the same security model as tools. Under the default user_oauth auth mode, a read requires a valid Bearer token from the AI client and never falls back to a shared credential — see User-context OAuth. If no token is present, the read fails closed with AUTH_REQUIRED and no upstream call is made. Only read-only GET endpoints can back a resource, so resources/read can never trigger a write.

Opening the resources list

From your app's dashboard, click the Resources tab. The page lists every resource on the selected server, each with an on/off switch and a badge showing whether it is Static or an Endpoint template. If your app has multiple environments (branches), use the branch buttons to switch between them.

Where endpoint resources come from

Endpoint resource templates are generated automatically when you connect and import an API. Every read-only GET endpoint that produces a tool also produces a matching resource template, linked to that tool. Like tools, they are created disabled — enable the ones you want to expose. Re-importing is safe: it preserves your enabled state and edits.

Generating from an existing import

If your app was imported before the Resources feature existed, its endpoint templates won't exist yet. You don't need to re-import — click Generate from API on the Resources page. FlowCP re-reads the OpenAPI document captured at your last import (no upstream call), generates a resource template for every read-only GET endpoint, and links each to the tool it already created. The action is idempotent: existing resources keep their enabled state and edits, and new ones appear disabled. If the server has no read-only endpoints, nothing is created.

Creating a static resource

1. Click New resource.

2. Fill in the fields:

   • Name — a snake_case identifier, e.g. house_style.

   • Description — a one-line summary shown to the client.

   • URI — the fixed URI the content is served at, e.g. doc://house-style.

   • MIME type — e.g. text/markdown or application/json.

   • Content — the body to serve.

3. Click Create resource.

New resources are created disabled, following the platform's default-deny model — see Default-deny model.

Enabling a resource

Toggle the switch on a resource's row to On to offer it to AI clients. Changes take effect immediately — no re-publish required. Disabled resources are never listed or readable.

Editing and deleting

• Click the pencil icon to edit a resource. For static resources you can change the name, description, URI, MIME type, and content. For endpoint resources the backing tool and URI variables come from your imported API; you can adjust the title, description, and URI template.

• Click the trash icon to delete a resource. This cannot be undone.

Publishing

Publishing is blocked if an enabled endpoint resource points at a tool that is missing or disabled — otherwise the read would fail closed at runtime. Enable the backing tool, or disable the resource, before publishing. See Publish your MCP server.