LoginSign Up
← Back to all sparks
F

Flowise

AI-ASSISTANTS
Velocity2.5

Open-source low-code tool to build LLM apps and AI agents visually.

flowiseai.com ↗

Flowise spent 2026 paying down the security debt of a multi-tenant agent builder

agent-buildermulti-tenancysecurity-hardeningmcpself-hostedagentflow
◆Current state
Flowise ships from GitHub on a roughly monthly minor cadence, and since 3.1.0 in March the release notes read less like a feature log than a hardening program. 3.1.2 and 3.1.4 are dominated by cross-workspace authorization fixes, tenant validation, credential-leak repairs and sanitization work, much of it filed by Workday-affiliated contributors. The one clear capability move in the window is 3.1.3 turning a chatflow into an MCP server.
◆Where it's heading
The project is converting from a self-hosted hobby flow builder into something a large organization can run with multiple tenants on one instance. 3.1.0 made that explicit by enabling HTTP security checks and an internal-address deny list by default — a breaking change accepted in exchange for SSRF protection. Feature work continues on AgentFlow (rich-text content editing, form input filtering, canvas actions), but it is now secondary to isolation guarantees.
◆Prediction
The concentration of workspace-boundary fixes suggests the next releases keep auditing the same seam — expect more tenant-scoped endpoint checks and MCP configuration controls rather than a new authoring surface.

◆Recent moves

  1. 20d ago

    3.1.4 tightens tenant isolation and gates MCP stdio commands

    Almost the entire release is isolation work: cross-workspace authorization on openai-realtime, tenant validation, node-load workspace scoping, an operator-controlled allowlist for custom MCP stdio commands, and deny-list checks on web scrapers and chat models. Substantial for anyone running Flowise for more than one team, invisible to a single-tenant user.

    View source ↗
  2. 1mo ago

    3.1.3 turns any chatflow into an MCP server

    ⚡ SPARK

    Buried in a fix-heavy release is the ability to turn any chatflow into an MCP server, which inverts Flowise's position in a stack: flows stop being endpoints you call and become tools other agents call. AgentFlow also gains change notifications on node and edge deletion plus client-side filtering of Start-node form options.

    View source ↗
  3. 4mo ago

    3.1.2 fixes credential leak, CORS wildcard and cross-workspace disclosure

    A security-dominated release: a wildcard CORS policy on the TTS endpoint, mass assignment in the tools endpoint, a credential data leak and cross-workspace chatflow disclosure all get fixed, alongside MCP server config hardening. This is the release that set the pattern the next two followed.

    View source ↗
  4. 4mo ago

    flowise-ui tagged 3.1.2 alongside the main release

    The UI package's matching 3.1.2 tag, published in the same batch. No user-visible change beyond what the main release carries.

    View source ↗
  5. 4mo ago

    flowise-components tagged 3.1.2 alongside the main release

    A package tag published alongside the 3.1.2 release with no changes of its own. Version bookkeeping for the components package.

    View source ↗
  6. 4mo ago

    3.1.1 adds an AgentFlow rich text editor and Weaviate v3 client

    Real AgentFlow authoring work — a rich text editor for content editing, fixed model parameters, synchronous array-input keys — plus a Weaviate client v3 migration for embedding compatibility. The last release before security fixes took over the changelog.

    View source ↗