# Flow MCP: smarter flow generation, validation warnings, and clearer preview limits > Published: 2026-08-12 > Updated: 2026-08-12 > Canonical: https://finalpos.com/help/flow-mcp-smarter-flow-generation-validation-warnings-and-clearer-preview-limits The Final Flows MCP server update (2026-08-07) adds TypeScript types to the scaffold baseline, surfaces validate_flow advisory warnings to external agents, blocks deploy_flow on hardcoded credentials, and emits a preview-limitations manifest from start_preview. All changes are live on build.finalpos.com and flow.finalpos.com with no client configuration needed. ## Key takeaways - The scaffold baseline now includes TypeScript types, so first-time syncs no longer produce a wall of TS errors. - validate_flow v2 surfaces advisory warnings for money math, hardcoded catalog data, missing navigation anchors, and tip/gratuity misuse directly to your MCP client. - deploy_flow now blocks on hardcoded credentials before any deployment attempt. - start_preview emits a manifest of preview limitations so AI agents know what the preview can and cannot simulate. - All improvements are live on build.finalpos.com and flow.finalpos.com — no client configuration changes required. ## What changed On 2026-08-07 we shipped a set of improvements to the Final Flows MCP server, the Flow project, and the Cursor plugin — all live now on flow.finalpos.com. The changes fall into four areas. --- ## 1. TypeScript types ship with the scaffold baseline **Before:** The first time you ran `validate_flow` or synced a new scaffold, you'd hit a wall of `TS7016` / `TS7026` errors because `@types/react` and `@types/react-dom` were missing from the preview scaffold's `devDependencies`. The tool looked broken before you'd written a single line. **After:** `@types/react`, `@types/react-dom`, and `typescript` are now part of the scaffold baseline and kept in sync with the seed template automatically. First-time syncs are clean. --- ## 2. `validate_flow` now returns advisory warnings `validate_flow` has been upgraded to v2. It now returns a `warnings[]` array that surfaces four existing guardrail checks — previously only visible inside the in-app fix loop — directly to your MCP client: - **Client money math** — flags flows that perform payment calculations client-side instead of on the server. - **Hardcoded catalog data** — catches product IDs, prices, or SKUs baked into the flow code rather than fetched from the catalog. - **Missing `StationHomeButton`** — warns when the station-home navigation anchor is absent. - **Missing `data-test` attributes** — flags components that can't be targeted by automated tests. - **Tip/gratuity as cart fee** — a new lint that catches the common mistake of adding a tip as a line-item cart fee instead of using the correct gratuity field. `validate_flow` also now: - Reports `typechecker: ok` or `typechecker: unavailable` explicitly, instead of returning a silently clean result when the type checker couldn't run. - Stamps `pinnedCommandFrameVersion` and `currentVersion` in the response so you can see immediately if your scaffold has drifted from the deployed command frame. --- ## 3. `deploy_flow` blocks on hardcoded credentials If your flow source contains hardcoded secrets or credentials, `deploy_flow` now refuses to proceed and returns an actionable error. Because a built flow can be distributed to other organisations, a leaked credential is an irreversible harm — this check runs before any deployment attempt. --- ## 4. `start_preview` emits a preview-limitations manifest The preview environment has always had constraints that weren't documented anywhere an external agent could read them. `start_preview` now emits a version-stamped manifest that lists exactly what the preview does and does not simulate: - Instant always-success tenders (no real payment processing) - Canned card totals - Cart appends that do not read back - Query filters that are ignored - The `?finoodle_mock` dataset selector for switching mock datasets This means your AI agent knows the preview's limits before it starts testing — not after it's confused by unexpected behaviour. --- ## 5. Rate budget disclosure in server instructions The MCP server instructions now include per-key hourly rate budgets, interpolated directly from the enforcement constants. The prose and the enforcement can no longer drift apart. --- ## Who benefits These changes apply to every MCP client: Claude Code, Cursor, Gemini CLI, ChatGPT, and any other client connecting to the Final Flows MCP server. No configuration changes are needed on your end — the improvements are live in the server and scaffold baseline. If you previously worked around the old behaviour with a custom skill or prompt file, you can simplify or remove those workarounds. The guardrails that required manual instruction are now built into the server.