Skip to content
FlowMCP v4

Scope Allowlist + Public-only Principle

Spec: gradingSpec/1.1.0 Status: stable (additive extension of 1.0.0) Changes vs. 1.0.0: entirely new Scope chapter (scope allowlist + public-only principle).

The grading system covers only an explicit allowlist of FlowMCP constructs: Tools, Shared Lists, the about markdown resource, and Skills are gradable, while all other Resources, Prompts, and Procedures stay on-hold because they lack a clear grading methodology. A second, orthogonal boundary applies on top of that allowlist — the public-only principle restricts grading to publicly accessible data sources, leaving private or non-public interfaces to the schema author. This chapter defines both boundaries and the consequences they have for which areas run and how out-of-scope fields are answered.

Scope

Section titled “Scope”

Scope Allowlist

Section titled “Scope Allowlist”

The grading system covers an explicit allowlist of FlowMCP constructs. The about markdown resource and Skills have a clear grading methodology and are in-scope (graded by their dedicated areas). All other Resources, Prompts, and Procedures remain FlowMCP constructs without a clear grading methodology — they lie outside the current scope.

ElementStatusRationale
ToolsIn-Scope (primary)Most measurable unit
Shared ListsIn-Scope (secondary)Best available
about markdown resourceIn-ScopeThe single gradable resource — carries the Domain-Knowledge; graded by the about-namespace and about-selection areas
Skills (type namespace / selection / agent)In-ScopeGraded per-skill by the namespace-skills and selection-skills-L1/L2/L3 areas
Resources other than about (local files)Out-of-Scope (on-hold)Not reproducible
Resources (local SQLite)Out-of-Scope (on-hold)Private DB
Resources (SQL in general)Out-of-Scope (on-hold)Connection complexity
PromptsOut-of-Scope (on-hold)Unclear how to test
ProceduresOut-of-Scope (on-hold)Unclear how to test

Nine entries in total. The about markdown resource and Skills are in-scope; all other Resources, Prompts, and Procedures remain on-hold. Adding a new element to the allowlist is a gradingSpec bump.

Public-only Principle

Section titled “Public-only Principle”

The FlowMCP grading system is designed exclusively for publicly accessible data sources. Schemas that address private or non-publicly reachable resources lie outside the standardisation scope. Responsibility for grading such schemas rests with the schema author and the end user.

This principle is the consequence of 02-eligibility.md (target audience — public interfaces) and the data-source access-class taxonomy. It prevents the grading system from taking responsibility for schemas whose data source belongs to another party (internal API, private SQLite, non-public SQL) outside the reach of the standardisation process.

Consequences

Section titled “Consequences”
  • Provider areas are tool-centric (matches the allowlist) — the single-test, tools-aggregate-schema, and tools-aggregate-namespace areas evaluate tool aspects (see 08-grading-model.md)
  • Existing non-tool code that is not about or a Skill is marked on-hold — code audit
  • The n/a convention (see 08-grading-model.md) is the standard answer for out-of-scope fields of an otherwise valid schema (e.g. a schema has tools + resources — tools are graded, resources n/a)

Relationship to Exclusion Criteria and Access Classes

Section titled “Relationship to Exclusion Criteria and Access Classes”

The exclusion criteria and access classes in 02-eligibility.md govern what is permitted within a schema (read-only, OAuth prohibition, free-tier requirement). Scope governs what at all is graded:

  • Exclusion criteria / access classes: microscope (which endpoints may be inside?)
  • Scope: telescope (which FlowMCP constructs are covered at all?)

The two complement each other. A schema can satisfy the exclusion criteria and access classes perfectly and still contain out-of-scope constructs (e.g. Procedures) — the Procedures then receive n/a, the tools are graded in full.

Section titled “Related”