Back to the changelog

• Security

  Start requirements on every channel

  The "Require entityRefId" rule now applies on every creation channel (UI, API, event, Flow Agent, MCP), not just the API trigger — before, a Flow Agent start could create an item with an empty entity reference even when the flow required one. Both this and "Validate the data payload" are now presented as flow-level "Start requirements" at the top of the Activation tab, out of the "API trigger" block that wrongly implied they were API-only.

• Improvement

  Centralized create and transition paths

  Every point that creates an item or runs a transition (item POST, REST/extension transitions, Flow Agent, worker/MCP callbacks) now goes through a single state-entry path. As a result the Data Gate, the AI safety net (no AI run on empty data) and the per-state iteration limit apply uniformly everywhere, including agent starts.

• Integration

  AI start shared between Flow Agent and MCP

  The "Flow Agent" section of the Activation tab becomes "AI / Agent start" and makes clear it governs both the built-in Flow Agent and external AI agents via MCP. The "when to use this flow" hints (intent + sample phrases) are now exposed to MCP agents too: an external LLM listing the flows sees the same guidance as the built-in agent and knows which flow to start (and which not to).