Skip to main content
Uses: CLI · Claude Code · Codex
Flo is an agent for Claude Code and Codex. You describe a workflow (“when a deal closes in Salesforce, post to Slack”); Flo designs it, dry-runs it against your own Engini account, shows you a proposal, and creates it only after you approve - always turned off. You finish and turn it on in the Engini designer. Flo works through the engini CLI, on your own login and your own API-key connection. It does nothing your key could not do by hand - which is also the honest limit of every safety measure on the Flo safety page. The current release is v0.1.0. The plugin is published at github.com/engini/flo-plugin.
Flo has been tested on Claude Code only. The Codex install and the Codex-specific steps on this page are provisional: they have not yet been verified on a real Codex install.

​
Before you start

jq is not needed.

​
Install in Claude Code

Run these two commands in Claude Code:
To stay on one reviewed release, add the marketplace pinned to its tag instead:
Replace vX.Y.Z with the release tag, for example v0.1.0. Claude Code does not update plugins on its own, and neither tool signs or verifies a plugin, so the pinned form is the one to use if you review what you install. Start a new session after installing - the skill is not found until you do.

​
Install in Codex

Not yet verified on a real Codex install - treat these steps as provisional.
Then install flo from the /plugins browser and start a new session - the skill is not found until you do. Codex has no Flo guard hook, so also save the Codex rules from Flo safety as ~/.codex/rules/flo.rules. Codex runs commands without network by default, which makes every engini call fail: see Codex sandbox.

​
Add the safety settings

A plugin cannot install your own permission settings for you. Copy them in yourself:
  • Claude Code: merge the permissions block from Flo safety into your user settings, and never run Flo on auto-accept or --dangerously-skip-permissions.
  • Codex: save the rules file as described above.

​
Check the install

This check must fail loudly if something is wrong. Claude Code. Run /plugin details flo@engini-flo. It must list Skills (1), Agents (1) and Hooks (1). Hooks (0) means the guard is not installed and nothing but your own settings stops the four things Flo never does (see Flo safety). Then prove the guard actually runs. Ask Claude to run this exact command. It is harmless either way: it makes a throwaway fake engini in a temp folder and puts it first on the path, so your real CLI and account are never touched.
  • The result says FLO-HOOK-DENY - the guard is working.
  • It prints FLO-CANARY-RAN - the guard did not run (no Python on the path, hooks disabled in your settings, the plugin disabled, or an older Claude Code). Fix that before you rely on it.
  • It prints a permission-denied message and neither of the two above - your own settings caught it, but the guard still did not run. Fix that too.
Never test the guard with a real never-verb against your real engini: if the guard is missing, that is a real delete on your account.

​
Connect Engini

Do this in your own terminal.
1

Log in

Interactive. Never engini login --api-key ...: arguments end up in your shell history and in the process list.
2

Connect the workflows app

Choose auth method 1 (x-api-key) and paste your workspace-scoped key. Any other auth method fails every builder call with 403 API_KEY_REQUIRED.
Run both yourself, outside Claude Code or Codex. Flo’s guard refuses to let the agent run them, because they put a raw key in the agent’s hands.

​
First run

Ask for a workflow in plain words:
Flo then:
  1. Checks the CLI version, your login (account, workspace and environment) and your engini_workflows connection.
  2. Compiles a throwaway plan to confirm which workspace and environment your connection writes to.
  3. Searches the catalog, reads each step’s schema and dropdown options, and compiles the plan until it is clean.
  4. Stops and shows you a proposal table: every step, the target workspace and environment the compile echoed, the connection id and a fingerprint.
  5. Creates the workflow only when you approve that proposal in the conversation, quoting its fingerprint. The workflow is created turned off.
You finish in the Engini designer: connect any step Flo could not connect (Flo lists them), fill fields it left empty on purpose, and turn the workflow on.

​
What Flo will and won’t do

Flo will: design, dry-run, propose, and create or update workflows you approved - always turned off. Flo won’t: turn a workflow on or off, run it, rerun an execution, delete a workflow, create or change a connection, or handle your API key. How each of these is enforced, and where the enforcement stops, is on Flo safety.

​
Update and uninstall

  • Update: run /plugin marketplace update engini-flo, then reinstall with /plugin install flo@engini-flo. In Codex, upgrade from /plugins. Neither tool updates Flo on its own, so a fix to the never list or the guard reaches you only when you update.
  • Uninstall: run /plugin uninstall flo@engini-flo (Claude Code), or remove it in /plugins (Codex). Remove the safety settings from your configuration if you no longer want them.

​
Troubleshooting

The full list, including every error Flo can report from Engini, is in the plugin’s troubleshooting guide.