feat: Add Directus Flows & Operations management + fix inspector CVEs

[Copilot]

Directus Flows had no MCP representation, making it impossible to create or manage automations via AI clients. Also upgrades @modelcontextprotocol/inspector to patch two security vulnerabilities.

Flows & Operations tools

11 new tools covering the full Flows lifecycle:

Flows

• getFlows / getFlow — list and retrieve flows
• createFlow — create with name, trigger, status, accountability, options, icon, color, description
• updateFlow / deleteFlow
• triggerFlow — fire a flow via /flows/trigger/:id; supports GET/POST and optional payload

Operations (steps within a flow)

• getOperations / getOperation
• createOperation — attach to a flow with key, type, position_x/y, options, resolve, reject
• updateOperation / deleteOperation

Example — create a scheduled flow then attach a log operation:

// createFlow
{ "name": "Nightly cleanup", "trigger": "schedule", "options": { "cron": "0 0 * * *" }, "status": "active" }

// createOperation
{ "flow": "<flow-id>", "name": "Log start", "key": "log_start", "type": "log", "position_x": 0, "position_y": 0, "options": { "message": "Cleanup started" } }

Security

Bumps @modelcontextprotocol/inspector 0.10.2 → 0.16.6 (devDependency):

Advisory	Fixed in
Proxy server lacks authentication between Inspector client and proxy	0.14.1
XSS enabling potential command execution via untrusted MCP server	0.16.6