diff --git a/mcpo/flowagent/Dockerfile b/mcpo/flowagent/Dockerfile
new file mode 100644
index 0000000..edfa2d2
--- /dev/null
+++ b/mcpo/flowagent/Dockerfile
@@ -0,0 +1,21 @@
+FROM ghcr.io/open-webui/mcpo:main
+
+# Azure CLI — required for non-interactive service-principal auth
+# (`az login --service-principal`) performed by entrypoint.sh at container
+# start. FlowAgent's auth model is Azure CLI + MSAL; see
+# https://github.com/microsoft/power-platform-skills/blob/main/plugins/power-automate/references/connection-patterns.md
+RUN apk add --no-cache py3-pip curl \
+ && pip install --no-cache-dir --break-system-packages azure-cli
+
+# FlowAgent self-contained MCP bundle (stdio transport, all tools inlined,
+# Node 18+ only — no npm install / remote host needed at runtime).
+# Pinned to a ref (commit SHA or tag), NOT `main`, for reproducible builds.
+# Bump deliberately via PR when upstream ships updates:
+# https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-automate/server
+ARG FLOWAGENT_REF=main
+RUN mkdir -p /app/flowagent \
+ && curl -fsSL "https://raw.githubusercontent.com/microsoft/power-platform-skills/${FLOWAGENT_REF}/plugins/power-automate/server/mcp.mjs" \
+      -o /app/flowagent/mcp.mjs
+
+COPY entrypoint.sh /app/flowagent/entrypoint.sh
+RUN chmod +x /app/flowagent/entrypoint.sh