Is Formio MCP server safe?

Probably. Read the findings first.

C65/100grade C

Use with care. Some checks failed or could not be verified.

What to know before installing

Public scan report

scanner v0.1.9 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high

Code scan109 source files scanned13/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 10 days ago15/15
Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace8/10

highShell command built from a string (injection risk)exec.shell-concat

dist/auth.js: … : 'xdg-open'; exec(`${openCmd} "${loginUrl}"`, (err) => { …

Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

MCP
Authorize consequential AI agent actions before execution
not reviewed
Established
A
Agent-Native Forms
Agent-Native form builder - create, edit, and manage forms
More from BuilderIO →
not reviewed
Established
A
ContextStream MCP Server
Project memory, semantic code search, and grounded agent context.
not reviewed
Established
A