Formio MCP server

by form.io·io.form/formio-mcp·v1.0.1·8 stars

No reviews yet

Create and manage Form.io forms, resources, actions, roles, and projects from your AI agent.

B83/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B83/100

full report

Adoption

Growing

8 stars342 downloads/wk

Reviews

Write one

Nobody has reviewed Formio yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Formio tools (25, 9 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

action_createwrite action
Create a new action on a form. Call action_type_get first to discover the required settings schema for the action type.
action_deletewrite action
Delete an action from a form. The action stops running on submissions immediately and is not recoverable — call action_get first if the settings may be needed again.
action_get
Get a single action by ID from a form, including its handler, method, condition, and type-specific settings. Call action_list first to find the action ID.
action_list
List the actions configured on a form, one page at a time — the server-side handlers that run when a submission is saved, such as save-to-resource, email, login, and role assignment.
action_type_get
Get action type info and settings form schema. Call this before action_create to discover the required settings for the action type.
action_type_list
List the action types available for a form. Returns the whole catalog the server supports in one result.
action_updatewrite action
Update an existing action on a form; call action_get first if you do not already have it. Sent fields overwrite, arrays and objects whole; top-level fields left out keep their value.
form_createwrite action
Create a form in the project `cwd` resolves to. Build the form JSON with the formio-schema skill first. On a deployment licensed for revisions, `revisions` defaults to "original". Not for a draft of an existing form ("save a draft", "draft <change>"): use form_update with `draft: true`.
form_get
Fetch a form definition, by _id or path, from the project `cwd` resolves to. `draft: true` fetches its in-flight draft instead of the published form.
form_list
List forms from the project `cwd` resolves to, one page at a time, optionally filtered by type and tags.
form_publishwrite action
Publish a form's draft as its live version in the project `cwd` resolves to. Save the draft first with form_update and `draft: true`; a form with no draft fails with NO_DRAFT. Needs the revisions licence (Security Module).
form_revert
Revert a form in the project `cwd` resolves to back to a prior revision: its components, tags, properties and display replace the live form's. Find it with form_revision_list. Needs the revisions licence (Security Module).
form_revision_get
Fetch one immutable form revision from the project `cwd` resolves to. Restore it with form_revert, passing its `_vid`.
form_revision_list
List a form's published revision summaries in the project `cwd` resolves to, newest first, one page at a time. Read one with form_revision_get, or restore one with form_revert, passing its `_vid`.
form_updatewrite action
project_export
Export the project `cwd` resolves to as a template (roles, resources, forms, actions). With `tag`, export the template that version tag stored instead — how a workspace's template.json is refreshed; Form.io does not store project-level access with a tag, so that comes from the project's current access.
project_get
project_import
Import a template's roles, resources, forms and actions into the project `cwd` resolves to, for a first build: build it with the formio-resource-planner skill. Each form it names is replaced, its actions deleted and recreated, and its `access` replaces the project's; change an existing project with the form, role and action tools instead.
project_set
project_tag_createwrite action
Version the project `cwd` resolves to: Form.io snapshots its current state under a semver `tag` with a `description`, and the project is then at that version. Ask the user before calling. Export the version with project_export `tag`.
project_tag_list
Report the version the project `cwd` resolves to is at (`current`) and its version tags, newest first. With `compare: true`, also report the roles, resources, forms and actions changed since `current` — changes made outside the agent.
role_createwrite action
Create a new role in the project `cwd` resolves to.
role_list
List the roles defined in the project `cwd` resolves to, one page at a time.
role_updatewrite action
Update an existing role in the project `cwd` resolves to. Sent fields overwrite, arrays and objects whole; top-level fields left out keep their value.
server_status
Report this server's name and version and how `cwd` resolves to a project, as project_get does. It makes no Form.io request and needs no credentials: call it first when other tools fail.

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

no findings

Code scan143 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 1 days ago15/15
Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace8/10

Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Formio compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 83/100; higher than 68% of 4,460 AI and agents servers
Tools: 25; the typical AI and agents server has 6
Tools that change things: 36%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 8; more than 82% of 2,711 AI and agents servers
Downloads a week: 342; more than 81% of 1,538 AI and agents servers with a package

What its tools let an agent do: 16 read · 9 change

Release history: 4 versions in the registry since 2026-09-09, latest 2026-10-14, typically one every 9 days.

Install Formio in Claude Code, Cursor or VS Code

Runs npx -y @formio/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add formio-mcp -- npx -y @formio/mcp

Add to Cursor

What the publisher says

From the Formio repository's README, as published. We do not edit it. Read it on GitHub

The Form.io Agentic Coding Toolset

@formio/ai is what brings Form.io into your agentic coding environment. It provides a series of tools that enable any developer to perform a number of complex actions against the Form.io Enterprise Server using their favorite Agentic Coding toolsets. This turns the Form.io Enterprise Server into a Composable Backend for Agentically Coded Applications.

Getting Started
What you get
Why this exists
Agentic Skill Library
How it all works together
Orchestration skills
All skills
Examples and Use Cases
Build complete applications
Build forms and wizards
Embed forms in existing applications
Work the REST API via prompt

Getting Started

To get started, open up your Terminal within your application folder, and then use one of the following methods to install this plugin within your application folder.

Option 1: Skills.sh Installation

npx skills add formio/ai

The command installs the skill library into .agents/skills/ folder within your application, which every skills-capable agent reads. It installs skills only — the Form.io MCP server, which is what gives the agent tools like formcreate, formlist, and project_import, is connected on first use by the bundled formio-mcp-setup skill: it writes the MCP configuration for your client, asks you to approve it, and tells you to reload.

Option 2: Agent Plugin Installation

If your agent supports plugins, installing the plugin is an alternative to the command above. A plugin install already includes the skills and the MCP server:

Claude Code

/plugin marketplace add https://github.com/formio/ai.git
/plugin install formio-ai@formio

Cursor

Plugin installation coming soon

Codex

Plugin installation coming soon

Copilot

Plugin installation coming soon

Project Setup

Neither install route asks for a URL. Both are resolved per working directory, so one install can serve several projects, and the answer travels with the code rather than with your machine. The first Form.io tool call that needs a project reports what is missing and names the command that supplies it:

# What does this directory resolve to?
npx -y @formio/mcp@0.13.0 project get --cwd "$(pwd)"

# Record it for this machine…
npx -y @formio/mcp@0.13.0 project set --project-url "<project url>" --cwd "$(pwd)"

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

2026-10-15restoreC → Bscore 83

Formio: common questions

Is Formio MCP server safe?: Mostly: it is graded B (83/100). Read the Formio safety report
How do I install Formio?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Formio need an API key?: Yes. The registry entry asks for FORMIO_API_KEY.
Is Formio maintained?: The last commit was 21 days ago (2026-10-14). The latest release is v1.0.1.
What can I use instead of Formio?: Servers from other publishers that do the same job: Decionis MCP server, Agent-Native Forms MCP server and Emilia Protocol MCP server.
How does Formio compare with other AI and agents MCP servers?: safety score 83/100 (higher than 68% of 4,460 AI and agents servers); tools 25 (the typical AI and agents server has 6); tools that change things 36% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Formio

Same job from other publishers: the closest match first, then the best rated.

Decionis
Authorize consequential AI agent actions before execution
not reviewed
Established
A
Agent-Native Forms
Agent-Native form builder - create, edit, and manage forms
More from BuilderIO →
not reviewed
Established
A
Emilia Protocol
Exact-action approval for consequential agent actions: request, track, and verify signed receipts.
not reviewed
Established
B
three.ws Provenance
Append-only, signed, on-chain-verifiable agent action log — record and audit what agents did.
More from nirholas →
not reviewed
Established
B

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: B · 83/100
Stars: 8
Downloads/wk: 342
Price: Free
Licence: MIT
Transport: Local · npm
Version: 1.0.1
Category: AI and agents
Last release: 2026-10-14

Credentials it needs

FORMIO_PROJECT_URLOptional, and the WEAKEST of the three project sources: a committed formio.json found by walking up from the working directory wins, then the per-directory mapping project_set writes, then this. It pins nothing — project_set can redirect a directory whose environment names a different project. Useful for a launch with nowhere to record a project, such as CI or a container (e.g. https://examples.form.io on the hosted cloud; self-hosted it is either https://your-project.your-domain.com or https://your-host/project-name, depending on how that deployment routes projects). Leave it unset and the agent asks for a project and records it per directory.
FORMIO_BASE_URLOptional, and usually unnecessary: the base URL is DERIVED from the project URL — https://api.form.io for a project on a form.io host, the parent path for a project addressed as a sub-directory — and is asked for only when it cannot be derived, which is a path-less project URL on a customer domain. There is no default. Like FORMIO_PROJECT_URL it is the weakest source, behind a committed formio.json and the per-directory mapping.
FORMIO_API_KEYsecretForm.io project API key. Optional — applied only to the project FORMIO_PROJECT_URL names, so set FORMIO_PROJECT_URL beside it; any other project, and every project when it is omitted, uses the browser-based portal login flow to obtain a JWT.
FORMIO_LOGIN_FORMURL of a custom login form used by the browser-based portal login flow. Defaults to the deployment's portal login form.
FORMIO_AUTH_HOSTAddress the browser-login page binds to. Optional; defaults to 127.0.0.1. Set it to 0.0.0.0, together with FORMIO_AUTH_PORT, when the server runs in a container or on a remote machine and the login page must be reachable through a published port. 0.0.0.0 exposes the page on every interface for the duration of a login.
FORMIO_AUTH_PORTFixed port for the browser-login page, so a container can publish it (e.g. 43117). Optional; a positive integer, and by default the page takes an ephemeral port.
FORMIO_AUTH_TIMEOUTSeconds to wait for a browser login before the call fails with an error naming the remedies. Optional; a positive integer no larger than 2147483, and any other value is ignored. Defaults to 900.
FORMIO_FORCE_BROWSERSet to 1 to attempt the browser login even where the server detects it cannot present one (CI, a container, a remote shell with no display). Use it when the login page is reachable from a browser elsewhere.
FORMIO_REQUEST_TIMEOUTSeconds a Form.io request may go unanswered before the call fails with a network error naming the URL. Optional; a positive integer no larger than 2147483, and any other value is ignored. Defaults to 60. project_import and project_export wait 300 seconds, or this value when it is longer.
FORMIO_INSECURE_TLSSet to 1 to skip TLS certificate verification only for requests to the configured deployment (the hosts of the resolved project URL and base URL); every other host is verified as usual. For local development against self-signed certificates only — never enable in production.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/formio-mcp.svg)](https://mcp.market/server/formio-mcp)

How the badge works