Formmy
NPM · @FORMMY.APP/MCP-SERVER · SCANNED SEP 20
Run WhatsApp AI agents: manage agents, conversations, CRM contacts, orders and RAG docs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency6
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability73
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2554 tokens (~111/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "chat_with_agent" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the Formmy MCP server?
Formmy runs locally as an npm package, launched with npx -y @formmy.app/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @formmy.app/mcp-server
claude mcp add app-formmy-formmy -- npx -y @formmy.app/mcp-server
{
"mcpServers": {
"app-formmy-formmy": {
"command": "npx",
"args": [
"-y",
"@formmy.app/mcp-server"
]
}
}
} {
"servers": {
"app-formmy-formmy": {
"command": "npx",
"args": [
"-y",
"@formmy.app/mcp-server"
]
}
}
} codex mcp add app-formmy-formmy -- npx -y @formmy.app/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"app-formmy-formmy": {
"type": "local",
"command": [
"npx",
"-y",
"@formmy.app/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add app-formmy-formmy --command npx --arg -y --arg @formmy.app/mcp-server
mcp_servers:
app-formmy-formmy:
command: "npx"
args: ["-y", "@formmy.app/mcp-server"] {
"McpServers": {
"app-formmy-formmy": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@formmy.app/mcp-server"
]
}
}
} assistant mcp add app-formmy-formmy -t stdio -c npx -a -y @formmy.app/mcp-server
{
"mcpServers": {
"app-formmy-formmy": {
"command": "npx",
"args": [
"-y",
"@formmy.app/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@formmy.app/mcp-server@0.9.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_conversation_tag ~183
Add a CRM tag to a conversation. Use to mark categorical attributes the operator should see at a glance: 'VIP', 'lead', 'urgente', 'cotización', etc. label is free-form; color is hex. Optional comment is internal note (not shown to the client). In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | yes | Hex color, e.g. '#A855F7' (purple/VIP), '#10B981' (green/lead), '#EF4444' (red/urgente) |
| comment | string | – | Optional internal note about why this tag was applied |
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| label | string | yes | Tag label, e.g. 'VIP', 'lead', 'urgente' |
No output schema declared.
No examples provided.
add_document ~59
Add a RAG document/knowledge base entry to a Formmy agent
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
| content | string | yes | Document content (text, markdown, etc.) |
| title | string | yes | Document title |
No output schema declared.
No examples provided.
chat_with_agent ~62
Send a message to a Formmy agent and get the full response (non-streaming)
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
| message | string | yes | Message to send |
| sessionId | string | – | Session ID for conversation continuity |
No output schema declared.
No examples provided.
connect_integration ~87
Connect an external service (e.g. EasyBits DB) to a Formmy agent. The agent gets tools to interact with the service at chat time.
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
| config | object | yes | Integration config (e.g. { apiKey, dbId }) |
| integration | string | yes | Integration name (e.g. 'easybits') |
No output schema declared.
No examples provided.
create_agent ~88
Create a new Formmy agent/chatbot
| Name | Type | Req | Description |
|---|---|---|---|
| instructions | string | – | System prompt / instructions |
| model | string | – | AI model (e.g. gpt-4o-mini, gpt-4.1-mini, claude-3-5-haiku-latest) |
| name | string | yes | Agent name |
| welcomeMessage | string | – | Welcome message shown to users |
No output schema declared.
No examples provided.
create_order ~451
Record an order (cotización/pedido) for a conversation in Formmy. THIS IS THE CRM OF RECORD: every quote you send must be registered here, it is not optional. PRIORITY FIELDS you should almost always fill: `notas` (a summary of the order) and `cotizacionUrl` (the quote PDF on EasyBits). It shows in the contact panel's Órdenes accordion, moves the kanban card when `estatus` matches a CRM estado (call list_conversation_estados first), and bumps the conversation to the top. Use when an order/quote is confirmed or its status changes; only the most recent order drives the card and the board value. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically from the current chat.
| Name | Type | Req | Description |
|---|---|---|---|
| cliente | string | – | Customer name |
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| cotizacionUrl | string | – | PRIORITY. URL to the quote PDF hosted on EasyBits — the same link you sent to the customer. |
| direccionEntrega | object | – | Delivery address snapshot { label, direccion, cp, ciudad, mapsUrl } |
| estatus | string | – | Free-form status; match a CRM estado label (list_conversation_estados) so the card moves to that column, e.g. 'Pago a contra entrega' |
| folio | string | – | Order folio/number, e.g. '260521-007' |
| notas | string | – | PRIORITY. The comment for this order: products, shipping and anything the operator needs. Fill this whenever there is any context worth recording. |
| productos | array | – | Secondary. Quoted line items: [{ nombre, sku, cantidad, precioUnitario, subtotal, imagen }]. Their subtotals should sum to `total`. |
| status | string | – | Order lifecycle (default ABIERTA). Use CERRADA when delivered/closed. |
| tel | string | – | Contact phone |
| total | number | – | Order total / budget as a number, e.g. 783. If omitted and `productos` is given, it is derived from the line subtotals. |
No output schema declared.
No examples provided.
delete_document ~27
Delete a RAG document from an agent
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | Document ID |
No output schema declared.
No examples provided.
get_agent ~29
Get details of a specific Formmy agent
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
No output schema declared.
No examples provided.
get_conversation ~26
Get a conversation with its messages
| Name | Type | Req | Description |
|---|---|---|---|
| conversationId | string | yes | Conversation ID |
No output schema declared.
No examples provided.
get_document ~29
Get a specific RAG document with its full content
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | Document ID |
No output schema declared.
No examples provided.
list_agents ~18
List all Formmy agents for the authenticated user
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_conversation_estados ~107
List the valid CRM pipeline stages (kanban columns) configured for this agent. ALWAYS call this before set_order_status so you move orders within the defined set instead of inventing new labels. Returns an array of { label, color }. Pick the closest matching stage and reuse its exact label. In a WhatsApp conversation you do NOT need agentId — the stages are derived from the current chat.
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | – | Agent ID or slug — optional in WhatsApp. |
No output schema declared.
No examples provided.
list_conversations ~29
List conversations for a Formmy agent
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
No output schema declared.
No examples provided.
list_documents ~31
List all RAG documents for a Formmy agent
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
No output schema declared.
No examples provided.
list_orders ~172
List the ORDERS (pedidos/cotizaciones) of THIS conversation, newest first. Call it when the customer has more than one open quote and you need to act on a specific one instead of the latest: it returns each order's `id`, which you pass as `ordenId` to set_order_status or update_order. Also the way to check an order's current stage or lifecycle, since the board itself is not readable. Scoped to the current customer — it never lists other people's orders. In a WhatsApp conversation you do NOT need conversationId.
| Name | Type | Req | Description |
|---|---|---|---|
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| limit | number | – | Max orders to return (default 20, max 100). |
| status | string | – | Filter by lifecycle. Omit to get all. |
No output schema declared.
No examples provided.
remove_conversation_tag ~73
Remove a CRM tag from a conversation by its label. Case-insensitive match. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| tagLabel | string | yes | Label of the tag to remove |
No output schema declared.
No examples provided.
search_documents ~39
Semantic search across an agent's RAG documents
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
| query | string | yes | Search query |
No output schema declared.
No examples provided.
set_contact ~246
Save the person's fiscal / shipping data on their conversation so the operator sees it in the contact panel: `email`, `rfc` (Mexican tax ID), `razonSocial` (legal business name for invoicing), and a `direccion` (shipping address). Use when the customer gives you any of these — e.g. to bill (facturar) you need rfc + razonSocial, to ship you need direccion. Partial merge: send only the fields you just learned; omitted fields are left untouched. Each `direccion` you send is ADDED to their saved addresses (pass a stable `id` to update an existing one instead of adding a duplicate). In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| direccion | object | – | A shipping address to add/update in the person's saved addresses |
| string | – | Customer email | |
| razonSocial | string | – | Legal business name for invoicing (razón social) |
| rfc | string | – | Mexican tax ID (RFC), e.g. 'XAXX010101000' |
No output schema declared.
No examples provided.
set_order_status ~244
Move an ORDER (pedido) of a conversation to a pipeline stage (kanban column). The board groups orders by their stage (`estatus`). Use it whenever the deal changes column, in EITHER direction: quote sent → 'Cotización enviada', paid by transfer → 'Pago con transferencia', delivered → 'Cerrado', and also when the customer backs out → 'Cancelado'. Call list_conversation_estados first and reuse the exact label. To register a NEW order use create_order (which also sets its stage); when an order is cancelled or delivered, also close its lifecycle with update_order `status`. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically from the current chat.
| Name | Type | Req | Description |
|---|---|---|---|
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| estatus | string | yes | Pipeline stage label; match one from list_conversation_estados, e.g. 'Pago con transferencia' |
| ordenId | string | – | Which order to move. Omit for the most recent one (the usual case). Pass an `id` from list_orders when the customer has several open quotes and you must move an older one. |
No output schema declared.
No examples provided.
share_agent ~72
Share a Formmy agent with another user by email. Creates a permission so they can see and manage the agent.
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
| string | yes | Email of the user to share with | |
| role | string | – | Role to grant (default: VIEWER) |
No output schema declared.
No examples provided.
update_agent ~78
Update an existing Formmy agent
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | Agent ID or slug |
| customInstructions | string | – | Additional custom instructions |
| instructions | string | – | New system prompt |
| model | string | – | New AI model |
| name | string | – | New name |
| welcomeMessage | string | – | New welcome message |
No output schema declared.
No examples provided.
update_document ~47
Update an existing RAG document's title or content
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | New content |
| documentId | string | yes | Document ID |
| title | string | – | New title |
No output schema declared.
No examples provided.
update_order ~357
Update an order of this conversation IN PLACE (the most recent one unless you pass `ordenId`) — use it when something about an ALREADY REGISTERED order changes: the customer adds/removes a product, the total changes, the delivery address changes, or you finally got their phone. It is also how you close an order's lifecycle with `status` (CERRADA when delivered/paid, ARCHIVADA when cancelled) so it stops counting as open on the board. Send ONLY the fields that changed (partial patch; omitted fields are left untouched). If you send `productos` without `total`, the total is recomputed from the line subtotals. Do NOT use create_order for a change — that would duplicate the card on the board. To move the order between pipeline stages use set_order_status instead.
| Name | Type | Req | Description |
|---|---|---|---|
| cliente | string | – | Customer name |
| conversationId | string | – | Optional — auto-detected in WhatsApp. |
| cotizacionUrl | string | – | URL of the updated quote PDF |
| direccionEntrega | object | – | New delivery address snapshot |
| folio | string | – | Order folio |
| notas | string | – | Replace the order comment |
| ordenId | string | – | Which order to update. Omit for the most recent one. Pass an `id` from list_orders when the customer has several. |
| productos | array | – | Full replacement of the quoted line items |
| status | string | – | Order lifecycle. CERRADA = delivered/settled. ARCHIVADA = cancelled or dropped. Separate from `estatus` (the board column). |
| tel | string | – | Contact phone |
| total | number | – | New total, e.g. 1450 |
No output schema declared.
No examples provided.
What is the Formmy MCP server?
Formmy is an MCP server listed in the public MCP registry as app.formmy/formmy. Run WhatsApp AI agents: manage agents, conversations, CRM contacts, orders and RAG docs. This page covers its npm package (@formmy.app/mcp-server).
Is the Formmy MCP server safe to use?
Formmy scores 60 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Formmy MCP server expose?
Formmy exposes 23 tools: list_agents, get_agent, create_agent, update_agent, share_agent, and 18 more. Their descriptions and schemas cost roughly 2,554 tokens of context every time the server is loaded.
Is the Formmy MCP server still maintained?
Formmy is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.