Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Formmy

NPM · @FORMMY.APP/MCP-SERVER · SCANNED SEP 20

Run WhatsApp AI agents: manage agents, conversations, CRM contacts, orders and RAG docs.

60 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency6
Schema Quality & AI Usability73
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2554 tokens (~111/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "chat_with_agent" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the Formmy MCP server?

Formmy runs locally as an npm package, launched with npx -y @formmy.app/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @formmy.app/mcp-server

# add to Claude Code
claude mcp add app-formmy-formmy -- npx -y @formmy.app/mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "app-formmy-formmy": {
      "command": "npx",
      "args": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "app-formmy-formmy": {
      "command": "npx",
      "args": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add app-formmy-formmy -- npx -y @formmy.app/mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-formmy-formmy": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@formmy.app/mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add app-formmy-formmy --command npx --arg -y --arg @formmy.app/mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  app-formmy-formmy:
    command: "npx"
    args: ["-y", "@formmy.app/mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "app-formmy-formmy": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add app-formmy-formmy -t stdio -c npx -a -y @formmy.app/mcp-server
// mcp.json
{
  "mcpServers": {
    "app-formmy-formmy": {
      "command": "npx",
      "args": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 60

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@formmy.app/mcp-server@0.9.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 95 packages
Packages resolved 95
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 23 exposed · ~2,554 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_conversation_tag ~183

Add a CRM tag to a conversation. Use to mark categorical attributes the operator should see at a glance: 'VIP', 'lead', 'urgente', 'cotización', etc. label is free-form; color is hex. Optional comment is internal note (not shown to the client). In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.

NameTypeReqDescription
colorstringyesHex color, e.g. '#A855F7' (purple/VIP), '#10B981' (green/lead), '#EF4444' (red/urgente)
commentstringOptional internal note about why this tag was applied
conversationIdstringOptional — auto-detected in WhatsApp.
labelstringyesTag label, e.g. 'VIP', 'lead', 'urgente'

No output schema declared.

No examples provided.

add_document ~59

Add a RAG document/knowledge base entry to a Formmy agent

NameTypeReqDescription
agentIdstringyesAgent ID or slug
contentstringyesDocument content (text, markdown, etc.)
titlestringyesDocument title

No output schema declared.

No examples provided.

chat_with_agent ~62

Send a message to a Formmy agent and get the full response (non-streaming)

NameTypeReqDescription
agentIdstringyesAgent ID or slug
messagestringyesMessage to send
sessionIdstringSession ID for conversation continuity

No output schema declared.

No examples provided.

connect_integration ~87

Connect an external service (e.g. EasyBits DB) to a Formmy agent. The agent gets tools to interact with the service at chat time.

NameTypeReqDescription
agentIdstringyesAgent ID or slug
configobjectyesIntegration config (e.g. { apiKey, dbId })
integrationstringyesIntegration name (e.g. 'easybits')

No output schema declared.

No examples provided.

create_agent ~88

Create a new Formmy agent/chatbot

NameTypeReqDescription
instructionsstringSystem prompt / instructions
modelstringAI model (e.g. gpt-4o-mini, gpt-4.1-mini, claude-3-5-haiku-latest)
namestringyesAgent name
welcomeMessagestringWelcome message shown to users

No output schema declared.

No examples provided.

create_order ~451

Record an order (cotización/pedido) for a conversation in Formmy. THIS IS THE CRM OF RECORD: every quote you send must be registered here, it is not optional. PRIORITY FIELDS you should almost always fill: `notas` (a summary of the order) and `cotizacionUrl` (the quote PDF on EasyBits). It shows in the contact panel's Órdenes accordion, moves the kanban card when `estatus` matches a CRM estado (call list_conversation_estados first), and bumps the conversation to the top. Use when an order/quote is confirmed or its status changes; only the most recent order drives the card and the board value. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically from the current chat.

NameTypeReqDescription
clientestringCustomer name
conversationIdstringOptional — auto-detected in WhatsApp.
cotizacionUrlstringPRIORITY. URL to the quote PDF hosted on EasyBits — the same link you sent to the customer.
direccionEntregaobjectDelivery address snapshot { label, direccion, cp, ciudad, mapsUrl }
estatusstringFree-form status; match a CRM estado label (list_conversation_estados) so the card moves to that column, e.g. 'Pago a contra entrega'
foliostringOrder folio/number, e.g. '260521-007'
notasstringPRIORITY. The comment for this order: products, shipping and anything the operator needs. Fill this whenever there is any context worth recording.
productosarraySecondary. Quoted line items: [{ nombre, sku, cantidad, precioUnitario, subtotal, imagen }]. Their subtotals should sum to `total`.
statusstringOrder lifecycle (default ABIERTA). Use CERRADA when delivered/closed.
telstringContact phone
totalnumberOrder total / budget as a number, e.g. 783. If omitted and `productos` is given, it is derived from the line subtotals.

No output schema declared.

No examples provided.

delete_document ~27

Delete a RAG document from an agent

NameTypeReqDescription
documentIdstringyesDocument ID

No output schema declared.

No examples provided.

get_agent ~29

Get details of a specific Formmy agent

NameTypeReqDescription
agentIdstringyesAgent ID or slug

No output schema declared.

No examples provided.

get_conversation ~26

Get a conversation with its messages

NameTypeReqDescription
conversationIdstringyesConversation ID

No output schema declared.

No examples provided.

get_document ~29

Get a specific RAG document with its full content

NameTypeReqDescription
documentIdstringyesDocument ID

No output schema declared.

No examples provided.

list_agents ~18

List all Formmy agents for the authenticated user

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_conversation_estados ~107

List the valid CRM pipeline stages (kanban columns) configured for this agent. ALWAYS call this before set_order_status so you move orders within the defined set instead of inventing new labels. Returns an array of { label, color }. Pick the closest matching stage and reuse its exact label. In a WhatsApp conversation you do NOT need agentId — the stages are derived from the current chat.

NameTypeReqDescription
agentIdstringAgent ID or slug — optional in WhatsApp.

No output schema declared.

No examples provided.

list_conversations ~29

List conversations for a Formmy agent

NameTypeReqDescription
agentIdstringyesAgent ID or slug

No output schema declared.

No examples provided.

list_documents ~31

List all RAG documents for a Formmy agent

NameTypeReqDescription
agentIdstringyesAgent ID or slug

No output schema declared.

No examples provided.

list_orders ~172

List the ORDERS (pedidos/cotizaciones) of THIS conversation, newest first. Call it when the customer has more than one open quote and you need to act on a specific one instead of the latest: it returns each order's `id`, which you pass as `ordenId` to set_order_status or update_order. Also the way to check an order's current stage or lifecycle, since the board itself is not readable. Scoped to the current customer — it never lists other people's orders. In a WhatsApp conversation you do NOT need conversationId.

NameTypeReqDescription
conversationIdstringOptional — auto-detected in WhatsApp.
limitnumberMax orders to return (default 20, max 100).
statusstringFilter by lifecycle. Omit to get all.

No output schema declared.

No examples provided.

remove_conversation_tag ~73

Remove a CRM tag from a conversation by its label. Case-insensitive match. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.

NameTypeReqDescription
conversationIdstringOptional — auto-detected in WhatsApp.
tagLabelstringyesLabel of the tag to remove

No output schema declared.

No examples provided.

search_documents ~39

Semantic search across an agent's RAG documents

NameTypeReqDescription
agentIdstringyesAgent ID or slug
querystringyesSearch query

No output schema declared.

No examples provided.

set_contact ~246

Save the person's fiscal / shipping data on their conversation so the operator sees it in the contact panel: `email`, `rfc` (Mexican tax ID), `razonSocial` (legal business name for invoicing), and a `direccion` (shipping address). Use when the customer gives you any of these — e.g. to bill (facturar) you need rfc + razonSocial, to ship you need direccion. Partial merge: send only the fields you just learned; omitted fields are left untouched. Each `direccion` you send is ADDED to their saved addresses (pass a stable `id` to update an existing one instead of adding a duplicate). In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.

NameTypeReqDescription
conversationIdstringOptional — auto-detected in WhatsApp.
direccionobjectA shipping address to add/update in the person's saved addresses
emailstringCustomer email
razonSocialstringLegal business name for invoicing (razón social)
rfcstringMexican tax ID (RFC), e.g. 'XAXX010101000'

No output schema declared.

No examples provided.

set_order_status ~244

Move an ORDER (pedido) of a conversation to a pipeline stage (kanban column). The board groups orders by their stage (`estatus`). Use it whenever the deal changes column, in EITHER direction: quote sent → 'Cotización enviada', paid by transfer → 'Pago con transferencia', delivered → 'Cerrado', and also when the customer backs out → 'Cancelado'. Call list_conversation_estados first and reuse the exact label. To register a NEW order use create_order (which also sets its stage); when an order is cancelled or delivered, also close its lifecycle with update_order `status`. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically from the current chat.

NameTypeReqDescription
conversationIdstringOptional — auto-detected in WhatsApp.
estatusstringyesPipeline stage label; match one from list_conversation_estados, e.g. 'Pago con transferencia'
ordenIdstringWhich order to move. Omit for the most recent one (the usual case). Pass an `id` from list_orders when the customer has several open quotes and you must move an older one.

No output schema declared.

No examples provided.

share_agent ~72

Share a Formmy agent with another user by email. Creates a permission so they can see and manage the agent.

NameTypeReqDescription
agentIdstringyesAgent ID or slug
emailstringyesEmail of the user to share with
rolestringRole to grant (default: VIEWER)

No output schema declared.

No examples provided.

update_agent ~78

Update an existing Formmy agent

NameTypeReqDescription
agentIdstringyesAgent ID or slug
customInstructionsstringAdditional custom instructions
instructionsstringNew system prompt
modelstringNew AI model
namestringNew name
welcomeMessagestringNew welcome message

No output schema declared.

No examples provided.

update_document ~47

Update an existing RAG document's title or content

NameTypeReqDescription
contentstringNew content
documentIdstringyesDocument ID
titlestringNew title

No output schema declared.

No examples provided.

update_order ~357

Update an order of this conversation IN PLACE (the most recent one unless you pass `ordenId`) — use it when something about an ALREADY REGISTERED order changes: the customer adds/removes a product, the total changes, the delivery address changes, or you finally got their phone. It is also how you close an order's lifecycle with `status` (CERRADA when delivered/paid, ARCHIVADA when cancelled) so it stops counting as open on the board. Send ONLY the fields that changed (partial patch; omitted fields are left untouched). If you send `productos` without `total`, the total is recomputed from the line subtotals. Do NOT use create_order for a change — that would duplicate the card on the board. To move the order between pipeline stages use set_order_status instead.

NameTypeReqDescription
clientestringCustomer name
conversationIdstringOptional — auto-detected in WhatsApp.
cotizacionUrlstringURL of the updated quote PDF
direccionEntregaobjectNew delivery address snapshot
foliostringOrder folio
notasstringReplace the order comment
ordenIdstringWhich order to update. Omit for the most recent one. Pass an `id` from list_orders when the customer has several.
productosarrayFull replacement of the quoted line items
statusstringOrder lifecycle. CERRADA = delivered/settled. ARCHIVADA = cancelled or dropped. Separate from `estatus` (the board column).
telstringContact phone
totalnumberNew total, e.g. 1450

No output schema declared.

No examples provided.

Common questions

What is the Formmy MCP server?

Formmy is an MCP server listed in the public MCP registry as app.formmy/formmy. Run WhatsApp AI agents: manage agents, conversations, CRM contacts, orders and RAG docs. This page covers its npm package (@formmy.app/mcp-server).

Is the Formmy MCP server safe to use?

Formmy scores 60 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Formmy MCP server expose?

Formmy exposes 23 tools: list_agents, get_agent, create_agent, update_agent, share_agent, and 18 more. Their descriptions and schemas cost roughly 2,554 tokens of context every time the server is loaded.

Is the Formmy MCP server still maintained?

Formmy is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.