# Formmy (npm · @formmy.app/mcp-server)

Run WhatsApp AI agents: manage agents, conversations, CRM contacts, orders and RAG docs.

- Trust score: 60/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `@formmy.app/mcp-server`: 60/100 (this document), [markdown](https://verifymcp.io/servers/app-formmy-formmy/formmy-app-mcp-server.md), [page](https://verifymcp.io/servers/app-formmy-formmy/formmy-app-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@formmy.app/mcp-server`
- Version: `0.9.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 95 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 1 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 73/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2554 tokens (~111/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "chat_with_agent" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Formmy MCP server?

Formmy runs locally as an npm package, launched with npx -y @formmy.app/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add app-formmy-formmy -- npx -y @formmy.app/mcp-server
```

### Cursor

```json
{
  "mcpServers": {
    "app-formmy-formmy": {
      "command": "npx",
      "args": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "app-formmy-formmy": {
      "command": "npx",
      "args": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add app-formmy-formmy -- npx -y @formmy.app/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-formmy-formmy": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@formmy.app/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-formmy-formmy --command npx --arg -y --arg @formmy.app/mcp-server
```

### Hermes

```yaml
mcp_servers:
  app-formmy-formmy:
    command: "npx"
    args: ["-y", "@formmy.app/mcp-server"]
```

### Netclaw

```json
{
  "McpServers": {
    "app-formmy-formmy": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add app-formmy-formmy -t stdio -c npx -a -y @formmy.app/mcp-server
```

### Other

```json
{
  "mcpServers": {
    "app-formmy-formmy": {
      "command": "npx",
      "args": [
        "-y",
        "@formmy.app/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 60)

First indexed and scored.

## MCP tools (23)

### `list_agents` (~18 tokens)

List all Formmy agents for the authenticated user

### `get_agent` (~29 tokens)

Get details of a specific Formmy agent

Input parameters:

- `agentId` (string, required): Agent ID or slug

### `create_agent` (~88 tokens)

Create a new Formmy agent/chatbot

Input parameters:

- `instructions` (string): System prompt / instructions
- `model` (string): AI model (e.g. gpt-4o-mini, gpt-4.1-mini, claude-3-5-haiku-latest)
- `name` (string, required): Agent name
- `welcomeMessage` (string): Welcome message shown to users

### `update_agent` (~78 tokens)

Update an existing Formmy agent

Input parameters:

- `agentId` (string, required): Agent ID or slug
- `customInstructions` (string): Additional custom instructions
- `instructions` (string): New system prompt
- `model` (string): New AI model
- `name` (string): New name
- `welcomeMessage` (string): New welcome message

### `share_agent` (~72 tokens)

Share a Formmy agent with another user by email. Creates a permission so they can see and manage the agent.

Input parameters:

- `agentId` (string, required): Agent ID or slug
- `email` (string, required): Email of the user to share with
- `role` (string): Role to grant (default: VIEWER)

### `connect_integration` (~87 tokens)

Connect an external service (e.g. EasyBits DB) to a Formmy agent. The agent gets tools to interact with the service at chat time.

Input parameters:

- `agentId` (string, required): Agent ID or slug
- `config` (object, required): Integration config (e.g. { apiKey, dbId })
- `integration` (string, required): Integration name (e.g. 'easybits')

### `chat_with_agent` (~62 tokens)

Send a message to a Formmy agent and get the full response (non-streaming)

Input parameters:

- `agentId` (string, required): Agent ID or slug
- `message` (string, required): Message to send
- `sessionId` (string): Session ID for conversation continuity

### `add_document` (~59 tokens)

Add a RAG document/knowledge base entry to a Formmy agent

Input parameters:

- `agentId` (string, required): Agent ID or slug
- `content` (string, required): Document content (text, markdown, etc.)
- `title` (string, required): Document title

### `list_documents` (~31 tokens)

List all RAG documents for a Formmy agent

Input parameters:

- `agentId` (string, required): Agent ID or slug

### `get_document` (~29 tokens)

Get a specific RAG document with its full content

Input parameters:

- `documentId` (string, required): Document ID

### `search_documents` (~39 tokens)

Semantic search across an agent's RAG documents

Input parameters:

- `agentId` (string, required): Agent ID or slug
- `query` (string, required): Search query

### `update_document` (~47 tokens)

Update an existing RAG document's title or content

Input parameters:

- `content` (string): New content
- `documentId` (string, required): Document ID
- `title` (string): New title

### `delete_document` (~27 tokens)

Delete a RAG document from an agent

Input parameters:

- `documentId` (string, required): Document ID

### `list_conversations` (~29 tokens)

List conversations for a Formmy agent

Input parameters:

- `agentId` (string, required): Agent ID or slug

### `get_conversation` (~26 tokens)

Get a conversation with its messages

Input parameters:

- `conversationId` (string, required): Conversation ID

### `list_conversation_estados` (~107 tokens)

List the valid CRM pipeline stages (kanban columns) configured for this agent. ALWAYS call this before set_order_status so you move orders within the defined set instead of inventing new labels. Returns an array of { label, color }. Pick the closest matching stage and reuse its exact label. In a WhatsApp conversation you do NOT need agentId — the stages are derived from the current chat.

Input parameters:

- `agentId` (string): Agent ID or slug — optional in WhatsApp.

### `list_orders` (~172 tokens)

List the ORDERS (pedidos/cotizaciones) of THIS conversation, newest first. Call it when the customer has more than one open quote and you need to act on a specific one instead of the latest: it returns each order's `id`, which you pass as `ordenId` to set_order_status or update_order. Also the way to check an order's current stage or lifecycle, since the board itself is not readable. Scoped to the current customer — it never lists other people's orders. In a WhatsApp conversation you do NOT need conversationId.

Input parameters:

- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `limit` (number): Max orders to return (default 20, max 100).
- `status` (string): Filter by lifecycle. Omit to get all.

### `set_order_status` (~244 tokens)

Move an ORDER (pedido) of a conversation to a pipeline stage (kanban column). The board groups orders by their stage (`estatus`). Use it whenever the deal changes column, in EITHER direction: quote sent → 'Cotización enviada', paid by transfer → 'Pago con transferencia', delivered → 'Cerrado', and also when the customer backs out → 'Cancelado'. Call list_conversation_estados first and reuse the exact label. To register a NEW order use create_order (which also sets its stage); when an order is cancelled or delivered, also close its lifecycle with update_order `status`. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically from the current chat.

Input parameters:

- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `estatus` (string, required): Pipeline stage label; match one from list_conversation_estados, e.g. 'Pago con transferencia'
- `ordenId` (string): Which order to move. Omit for the most recent one (the usual case). Pass an `id` from list_orders when the customer has several open quotes and you must move an older one.

### `set_contact` (~246 tokens)

Save the person's fiscal / shipping data on their conversation so the operator sees it in the contact panel: `email`, `rfc` (Mexican tax ID), `razonSocial` (legal business name for invoicing), and a `direccion` (shipping address). Use when the customer gives you any of these — e.g. to bill (facturar) you need rfc + razonSocial, to ship you need direccion. Partial merge: send only the fields you just learned; omitted fields are left untouched. Each `direccion` you send is ADDED to their saved addresses (pass a stable `id` to update an existing one instead of adding a duplicate). In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.

Input parameters:

- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `direccion` (object): A shipping address to add/update in the person's saved addresses
- `email` (string): Customer email
- `razonSocial` (string): Legal business name for invoicing (razón social)
- `rfc` (string): Mexican tax ID (RFC), e.g. 'XAXX010101000'

### `add_conversation_tag` (~183 tokens)

Add a CRM tag to a conversation. Use to mark categorical attributes the operator should see at a glance: 'VIP', 'lead', 'urgente', 'cotización', etc. label is free-form; color is hex. Optional comment is internal note (not shown to the client). In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.

Input parameters:

- `color` (string, required): Hex color, e.g. '#A855F7' (purple/VIP), '#10B981' (green/lead), '#EF4444' (red/urgente)
- `comment` (string): Optional internal note about why this tag was applied
- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `label` (string, required): Tag label, e.g. 'VIP', 'lead', 'urgente'

### `remove_conversation_tag` (~73 tokens)

Remove a CRM tag from a conversation by its label. Case-insensitive match. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically.

Input parameters:

- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `tagLabel` (string, required): Label of the tag to remove

### `update_order` (~357 tokens)

Update an order of this conversation IN PLACE (the most recent one unless you pass `ordenId`) — use it when something about an ALREADY REGISTERED order changes: the customer adds/removes a product, the total changes, the delivery address changes, or you finally got their phone. It is also how you close an order's lifecycle with `status` (CERRADA when delivered/paid, ARCHIVADA when cancelled) so it stops counting as open on the board. Send ONLY the fields that changed (partial patch; omitted fields are left untouched). If you send `productos` without `total`, the total is recomputed from the line subtotals. Do NOT use create_order for a change — that would duplicate the card on the board. To move the order between pipeline stages use set_order_status instead.

Input parameters:

- `cliente` (string): Customer name
- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `cotizacionUrl` (string): URL of the updated quote PDF
- `direccionEntrega` (object): New delivery address snapshot
- `folio` (string): Order folio
- `notas` (string): Replace the order comment
- `ordenId` (string): Which order to update. Omit for the most recent one. Pass an `id` from list_orders when the customer has several.
- `productos` (array): Full replacement of the quoted line items
- `status` (string): Order lifecycle. CERRADA = delivered/settled. ARCHIVADA = cancelled or dropped. Separate from `estatus` (the board column).
- `tel` (string): Contact phone
- `total` (number): New total, e.g. 1450

### `create_order` (~451 tokens)

Record an order (cotización/pedido) for a conversation in Formmy. THIS IS THE CRM OF RECORD: every quote you send must be registered here, it is not optional. PRIORITY FIELDS you should almost always fill: `notas` (a summary of the order) and `cotizacionUrl` (the quote PDF on EasyBits). It shows in the contact panel's Órdenes accordion, moves the kanban card when `estatus` matches a CRM estado (call list_conversation_estados first), and bumps the conversation to the top. Use when an order/quote is confirmed or its status changes; only the most recent order drives the card and the board value. In a WhatsApp conversation you do NOT need conversationId — it is detected automatically from the current chat.

Input parameters:

- `cliente` (string): Customer name
- `conversationId` (string): Optional — auto-detected in WhatsApp.
- `cotizacionUrl` (string): PRIORITY. URL to the quote PDF hosted on EasyBits — the same link you sent to the customer.
- `direccionEntrega` (object): Delivery address snapshot { label, direccion, cp, ciudad, mapsUrl }
- `estatus` (string): Free-form status; match a CRM estado label (list_conversation_estados) so the card moves to that column, e.g. 'Pago a contra entrega'
- `folio` (string): Order folio/number, e.g. '260521-007'
- `notas` (string): PRIORITY. The comment for this order: products, shipping and anything the operator needs. Fill this whenever there is any context worth recording.
- `productos` (array): Secondary. Quoted line items: [{ nombre, sku, cantidad, precioUnitario, subtotal, imagen }]. Their subtotals should sum to `total`.
- `status` (string): Order lifecycle (default ABIERTA). Use CERRADA when delivered/closed.
- `tel` (string): Contact phone
- `total` (number): Order total / budget as a number, e.g. 783. If omitted and `productos` is given, it is derived from the line subtotals.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/app-formmy-formmy/formmy-app-mcp-server#diagnostics

## Score history

- 2026-09-21: 60
- 2026-09-20: 60
- 2026-09-19: 60

## Common questions

### What is the Formmy MCP server?

Formmy is an MCP server listed in the public MCP registry as app.formmy/formmy. Run WhatsApp AI agents: manage agents, conversations, CRM contacts, orders and RAG docs. This page covers its npm package (@formmy.app/mcp-server).

### Is the Formmy MCP server safe to use?

Formmy scores 60 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Formmy MCP server expose?

Formmy exposes 23 tools: list_agents, get_agent, create_agent, update_agent, share_agent, and 18 more. Their descriptions and schemas cost roughly 2,554 tokens of context every time the server is loaded.

### Is the Formmy MCP server still maintained?

Formmy is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- npm package: https://www.npmjs.com/package/@formmy.app/mcp-server
- Socket report: https://socket.dev/npm/package/@formmy.app/mcp-server
- Website: https://formmy.app/
- Changelog RSS feed: https://verifymcp.io/servers/app-formmy-formmy/formmy-app-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-formmy-formmy/formmy-app-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/app-formmy-formmy/formmy-app-mcp-server