Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.form/formio-mcp

NPM · @FORMIO/MCP · SCANNED SEP 20

Create and manage Form.io forms, resources, actions, roles, and projects from your AI agent.

Available components

+3 this week 93 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 39 of 122 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to formio/ai). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 10 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability62
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 6794 tokens (~323/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.form/formio-mcp server?

io.form/formio-mcp runs locally as an npm package, launched with npx -y @formio/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @formio/mcp

# add to Claude Code
claude mcp add io-form-formio-mcp -- npx -y @formio/mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "io-form-formio-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@formio/mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "io-form-formio-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@formio/mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add io-form-formio-mcp -- npx -y @formio/mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-form-formio-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@formio/mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add io-form-formio-mcp --command npx --arg -y --arg @formio/mcp
# ~/.hermes/config.yaml
mcp_servers:
  io-form-formio-mcp:
    command: "npx"
    args: ["-y", "@formio/mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "io-form-formio-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@formio/mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add io-form-formio-mcp -t stdio -c npx -a -y @formio/mcp
// mcp.json
{
  "mcpServers": {
    "io-form-formio-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@formio/mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1
    • Stability: 0.97 → pass security
    • Security disclosure: unverified → pass functional
  • 19 Sept 26 0
    • Security disclosure: pass → unverified functional
  • 18 Sept 26 −1
    • Stability: pass → 0.93 functional
  • 16 Sept 26 +1
    • Stability: 0.97 → pass security
  • 15 Sept 26 +2
    • CVE-2026-82562 no longer affects this package security
    • CVE-2026-82417 no longer affects this package security
    • Known CVEs: fail → pass security
  • 13 Sept 26 −1
    • Stability: pass → 0.90 functional
  • 12 Sept 26 0
    • Stability: 0.97 → pass security
  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@formio/mcp@0.13.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo formio/ai
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/formio/ai/.github/workflows/release.yml@refs/heads/main
Rekor log index 2769036383
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:96dab81e170f20de89c633035a710dc243d21b7183d44cea62a95f4361562a923c43ab84c30f6b9c4c7b1b3a0ccb843e0d31a37e720b3ebc71fd3da1a

Background: How many MCP packages publish verified provenance →

Dependencies 122 packages
Packages resolved 122
Stale 39
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 21 exposed · ~5,705 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
action_create ~193

Create a new action on a form. Call action_type_get first to discover the required settings schema for the action type.

NameTypeReqDescription
actionobjectyesAction definition
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID to attach the action to
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
conditionobjectCondition gating whether the action runs
createdstringISO 8601 creation timestamp
formstringID of the form the action runs on
handlerarrayWhen the action runs relative to submission handling: "before" and/or "after"
machineNamestringMachine-readable unique name within the project
methodarraySubmission methods the action responds to, e.g. "create", "update"
modifiedstringISO 8601 last-modified timestamp
namestringAction type name, e.g. "save", "login", "email"
prioritynumberExecution order; higher runs first
settingsobjectAction-type-specific settings; see action_type_get for the schema
titlestringHuman-readable action title

No examples provided.

action_delete ~204

Delete an action from a form. The action stops running on submissions immediately and is not recoverable — call action_get first if the settings may be needed again.

NameTypeReqDescription
actionIdstringyesThe action ID to delete
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID the action belongs to
NameTypeReqDescription
messagestringyesHuman-readable result detail
okbooleanyesTrue when the operation completed

No examples provided.

action_get ~205

Get a single action by ID from a form, including its handler, method, condition, and type-specific settings. Call action_list first to find the action ID.

NameTypeReqDescription
actionIdstringyesThe action ID to retrieve
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID the action belongs to
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
conditionobjectCondition gating whether the action runs
createdstringISO 8601 creation timestamp
formstringID of the form the action runs on
handlerarrayWhen the action runs relative to submission handling: "before" and/or "after"
machineNamestringMachine-readable unique name within the project
methodarraySubmission methods the action responds to, e.g. "create", "update"
modifiedstringISO 8601 last-modified timestamp
namestringAction type name, e.g. "save", "login", "email"
prioritynumberExecution order; higher runs first
settingsobjectAction-type-specific settings; see action_type_get for the schema
titlestringHuman-readable action title

No examples provided.

action_list ~193

List the actions configured on a form — the server-side handlers that run when a submission is saved, such as save-to-resource, email, login, and role assignment.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID to list actions for
NameTypeReqDescription
actionsarrayyesActions configured on the form
countnumberyesNumber of actions returned

No examples provided.

action_type_get ~210

Get action type info and settings form schema. Call this before action_create to discover the required settings for the action type.

NameTypeReqDescription
actionNamestringyesThe action type name (e.g. "email", "save", "login")
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID to get the action type for
NameTypeReqDescription
accessobjectAccess requirements for configuring the action
defaultsobjectDefault settings applied on creation
descriptionstringWhat the action type does
namestringAction type name to pass as `name` to action_create
prioritynumberDefault execution priority
settingsFormobjectForm definition describing the settings this action type accepts; its components are the keys valid in `settings` on action_create
titlestringHuman-readable action type title

No examples provided.

action_types_list ~180

List available action types for a form. Returns the catalog of action types the server supports.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID to list available action types for
NameTypeReqDescription
actionTypesarrayyesAction types this deployment supports for the form
countnumberyesNumber of action types returned

No examples provided.

action_update ~220

Update an existing action on a form. This is a full replacement of the action document — include every field you want to keep, and call action_get first if you do not already have it.

NameTypeReqDescription
actionobjectyesAction definition
actionIdstringyesThe action ID to update
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdstringyesThe form ID the action belongs to
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
conditionobjectCondition gating whether the action runs
createdstringISO 8601 creation timestamp
formstringID of the form the action runs on
handlerarrayWhen the action runs relative to submission handling: "before" and/or "after"
machineNamestringMachine-readable unique name within the project
methodarraySubmission methods the action responds to, e.g. "create", "update"
modifiedstringISO 8601 last-modified timestamp
namestringAction type name, e.g. "save", "login", "email"
prioritynumberExecution order; higher runs first
settingsobjectAction-type-specific settings; see action_type_get for the schema
titlestringHuman-readable action title

No examples provided.

form_create ~297

Create a new form in the Form.io project mapped to the user's current working directory. IMPORTANT: Before calling this tool, use the formio-schema skill to construct a properly structured Form.io form JSON definition based on the user's requirements. The skill documents all component types, validation options, layout patterns, and conditional logic available in Form.io. New forms default to `revisions: 'original'` so form change history is preserved. NOT for: creating a draft revision of an existing form. When the user says "create/save a draft", "draft <change>", call form_update with `formId` and `draft: true` instead.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formobjectyesForm.io form JSON definition
notestringNote describing the initial revision
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
accessarrayRole-based access to the form definition itself
componentsarrayComponent tree defining the fields, layout, and logic of the form
createdstringISO 8601 creation timestamp
displaystringRender style: "form" or "wizard"
machineNamestringMachine-readable unique name within the project
modifiedstringISO 8601 last-modified timestamp
namestringAPI name of the form
ownerstring|nullID of the submission owner, when set
pathstringURL path the form is served at, relative to the project
projectstringID of the project owning the form
propertiesobjectCustom key/value properties
revisionsstring|booleanRevision mode: "original", "current", or false when disabled
settingsobjectForm-level settings
submissionAccessarrayRole-based access to the submissions of this form
tagsarrayTags applied to the form
titlestringHuman-readable form title
typestring"form" for a form, "resource" for a data resource

No examples provided.

form_get ~255

Fetch a single form definition from the Form.io project mapped to the user's current working directory, by form ID or path. Pass `draft: true` to fetch the form's current in-flight draft instead of the published form.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
draftbooleanWhen true, fetch the form's current draft (GET /<form>/draft)
formIdOrPathstringyesForm ID (_id) or path (e.g. "user/login")
selectstringComma-separated fields to return (omit for full form JSON)
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
accessarrayRole-based access to the form definition itself
componentsarrayComponent tree defining the fields, layout, and logic of the form
createdstringISO 8601 creation timestamp
displaystringRender style: "form" or "wizard"
machineNamestringMachine-readable unique name within the project
modifiedstringISO 8601 last-modified timestamp
namestringAPI name of the form
ownerstring|nullID of the submission owner, when set
pathstringURL path the form is served at, relative to the project
projectstringID of the project owning the form
propertiesobjectCustom key/value properties
revisionsstring|booleanRevision mode: "original", "current", or false when disabled
settingsobjectForm-level settings
submissionAccessarrayRole-based access to the submissions of this form
tagsarrayTags applied to the form
titlestringHuman-readable form title
typestring"form" for a form, "resource" for a data resource

No examples provided.

form_list ~258

List forms from the Form.io project mapped to the user's current working directory with optional filtering and pagination.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
limitnumberMaximum number of forms to return (default: 20)
selectstringComma-separated fields to return (default: _id,title,name,path,type,tags)
skipnumberNumber of forms to skip for pagination
sortstringSort field and direction (e.g. "-created")
tagsarrayFilter by tags
typestringFilter by form type
NameTypeReqDescription
countnumberyesNumber of forms returned by this call
formsarrayyesMatching forms, in the requested sort order

No examples provided.

form_revision_get ~274

Fetch a single immutable form revision from the Form.io project mapped to the current working directory. `version` accepts either the revision `_vid` (e.g. "3") or the revision document `_id` (24-character hex). To revert the live form to this revision, pass its `form` body to `form_update` with a `note` like `Revert to v<vid>`.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdOrPathstringyesForm ID (_id) or path alias (e.g. "user/login")
versionstringyesRevision _vid (e.g. "3") or revision document _id
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
accessarrayRole-based access to the form definition itself
componentsarrayComponent tree defining the fields, layout, and logic of the form
createdstringISO 8601 creation timestamp
displaystringRender style: "form" or "wizard"
machineNamestringMachine-readable unique name within the project
modifiedstringISO 8601 last-modified timestamp
namestringAPI name of the form
ownerstring|nullID of the submission owner, when set
pathstringURL path the form is served at, relative to the project
projectstringID of the project owning the form
propertiesobjectCustom key/value properties
revisionsstring|booleanRevision mode: "original", "current", or false when disabled
settingsobjectForm-level settings
submissionAccessarrayRole-based access to the submissions of this form
tagsarrayTags applied to the form
titlestringHuman-readable form title
typestring"form" for a form, "resource" for a data resource

No examples provided.

form_revisions_list ~274

List immutable published revision summaries for a single form in the Form.io project mapped to the current working directory. Returns compact revision metadata (_vid, _id, modified, user, _vnote) for the form identified by `formIdOrPath`. To inspect a specific revision body, call `form_revision_get` with the desired `_vid`. To revert the live form to a prior revision, pass that revision body to `form_update` with a `note` like `Revert to v<vid>`.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
formIdOrPathstringyesForm ID (_id) or path alias (e.g. "user/login")
NameTypeReqDescription
countnumberyesNumber of revisions returned
revisionsarrayyesPublished revision summaries, newest first

No examples provided.

form_update ~532

Update an existing form in the Form.io project mapped to the user's current working directory. IMPORTANT: Before calling this tool, first use form_get to fetch the current form definition, then use the formio-schema skill to understand the schema so that you can apply the requested modifications (add, remove, or modify fields and settings), and finally call this tool with the complete updated form JSON. `draft`, `publish`, and `revert` are mutually exclusive — pass at most one. If `revisions` in the response differs from the stored value, the per-form revisions-mode gate prompted the USER and they chose.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
draftbooleanWhen true, create or update a draft (PUT /form/{formId}/draft) instead of publishing. Caller `form` fields merge on top of existing draft fields, preserving prior unpublished draft edits.
formobjectyesComplete updated Form.io form JSON definition
formIdstringyesThe _id of the form to update
notestringyesRequired note describing the diff (live form vs updated body) — no action preambles ("Published draft:", "Saved draft:", "Reverted:"). For `revert: true`, default to "Reverted to version {version}" u…
publishbooleanWhen true, publish the current draft. Caller `form` body is ignored; only allowlisted revision fields flow from existing draft to live (PUT /form/{formId}).
revertbooleanWhen true, revert the live form to a prior revision. Requires `version`. Caller `form` body is ignored; only allowlisted revision fields flow from the revision to live.
versionstringRevision identifier for `revert: true` — either the revision `_vid` (e.g. "3") or the revision document `_id` (24-char hex).
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
accessarrayRole-based access to the form definition itself
componentsarrayComponent tree defining the fields, layout, and logic of the form
createdstringISO 8601 creation timestamp
displaystringRender style: "form" or "wizard"
machineNamestringMachine-readable unique name within the project
modifiedstringISO 8601 last-modified timestamp
namestringAPI name of the form
ownerstring|nullID of the submission owner, when set
pathstringURL path the form is served at, relative to the project
projectstringID of the project owning the form
propertiesobjectCustom key/value properties
revisionsstring|booleanRevision mode: "original", "current", or false when disabled
settingsobjectForm-level settings
submissionAccessarrayRole-based access to the submissions of this form
tagsarrayTags applied to the form
titlestringHuman-readable form title
typestring"form" for a form, "resource" for a data resource

No examples provided.

hello ~53

Say hello — a connectivity check that confirms the server is running and reachable. Needs no Form.io project or credentials, so it is the first thing to try when other tools fail.

NameTypeReqDescription
namestringName to greet
NameTypeReqDescription
greetingstringyesThe greeting this server produced

No examples provided.

project_export ~185

Export the complete template (roles, resources, forms, actions) of the Form.io project mapped to the user's current working directory as a portable JSON document. Use this to snapshot a project before importing changes.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
NameTypeReqDescription
actionsobjectActions, keyed by machine name
descriptionstringProject description
formsobjectForms, keyed by machine name
namestringProject machine name
resourcesobjectResource forms, keyed by machine name
rolesobjectRoles, keyed by machine name
titlestringProject title
versionstringTemplate schema version

No examples provided.

project_get ~331

Report which Form.io project the given working directory resolves to, which deployment hosts it, and which layer supplied each — the preflight to run before the first tool call that reads from or writes to a deployment. Answers from inside this server, using the same resolver every other tool uses, so what it reports is what the next call targets. There is no need to run any shell command to ask this. Branch on `status`. "ok" means both URLs resolved and you may proceed. "not-configured" means nothing is mapped for this directory: relay the message, ask the user for the single value it names, record it with project_set, and call this again. "base-url-unresolved" means the project IS recorded and only its deployment is missing — ask for the Base URL alone and do NOT re-ask for the Project URL. Reads only. It resolves and reports; project_set is what records a choice.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
NameTypeReqDescription
baseUrlstringDeployment hosting that project; absent unless status is ok
baseUrlSourcestringWhich layer supplied the base URL: committed, mapping, environment, derived (read off the project URL), or unresolved
cwdstringyesWorking directory the resolution was performed for
forcedbooleanTrue when this pair was recorded with `project set --force`, which waives the rules tying a Project URL to the deployment that serves it — the case those rules cannot tell from a mistake is an intern…
messagestringyesThe full human-readable report, including what to do next
notesarrayyesAnything set aside while resolving — an unreadable mapping a committed formio.json made irrelevant, a stored value that is not a URL, or the directory this answer is about when no cwd was passed. A U…
projectUrlstringProject URL that resolves for that directory; absent when status is not-configured
projectUrlSourcestringWhich layer supplied the project URL: committed (a formio.json found by walking up), mapping (the per-directory record project_set writes), or environment (FORMIO_PROJECT_URL, the weakest source)
remedyobjectThe same remedy the message states, as a call: ask the user for the argument named in `supply`, add it to `arguments`, and call the tool. Absent when the status is "ok" — and absent when no call fixe…
shadowedarrayyesLayers that could have supplied a URL and were overridden, in precedence order
statusstringyesWhich of the three answers this is: "ok" — both URLs resolved; "not-configured" — nothing is mapped for this directory, so ask the user for a Project URL and record it with project_set; "base-url-unr…
unpairedarrayyesValues that were overridden by nothing: a deployment recorded with no project beside it, so nothing says which project it serves and it cannot be read. Separate from `shadowed` because the fix differ…

No examples provided.

project_import ~221

Import a template JSON into the existing Form.io project mapped to the user's current working directory, merging roles, resources, forms, and actions in one call. Use the formio-resource-planner skill to construct the template before calling this tool. WARNING: import merges into the existing project — use project_export first to snapshot.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
templateobjectyesThe template JSON object to import
NameTypeReqDescription
messagestringyesHuman-readable result detail
okbooleanyesTrue when the operation completed

No examples provided.

project_set ~1,032

Set the active Form.io project for the given working directory by recording its URL in ~/.formio/projects.json You MUST call this tool whenever the user asks to set, change, or switch the active Form.io project — do not merely acknowledge the request in text. Persisting the choice requires the tool call. The chosen URL is persisted to ~/.formio/projects.json keyed by the cwd argument when provided (or the MCP server process cwd otherwise). Pass the `cwd` argument whenever you know the user's current working directory — the server process cwd is fixed at spawn and may not match where the user actually is. Every Form.io tool resolves its project on each call, so a mapping written here needs no restart. It takes effect only where the mapping is the record that WINS, though: under a committed formio.json the mapping is the fallback if that file goes away, and this call reports the pair that actually resolves rather than the one it recorded. Read `ok` and `projectUrl` on the result rather than assuming the write governs. You normally pass only projectUrl. The base URL — which builds the portal-login URL and keys the cached token — is derived from it — https://api.form.io for a project on a form.io host, and the parent path for a project addressed as a sub-directory — so there is nothing to supply. Pass baseUrl ONLY when the server reports that it cannot be determined, which happens for a project URL that carries no path on a customer domain: there the deployment is a sibling sub-domain and nothing in the project URL names it. Do not ask the user for a base URL before the server says it needs one. This tool writes the machine-local mapping, which is keyed by absolute path and therefore does not survive a clone. To record the target with the code instead — versioned, visible in a diff, and shared with everyone who clones the repository — write a committed formio.json yourself, in the application's own folder: a JSON object holding {"projectUrl": "..."}, plus "baseUrl" onl…

NameTypeReqDescription
baseUrlstringDeployment URL for the Form.io Enterprise Server that hosts this project. It builds the portal-login URL and keys the cached token, so a wrong one fails at login rather than on the request. Usually o…
cwdstringUser's current working directory to key the persisted mapping against, as an absolute path. Pass whenever known (e.g. from UserPromptSubmit hook context). Falls back to the MCP server's process.cwd()…
projectUrlstringFull URL of the Form.io project to activate. Optional when THIS DIRECTORY'S OWN MAPPING already holds a project: omitting it then updates that record's baseUrl alone, which is how the "Base URL canno…
NameTypeReqDescription
baseUrlstringThe deployment that serves `projectUrl`, from the same record — never one record's project beside another record's deployment
changedbooleanyesFalse when the requested mapping was already in place and nothing was written. True means the RECORD changed, which is not necessarily the same as the ACTIVE project changing — a committed formio.jso…
cwdstringyesWorking directory the mapping is keyed against
forcedbooleanTrue when the pair that now resolves was recorded with `project set --force`, which waives the rules tying a Project URL to the deployment that serves it. Set only by that shell command — this tool c…
messagestringyesHuman-readable result detail
okbooleanyesTrue when the directory is ready for a deployment call. False means the record WAS written and the directory still resolves no Base URL, because a committed formio.json governs it and supplies none —…
projectUrlstringyesProject URL now ACTIVE for that directory — what the next tool call will target. Usually the project this call just recorded; where a committed formio.json governs the directory, it is the project TH…

No examples provided.

role_create ~211

Create a new role in the Form.io project mapped to the user's current working directory.

NameTypeReqDescription
adminbooleanWhen true, holders bypass access checks
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
defaultbooleanWhen true, role is assigned to every new authenticated user
descriptionstringRole description
titlestringyesRole title
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
adminbooleanWhether the role grants administrative access
createdstringISO 8601 creation timestamp
defaultbooleanWhether the role is assigned to anonymous or newly registered users
descriptionstringWhat the role is for
machineNamestringMachine-readable unique name within the project
modifiedstringISO 8601 last-modified timestamp
projectstringID of the project owning the role
titlestringHuman-readable role title

No examples provided.

role_list ~174

List all roles defined in the Form.io project mapped to the user's current working directory.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
selectstringComma-separated fields to return
NameTypeReqDescription
countnumberyesNumber of roles returned
rolesarrayyesRoles defined in the project

No examples provided.

role_update ~203

Update an existing role in the Form.io project mapped to the user's current working directory. This is a full replacement — include all fields you want to preserve.

NameTypeReqDescription
cwdstringUser's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the…
roleobjectyesRole document with updated fields
roleIdstringyesThe _id of the role to update
NameTypeReqDescription
_idstringForm.io document ID (24-character hex)
adminbooleanWhether the role grants administrative access
createdstringISO 8601 creation timestamp
defaultbooleanWhether the role is assigned to anonymous or newly registered users
descriptionstringWhat the role is for
machineNamestringMachine-readable unique name within the project
modifiedstringISO 8601 last-modified timestamp
projectstringID of the project owning the role
titlestringHuman-readable role title

No examples provided.

Common questions

What is the io.form/formio-mcp server?

io.form/formio-mcp is listed in the public MCP registry as io.form/formio-mcp. Create and manage Form.io forms, resources, actions, roles, and projects from your AI agent. This page covers its npm package (@formio/mcp).

Is the io.form/formio-mcp server safe to use?

io.form/formio-mcp scores 93 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.form/formio-mcp server expose?

io.form/formio-mcp exposes 21 tools: hello, form_create, form_get, form_list, form_revision_get, and 16 more. Their descriptions and schemas cost roughly 5,705 tokens of context every time the server is loaded.

Is the io.form/formio-mcp server still maintained?

io.form/formio-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.form/formio-mcp server under?

io.form/formio-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.