io.form/formio-mcp
NPM · @FORMIO/MCP · SCANNED SEP 20
Create and manage Form.io forms, resources, actions, roles, and projects from your AI agent.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 39 of 122 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to formio/ai). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 10 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 6794 tokens (~323/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.form/formio-mcp server?
io.form/formio-mcp runs locally as an npm package, launched with npx -y @formio/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @formio/mcp
claude mcp add io-form-formio-mcp -- npx -y @formio/mcp
{
"mcpServers": {
"io-form-formio-mcp": {
"command": "npx",
"args": [
"-y",
"@formio/mcp"
]
}
}
} {
"servers": {
"io-form-formio-mcp": {
"command": "npx",
"args": [
"-y",
"@formio/mcp"
]
}
}
} codex mcp add io-form-formio-mcp -- npx -y @formio/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-form-formio-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@formio/mcp"
],
"enabled": true
}
}
} openclaw mcp add io-form-formio-mcp --command npx --arg -y --arg @formio/mcp
mcp_servers:
io-form-formio-mcp:
command: "npx"
args: ["-y", "@formio/mcp"] {
"McpServers": {
"io-form-formio-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@formio/mcp"
]
}
}
} assistant mcp add io-form-formio-mcp -t stdio -c npx -a -y @formio/mcp
{
"mcpServers": {
"io-form-formio-mcp": {
"command": "npx",
"args": [
"-y",
"@formio/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
- Stability: 0.97 → pass security
- Security disclosure: unverified → pass ▲ functional
- 19 Sept 26 0
- Security disclosure: pass → unverified ▼ functional
- 18 Sept 26 −1
- Stability: pass → 0.93 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +2
- CVE-2026-82562 no longer affects this package ▲ security
- CVE-2026-82417 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- 13 Sept 26 −1
- Stability: pass → 0.90 functional
- 12 Sept 26 0
- Stability: 0.97 → pass security
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@formio/mcp@0.13.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | formio/ai |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/formio/ai/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2769036383 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:96dab81e170f20de89c633035a710dc243d21b7183d44cea62a95f4361562a923c43ab84c30f6b9c4c7b1b3a0ccb843e0d31a37e720b3ebc71fd3da1a |
Background: How many MCP packages publish verified provenance →
Dependencies 122 packages
| Packages resolved | 122 |
|---|---|
| Stale | 39 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
action_create ~193
Create a new action on a form. Call action_type_get first to discover the required settings schema for the action type.
| Name | Type | Req | Description |
|---|---|---|---|
| action | object | yes | Action definition |
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID to attach the action to |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| condition | object | – | Condition gating whether the action runs |
| created | string | – | ISO 8601 creation timestamp |
| form | string | – | ID of the form the action runs on |
| handler | array | – | When the action runs relative to submission handling: "before" and/or "after" |
| machineName | string | – | Machine-readable unique name within the project |
| method | array | – | Submission methods the action responds to, e.g. "create", "update" |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | Action type name, e.g. "save", "login", "email" |
| priority | number | – | Execution order; higher runs first |
| settings | object | – | Action-type-specific settings; see action_type_get for the schema |
| title | string | – | Human-readable action title |
No examples provided.
action_delete ~204
Delete an action from a form. The action stops running on submissions immediately and is not recoverable — call action_get first if the settings may be needed again.
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | The action ID to delete |
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID the action belongs to |
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | Human-readable result detail |
| ok | boolean | yes | True when the operation completed |
No examples provided.
action_get ~205
Get a single action by ID from a form, including its handler, method, condition, and type-specific settings. Call action_list first to find the action ID.
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | The action ID to retrieve |
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID the action belongs to |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| condition | object | – | Condition gating whether the action runs |
| created | string | – | ISO 8601 creation timestamp |
| form | string | – | ID of the form the action runs on |
| handler | array | – | When the action runs relative to submission handling: "before" and/or "after" |
| machineName | string | – | Machine-readable unique name within the project |
| method | array | – | Submission methods the action responds to, e.g. "create", "update" |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | Action type name, e.g. "save", "login", "email" |
| priority | number | – | Execution order; higher runs first |
| settings | object | – | Action-type-specific settings; see action_type_get for the schema |
| title | string | – | Human-readable action title |
No examples provided.
action_list ~193
List the actions configured on a form — the server-side handlers that run when a submission is saved, such as save-to-resource, email, login, and role assignment.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID to list actions for |
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | yes | Actions configured on the form |
| count | number | yes | Number of actions returned |
No examples provided.
action_type_get ~210
Get action type info and settings form schema. Call this before action_create to discover the required settings for the action type.
| Name | Type | Req | Description |
|---|---|---|---|
| actionName | string | yes | The action type name (e.g. "email", "save", "login") |
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID to get the action type for |
| Name | Type | Req | Description |
|---|---|---|---|
| access | object | – | Access requirements for configuring the action |
| defaults | object | – | Default settings applied on creation |
| description | string | – | What the action type does |
| name | string | – | Action type name to pass as `name` to action_create |
| priority | number | – | Default execution priority |
| settingsForm | object | – | Form definition describing the settings this action type accepts; its components are the keys valid in `settings` on action_create |
| title | string | – | Human-readable action type title |
No examples provided.
action_types_list ~180
List available action types for a form. Returns the catalog of action types the server supports.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID to list available action types for |
| Name | Type | Req | Description |
|---|---|---|---|
| actionTypes | array | yes | Action types this deployment supports for the form |
| count | number | yes | Number of action types returned |
No examples provided.
action_update ~220
Update an existing action on a form. This is a full replacement of the action document — include every field you want to keep, and call action_get first if you do not already have it.
| Name | Type | Req | Description |
|---|---|---|---|
| action | object | yes | Action definition |
| actionId | string | yes | The action ID to update |
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formId | string | yes | The form ID the action belongs to |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| condition | object | – | Condition gating whether the action runs |
| created | string | – | ISO 8601 creation timestamp |
| form | string | – | ID of the form the action runs on |
| handler | array | – | When the action runs relative to submission handling: "before" and/or "after" |
| machineName | string | – | Machine-readable unique name within the project |
| method | array | – | Submission methods the action responds to, e.g. "create", "update" |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | Action type name, e.g. "save", "login", "email" |
| priority | number | – | Execution order; higher runs first |
| settings | object | – | Action-type-specific settings; see action_type_get for the schema |
| title | string | – | Human-readable action title |
No examples provided.
form_create ~297
Create a new form in the Form.io project mapped to the user's current working directory. IMPORTANT: Before calling this tool, use the formio-schema skill to construct a properly structured Form.io form JSON definition based on the user's requirements. The skill documents all component types, validation options, layout patterns, and conditional logic available in Form.io. New forms default to `revisions: 'original'` so form change history is preserved. NOT for: creating a draft revision of an existing form. When the user says "create/save a draft", "draft <change>", call form_update with `formId` and `draft: true` instead.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| form | object | yes | Form.io form JSON definition |
| note | string | – | Note describing the initial revision |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| access | array | – | Role-based access to the form definition itself |
| components | array | – | Component tree defining the fields, layout, and logic of the form |
| created | string | – | ISO 8601 creation timestamp |
| display | string | – | Render style: "form" or "wizard" |
| machineName | string | – | Machine-readable unique name within the project |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | API name of the form |
| owner | string|null | – | ID of the submission owner, when set |
| path | string | – | URL path the form is served at, relative to the project |
| project | string | – | ID of the project owning the form |
| properties | object | – | Custom key/value properties |
| revisions | string|boolean | – | Revision mode: "original", "current", or false when disabled |
| settings | object | – | Form-level settings |
| submissionAccess | array | – | Role-based access to the submissions of this form |
| tags | array | – | Tags applied to the form |
| title | string | – | Human-readable form title |
| type | string | – | "form" for a form, "resource" for a data resource |
No examples provided.
form_get ~255
Fetch a single form definition from the Form.io project mapped to the user's current working directory, by form ID or path. Pass `draft: true` to fetch the form's current in-flight draft instead of the published form.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| draft | boolean | – | When true, fetch the form's current draft (GET /<form>/draft) |
| formIdOrPath | string | yes | Form ID (_id) or path (e.g. "user/login") |
| select | string | – | Comma-separated fields to return (omit for full form JSON) |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| access | array | – | Role-based access to the form definition itself |
| components | array | – | Component tree defining the fields, layout, and logic of the form |
| created | string | – | ISO 8601 creation timestamp |
| display | string | – | Render style: "form" or "wizard" |
| machineName | string | – | Machine-readable unique name within the project |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | API name of the form |
| owner | string|null | – | ID of the submission owner, when set |
| path | string | – | URL path the form is served at, relative to the project |
| project | string | – | ID of the project owning the form |
| properties | object | – | Custom key/value properties |
| revisions | string|boolean | – | Revision mode: "original", "current", or false when disabled |
| settings | object | – | Form-level settings |
| submissionAccess | array | – | Role-based access to the submissions of this form |
| tags | array | – | Tags applied to the form |
| title | string | – | Human-readable form title |
| type | string | – | "form" for a form, "resource" for a data resource |
No examples provided.
form_list ~258
List forms from the Form.io project mapped to the user's current working directory with optional filtering and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| limit | number | – | Maximum number of forms to return (default: 20) |
| select | string | – | Comma-separated fields to return (default: _id,title,name,path,type,tags) |
| skip | number | – | Number of forms to skip for pagination |
| sort | string | – | Sort field and direction (e.g. "-created") |
| tags | array | – | Filter by tags |
| type | string | – | Filter by form type |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of forms returned by this call |
| forms | array | yes | Matching forms, in the requested sort order |
No examples provided.
form_revision_get ~274
Fetch a single immutable form revision from the Form.io project mapped to the current working directory. `version` accepts either the revision `_vid` (e.g. "3") or the revision document `_id` (24-character hex). To revert the live form to this revision, pass its `form` body to `form_update` with a `note` like `Revert to v<vid>`.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formIdOrPath | string | yes | Form ID (_id) or path alias (e.g. "user/login") |
| version | string | yes | Revision _vid (e.g. "3") or revision document _id |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| access | array | – | Role-based access to the form definition itself |
| components | array | – | Component tree defining the fields, layout, and logic of the form |
| created | string | – | ISO 8601 creation timestamp |
| display | string | – | Render style: "form" or "wizard" |
| machineName | string | – | Machine-readable unique name within the project |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | API name of the form |
| owner | string|null | – | ID of the submission owner, when set |
| path | string | – | URL path the form is served at, relative to the project |
| project | string | – | ID of the project owning the form |
| properties | object | – | Custom key/value properties |
| revisions | string|boolean | – | Revision mode: "original", "current", or false when disabled |
| settings | object | – | Form-level settings |
| submissionAccess | array | – | Role-based access to the submissions of this form |
| tags | array | – | Tags applied to the form |
| title | string | – | Human-readable form title |
| type | string | – | "form" for a form, "resource" for a data resource |
No examples provided.
form_revisions_list ~274
List immutable published revision summaries for a single form in the Form.io project mapped to the current working directory. Returns compact revision metadata (_vid, _id, modified, user, _vnote) for the form identified by `formIdOrPath`. To inspect a specific revision body, call `form_revision_get` with the desired `_vid`. To revert the live form to a prior revision, pass that revision body to `form_update` with a `note` like `Revert to v<vid>`.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| formIdOrPath | string | yes | Form ID (_id) or path alias (e.g. "user/login") |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of revisions returned |
| revisions | array | yes | Published revision summaries, newest first |
No examples provided.
form_update ~532
Update an existing form in the Form.io project mapped to the user's current working directory. IMPORTANT: Before calling this tool, first use form_get to fetch the current form definition, then use the formio-schema skill to understand the schema so that you can apply the requested modifications (add, remove, or modify fields and settings), and finally call this tool with the complete updated form JSON. `draft`, `publish`, and `revert` are mutually exclusive — pass at most one. If `revisions` in the response differs from the stored value, the per-form revisions-mode gate prompted the USER and they chose.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| draft | boolean | – | When true, create or update a draft (PUT /form/{formId}/draft) instead of publishing. Caller `form` fields merge on top of existing draft fields, preserving prior unpublished draft edits. |
| form | object | yes | Complete updated Form.io form JSON definition |
| formId | string | yes | The _id of the form to update |
| note | string | yes | Required note describing the diff (live form vs updated body) — no action preambles ("Published draft:", "Saved draft:", "Reverted:"). For `revert: true`, default to "Reverted to version {version}" u… |
| publish | boolean | – | When true, publish the current draft. Caller `form` body is ignored; only allowlisted revision fields flow from existing draft to live (PUT /form/{formId}). |
| revert | boolean | – | When true, revert the live form to a prior revision. Requires `version`. Caller `form` body is ignored; only allowlisted revision fields flow from the revision to live. |
| version | string | – | Revision identifier for `revert: true` — either the revision `_vid` (e.g. "3") or the revision document `_id` (24-char hex). |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| access | array | – | Role-based access to the form definition itself |
| components | array | – | Component tree defining the fields, layout, and logic of the form |
| created | string | – | ISO 8601 creation timestamp |
| display | string | – | Render style: "form" or "wizard" |
| machineName | string | – | Machine-readable unique name within the project |
| modified | string | – | ISO 8601 last-modified timestamp |
| name | string | – | API name of the form |
| owner | string|null | – | ID of the submission owner, when set |
| path | string | – | URL path the form is served at, relative to the project |
| project | string | – | ID of the project owning the form |
| properties | object | – | Custom key/value properties |
| revisions | string|boolean | – | Revision mode: "original", "current", or false when disabled |
| settings | object | – | Form-level settings |
| submissionAccess | array | – | Role-based access to the submissions of this form |
| tags | array | – | Tags applied to the form |
| title | string | – | Human-readable form title |
| type | string | – | "form" for a form, "resource" for a data resource |
No examples provided.
hello ~53
Say hello — a connectivity check that confirms the server is running and reachable. Needs no Form.io project or credentials, so it is the first thing to try when other tools fail.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Name to greet |
| Name | Type | Req | Description |
|---|---|---|---|
| greeting | string | yes | The greeting this server produced |
No examples provided.
project_export ~185
Export the complete template (roles, resources, forms, actions) of the Form.io project mapped to the user's current working directory as a portable JSON document. Use this to snapshot a project before importing changes.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| Name | Type | Req | Description |
|---|---|---|---|
| actions | object | – | Actions, keyed by machine name |
| description | string | – | Project description |
| forms | object | – | Forms, keyed by machine name |
| name | string | – | Project machine name |
| resources | object | – | Resource forms, keyed by machine name |
| roles | object | – | Roles, keyed by machine name |
| title | string | – | Project title |
| version | string | – | Template schema version |
No examples provided.
project_get ~331
Report which Form.io project the given working directory resolves to, which deployment hosts it, and which layer supplied each — the preflight to run before the first tool call that reads from or writes to a deployment. Answers from inside this server, using the same resolver every other tool uses, so what it reports is what the next call targets. There is no need to run any shell command to ask this. Branch on `status`. "ok" means both URLs resolved and you may proceed. "not-configured" means nothing is mapped for this directory: relay the message, ask the user for the single value it names, record it with project_set, and call this again. "base-url-unresolved" means the project IS recorded and only its deployment is missing — ask for the Base URL alone and do NOT re-ask for the Project URL. Reads only. It resolves and reports; project_set is what records a choice.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | – | Deployment hosting that project; absent unless status is ok |
| baseUrlSource | string | – | Which layer supplied the base URL: committed, mapping, environment, derived (read off the project URL), or unresolved |
| cwd | string | yes | Working directory the resolution was performed for |
| forced | boolean | – | True when this pair was recorded with `project set --force`, which waives the rules tying a Project URL to the deployment that serves it — the case those rules cannot tell from a mistake is an intern… |
| message | string | yes | The full human-readable report, including what to do next |
| notes | array | yes | Anything set aside while resolving — an unreadable mapping a committed formio.json made irrelevant, a stored value that is not a URL, or the directory this answer is about when no cwd was passed. A U… |
| projectUrl | string | – | Project URL that resolves for that directory; absent when status is not-configured |
| projectUrlSource | string | – | Which layer supplied the project URL: committed (a formio.json found by walking up), mapping (the per-directory record project_set writes), or environment (FORMIO_PROJECT_URL, the weakest source) |
| remedy | object | – | The same remedy the message states, as a call: ask the user for the argument named in `supply`, add it to `arguments`, and call the tool. Absent when the status is "ok" — and absent when no call fixe… |
| shadowed | array | yes | Layers that could have supplied a URL and were overridden, in precedence order |
| status | string | yes | Which of the three answers this is: "ok" — both URLs resolved; "not-configured" — nothing is mapped for this directory, so ask the user for a Project URL and record it with project_set; "base-url-unr… |
| unpaired | array | yes | Values that were overridden by nothing: a deployment recorded with no project beside it, so nothing says which project it serves and it cannot be read. Separate from `shadowed` because the fix differ… |
No examples provided.
project_import ~221
Import a template JSON into the existing Form.io project mapped to the user's current working directory, merging roles, resources, forms, and actions in one call. Use the formio-resource-planner skill to construct the template before calling this tool. WARNING: import merges into the existing project — use project_export first to snapshot.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| template | object | yes | The template JSON object to import |
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | Human-readable result detail |
| ok | boolean | yes | True when the operation completed |
No examples provided.
project_set ~1,032
Set the active Form.io project for the given working directory by recording its URL in ~/.formio/projects.json You MUST call this tool whenever the user asks to set, change, or switch the active Form.io project — do not merely acknowledge the request in text. Persisting the choice requires the tool call. The chosen URL is persisted to ~/.formio/projects.json keyed by the cwd argument when provided (or the MCP server process cwd otherwise). Pass the `cwd` argument whenever you know the user's current working directory — the server process cwd is fixed at spawn and may not match where the user actually is. Every Form.io tool resolves its project on each call, so a mapping written here needs no restart. It takes effect only where the mapping is the record that WINS, though: under a committed formio.json the mapping is the fallback if that file goes away, and this call reports the pair that actually resolves rather than the one it recorded. Read `ok` and `projectUrl` on the result rather than assuming the write governs. You normally pass only projectUrl. The base URL — which builds the portal-login URL and keys the cached token — is derived from it — https://api.form.io for a project on a form.io host, and the parent path for a project addressed as a sub-directory — so there is nothing to supply. Pass baseUrl ONLY when the server reports that it cannot be determined, which happens for a project URL that carries no path on a customer domain: there the deployment is a sibling sub-domain and nothing in the project URL names it. Do not ask the user for a base URL before the server says it needs one. This tool writes the machine-local mapping, which is keyed by absolute path and therefore does not survive a clone. To record the target with the code instead — versioned, visible in a diff, and shared with everyone who clones the repository — write a committed formio.json yourself, in the application's own folder: a JSON object holding {"projectUrl": "..."}, plus "baseUrl" onl…
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | – | Deployment URL for the Form.io Enterprise Server that hosts this project. It builds the portal-login URL and keys the cached token, so a wrong one fails at login rather than on the request. Usually o… |
| cwd | string | – | User's current working directory to key the persisted mapping against, as an absolute path. Pass whenever known (e.g. from UserPromptSubmit hook context). Falls back to the MCP server's process.cwd()… |
| projectUrl | string | – | Full URL of the Form.io project to activate. Optional when THIS DIRECTORY'S OWN MAPPING already holds a project: omitting it then updates that record's baseUrl alone, which is how the "Base URL canno… |
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | – | The deployment that serves `projectUrl`, from the same record — never one record's project beside another record's deployment |
| changed | boolean | yes | False when the requested mapping was already in place and nothing was written. True means the RECORD changed, which is not necessarily the same as the ACTIVE project changing — a committed formio.jso… |
| cwd | string | yes | Working directory the mapping is keyed against |
| forced | boolean | – | True when the pair that now resolves was recorded with `project set --force`, which waives the rules tying a Project URL to the deployment that serves it. Set only by that shell command — this tool c… |
| message | string | yes | Human-readable result detail |
| ok | boolean | yes | True when the directory is ready for a deployment call. False means the record WAS written and the directory still resolves no Base URL, because a committed formio.json governs it and supplies none —… |
| projectUrl | string | yes | Project URL now ACTIVE for that directory — what the next tool call will target. Usually the project this call just recorded; where a committed formio.json governs the directory, it is the project TH… |
No examples provided.
role_create ~211
Create a new role in the Form.io project mapped to the user's current working directory.
| Name | Type | Req | Description |
|---|---|---|---|
| admin | boolean | – | When true, holders bypass access checks |
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| default | boolean | – | When true, role is assigned to every new authenticated user |
| description | string | – | Role description |
| title | string | yes | Role title |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| admin | boolean | – | Whether the role grants administrative access |
| created | string | – | ISO 8601 creation timestamp |
| default | boolean | – | Whether the role is assigned to anonymous or newly registered users |
| description | string | – | What the role is for |
| machineName | string | – | Machine-readable unique name within the project |
| modified | string | – | ISO 8601 last-modified timestamp |
| project | string | – | ID of the project owning the role |
| title | string | – | Human-readable role title |
No examples provided.
role_list ~174
List all roles defined in the Form.io project mapped to the user's current working directory.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| select | string | – | Comma-separated fields to return |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of roles returned |
| roles | array | yes | Roles defined in the project |
No examples provided.
role_update ~203
Update an existing role in the Form.io project mapped to the user's current working directory. This is a full replacement — include all fields you want to preserve.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | User's current working directory as an absolute path. Selects the Form.io project that directory resolves to, by scope, narrowest first: a committed formio.json found by walking up from it, then the… |
| role | object | yes | Role document with updated fields |
| roleId | string | yes | The _id of the role to update |
| Name | Type | Req | Description |
|---|---|---|---|
| _id | string | – | Form.io document ID (24-character hex) |
| admin | boolean | – | Whether the role grants administrative access |
| created | string | – | ISO 8601 creation timestamp |
| default | boolean | – | Whether the role is assigned to anonymous or newly registered users |
| description | string | – | What the role is for |
| machineName | string | – | Machine-readable unique name within the project |
| modified | string | – | ISO 8601 last-modified timestamp |
| project | string | – | ID of the project owning the role |
| title | string | – | Human-readable role title |
No examples provided.
What is the io.form/formio-mcp server?
io.form/formio-mcp is listed in the public MCP registry as io.form/formio-mcp. Create and manage Form.io forms, resources, actions, roles, and projects from your AI agent. This page covers its npm package (@formio/mcp).
Is the io.form/formio-mcp server safe to use?
io.form/formio-mcp scores 93 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.form/formio-mcp server expose?
io.form/formio-mcp exposes 21 tools: hello, form_create, form_get, form_list, form_revision_get, and 16 more. Their descriptions and schemas cost roughly 5,705 tokens of context every time the server is loaded.
Is the io.form/formio-mcp server still maintained?
io.form/formio-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.form/formio-mcp server under?
io.form/formio-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.