{
  "slug": "io-form-formio-mcp",
  "name": "io.form/formio-mcp",
  "title": "formio-mcp",
  "description": "Create and manage Form.io forms, resources, actions, roles, and projects from your AI agent.",
  "version": "1.0.1",
  "publishedAt": "2026-10-14T04:13:35.316922Z",
  "updatedAt": "2026-10-14T04:13:35.316922Z",
  "repoUrl": "https://github.com/formio/ai",
  "websiteUrl": "https://form.io",
  "namespace": {
    "type": "domain",
    "owner": "form.io"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "@formio/mcp",
      "version": "1.0.1",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "FORMIO_PROJECT_URL",
      "isSecret": false,
      "isRequired": false,
      "description": "Optional, and the WEAKEST of the three project sources: a committed formio.json found by walking up from the working directory wins, then the per-directory mapping project_set writes, then this. It pins nothing — project_set can redirect a directory whose environment names a different project. Useful for a launch with nowhere to record a project, such as CI or a container (e.g. https://examples.form.io on the hosted cloud; self-hosted it is either https://your-project.your-domain.com or https://your-host/project-name, depending on how that deployment routes projects). Leave it unset and the agent asks for a project and records it per directory."
    },
    {
      "name": "FORMIO_BASE_URL",
      "isSecret": false,
      "isRequired": false,
      "description": "Optional, and usually unnecessary: the base URL is DERIVED from the project URL — https://api.form.io for a project on a form.io host, the parent path for a project addressed as a sub-directory — and is asked for only when it cannot be derived, which is a path-less project URL on a customer domain. There is no default. Like FORMIO_PROJECT_URL it is the weakest source, behind a committed formio.json and the per-directory mapping."
    },
    {
      "name": "FORMIO_API_KEY",
      "isSecret": true,
      "isRequired": false,
      "description": "Form.io project API key. Optional — applied only to the project FORMIO_PROJECT_URL names, so set FORMIO_PROJECT_URL beside it; any other project, and every project when it is omitted, uses the browser-based portal login flow to obtain a JWT."
    },
    {
      "name": "FORMIO_LOGIN_FORM",
      "isSecret": false,
      "isRequired": false,
      "description": "URL of a custom login form used by the browser-based portal login flow. Defaults to the deployment's portal login form."
    },
    {
      "name": "FORMIO_AUTH_HOST",
      "isSecret": false,
      "isRequired": false,
      "description": "Address the browser-login page binds to. Optional; defaults to 127.0.0.1. Set it to 0.0.0.0, together with FORMIO_AUTH_PORT, when the server runs in a container or on a remote machine and the login page must be reachable through a published port. 0.0.0.0 exposes the page on every interface for the duration of a login."
    },
    {
      "name": "FORMIO_AUTH_PORT",
      "isSecret": false,
      "isRequired": false,
      "description": "Fixed port for the browser-login page, so a container can publish it (e.g. 43117). Optional; a positive integer, and by default the page takes an ephemeral port."
    },
    {
      "name": "FORMIO_AUTH_TIMEOUT",
      "isSecret": false,
      "isRequired": false,
      "description": "Seconds to wait for a browser login before the call fails with an error naming the remedies. Optional; a positive integer no larger than 2147483, and any other value is ignored. Defaults to 900."
    },
    {
      "name": "FORMIO_FORCE_BROWSER",
      "isSecret": false,
      "isRequired": false,
      "description": "Set to 1 to attempt the browser login even where the server detects it cannot present one (CI, a container, a remote shell with no display). Use it when the login page is reachable from a browser elsewhere."
    },
    {
      "name": "FORMIO_REQUEST_TIMEOUT",
      "isSecret": false,
      "isRequired": false,
      "description": "Seconds a Form.io request may go unanswered before the call fails with a network error naming the URL. Optional; a positive integer no larger than 2147483, and any other value is ignored. Defaults to 60. project_import and project_export wait 300 seconds, or this value when it is longer."
    },
    {
      "name": "FORMIO_INSECURE_TLS",
      "isSecret": false,
      "isRequired": false,
      "description": "Set to 1 to skip TLS certificate verification only for requests to the configured deployment (the hosts of the resolved project URL and base URL); every other host is verified as usual. For local development against self-signed certificates only — never enable in production."
    }
  ],
  "category": "other",
  "subcategory": "more",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/formio/ai"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for 1 secret: FORMIO_API_KEY"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via domain form.io"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "@formio/mcp@1.0.1 runs nothing at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 144 files in @formio/mcp@1.0.1: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 144 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (npm)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"formio-mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@formio/mcp@1.0.1\"\n      ]\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 8,
  "archived": false,
  "pushedAt": "2026-10-28T23:35:13Z",
  "health": {
    "score": 58,
    "parts": {
      "popularity": 0.38105957688186726,
      "activity": 0.6,
      "issues": null,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 8,
      "forks": 4,
      "downloads": 730,
      "hn": null,
      "issuesOpen": 0,
      "issuesClosed": 1,
      "prsMerged": 109,
      "commits90": 0,
      "release": "2026-10-14T04:13:39Z",
      "pushed": "2026-10-28T23:35:13Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:35:52.424Z"
  }
}