@formio/mcp - npm Package Compare versions

Comparing version 0.12.0 to 0.12.1

dist/config.d.ts

 export declare const DEFAULT_BASE_URL = "https://api.form.io";
+/**
+ * The Project URL, for the PERSON being asked for one.
+ *
+ * Every skill instructs the agent to relay the unconfigured report verbatim and ask for
+ * the one value it names, so this text is read by a human — who is going to paste the URL
+ * they already have. What they need is the definition and the shapes; what they were
+ * getting was PROJECT_URL_GUIDANCE entire, a third of which is prohibitions written to
+ * stop an AGENT constructing a URL it should have asked for. Relayed under a one-line
+ * question, those read as guardrails for somebody else, and they made a three-line ask
+ * eight lines long.
+ *
+ * The prohibitions are not lost: they stay in PROJECT_URL_GUIDANCE, which the server's
+ * own instructions carry, so an agent with no skills installed still meets them at
+ * connect time — the surface they were written for.
+ */
+export declare const PROJECT_URL_FOR_A_USER: string;
+/**
+ * The same thing for an AGENT, with the rules that stop it building a URL rather than
+ * asking for one. Carried by the server's instructions and by the surfaces only a model
+ * reads — never by a report a user is shown; see PROJECT_URL_FOR_A_USER.
+ */
 export declare const PROJECT_URL_GUIDANCE: string;
@@ -3,0 +24,0 @@ export declare const BASE_URL_UNDERIVABLE = "a project URL that carries no path on a customer domain names its deployment nowhere \u2014 there the deployment is a sibling sub-domain of the same parent domain \u2014 so it cannot be derived";

dist/config.js

@@ -10,2 +10,27 @@ export const DEFAULT_BASE_URL = 'https://api.form.io';
 // for one value read as asking for two.
+/**
+ * The Project URL, for the PERSON being asked for one.
+ *
+ * Every skill instructs the agent to relay the unconfigured report verbatim and ask for
+ * the one value it names, so this text is read by a human — who is going to paste the URL
+ * they already have. What they need is the definition and the shapes; what they were
+ * getting was PROJECT_URL_GUIDANCE entire, a third of which is prohibitions written to
+ * stop an AGENT constructing a URL it should have asked for. Relayed under a one-line
+ * question, those read as guardrails for somebody else, and they made a three-line ask
+ * eight lines long.
+ *
+ * The prohibitions are not lost: they stay in PROJECT_URL_GUIDANCE, which the server's
+ * own instructions carry, so an agent with no skills installed still meets them at
+ * connect time — the surface they were written for.
+ */
+export const PROJECT_URL_FOR_A_USER = [
+    'A Project URL is the full URL of one Form.io project.',
+    `On Form.io's hosted cloud that is the project's name as a sub-domain of form.io: a project named examples is https://examples.form.io.`,
+    'On a deployment you host it is either a sub-directory of that deployment (https://forms.mysite.com/myproject) or a sibling sub-domain of the same parent domain (https://myproject.mysite.com), depending on how that deployment routes projects.',
+].join(' ');
+/**
+ * The same thing for an AGENT, with the rules that stop it building a URL rather than
+ * asking for one. Carried by the server's instructions and by the surfaces only a model
+ * reads — never by a report a user is shown; see PROJECT_URL_FOR_A_USER.
+ */
 export const PROJECT_URL_GUIDANCE = [
@@ -12,0 +37,0 @@ 'A Project URL is the full URL of one Form.io project — the project an application reads and writes.',

dist/project-report.js

 import { COMMITTED_CONFIG_FILE } from './committed-config.js';
-import { BASE_URL_UNDERIVABLE, PROJECT_URL_GUIDANCE, normalizeHttpUrl, } from './config.js';
+import { BASE_URL_UNDERIVABLE, PROJECT_URL_FOR_A_USER, normalizeHttpUrl, } from './config.js';
 import { ProjectNotConfiguredError, resolveProject, } from './project-resolver.js';
@@ -123,3 +123,3 @@ /**
                 ``,
-                PROJECT_URL_GUIDANCE,
+                PROJECT_URL_FOR_A_USER,
             ]
@@ -126,0 +126,0 @@ .filter(Boolean)

dist/project-resolver.js

 import path from 'path';
 import { z } from 'zod';
-import { BASE_URL_UNRESOLVED_GUIDANCE, PROJECT_URL_GUIDANCE, normalizeHttpUrl, stripTrailingSlashes, } from './config.js';
+import { BASE_URL_UNRESOLVED_GUIDANCE, PROJECT_URL_FOR_A_USER, normalizeHttpUrl, stripTrailingSlashes, } from './config.js';
 import { ProjectMapUnreadableError, projectMapPath, readProjectEntry, } from './project-map.js';
@@ -72,3 +72,8 @@ import { projectCommand } from './cli-launch.js';
         `To record the target with the code instead — versioned, and shared with everyone who clones it — add a ${COMMITTED_CONFIG_FILE} holding {"projectUrl": "..."} in the application's own folder. ` +
-        `${PROJECT_URL_GUIDANCE} FORMIO_PROJECT_URL in the server environment supplies one too, but it is the weakest source: a ${COMMITTED_CONFIG_FILE} or a mapping overrides it.`, 
+        // Which record wins is not this message's business. It is asked of a person for
+        // ONE value, and precedence — that the environment supplies a project too and is the
+        // weakest of the three — is a rule the agent already has from the server's own
+        // instructions at connect time. Carried here it lengthened, by a third, the message
+        // every skill relays verbatim to the user.
+        PROJECT_URL_FOR_A_USER, 
     // Carried structurally as well as in the prose: the reporting caller renders its
@@ -75,0 +80,0 @@ // own message and would otherwise have to parse this one back out.

package.json

 {
   "name": "@formio/mcp",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "mcpName": "io.form/formio-mcp",
@@ -5,0 +5,0 @@ "description": "Form.io MCP Server",

README.md

@@ -22,3 +22,3 @@ ## Formio MCP server
 | --- | --- | --- |
-| stdio | `npx -y @formio/mcp@0.12.0` (or `node dist/stdio.js`) | Claude Code, Claude Desktop, Cursor, VS Code, Codex, Windsurf, Cline — anything that speaks MCP over stdio |
+| stdio | `npx -y @formio/mcp@0.12.1` (or `node dist/stdio.js`) | Claude Code, Claude Desktop, Cursor, VS Code, Codex, Windsurf, Cline — anything that speaks MCP over stdio |
 
@@ -36,3 +36,3 @@ There is no HTTP or SSE transport. The server's only HTTP listener is the temporary browser-login page described under [Authentication](#authentication), which carries no MCP traffic.
       "command": "npx",
-      "args": ["-y", "@formio/mcp@0.12.0"],
+      "args": ["-y", "@formio/mcp@0.12.1"],
       "env": {
@@ -292,3 +292,3 @@ "FORMIO_PROJECT_URL": "https://your-project.form.io"
 
-<sub>\* Not at startup — the server starts, lists every tool, and answers `hello` without it; only the tools that read or write Form.io data error, naming `project_set` and this variable. The alternative is the `project_set` tool, which maps a working directory to a project in `~/.formio/projects.json`. Resolution runs by scope, narrowest first: a committed `formio.json` found by walking up from the caller's `cwd`, then the mapping for that `cwd`, then `FORMIO_PROJECT_URL` in the environment as the weakest source, then the error. Map a directory before any client connects with `npx -y @formio/mcp@0.12.0 project set --project-url <url> --cwd <path>` — the deployment is derived from the project URL wherever it can be, so add `--base-url <url>` only when the server says it cannot be determined. `project get --cwd <path>` prints what resolves and which source won. It exits `0` when it resolved, `1` when nothing is mapped for that directory, `2` when the command could not answer (a usage error, a malformed URL, an unreadable `~/.formio/projects.json`), and `3` when a project resolved but its Base URL could not be determined — so a caller can tell "nothing here yet" from "this failed" from "half configured, and here is the one value missing". `project set --cwd <path>` exits `0` when the directory is ready to serve a call, `1` when a named value is still missing, `2` when the command could not answer, and `3` when the record WAS written and the directory still resolves no Base URL — a committed `formio.json` governs it and supplies none, so the remedy is an edit to that file rather than another write.</sub>
+<sub>\* Not at startup — the server starts, lists every tool, and answers `hello` without it; only the tools that read or write Form.io data error, naming `project_set` and this variable. The alternative is the `project_set` tool, which maps a working directory to a project in `~/.formio/projects.json`. Resolution runs by scope, narrowest first: a committed `formio.json` found by walking up from the caller's `cwd`, then the mapping for that `cwd`, then `FORMIO_PROJECT_URL` in the environment as the weakest source, then the error. Map a directory before any client connects with `npx -y @formio/mcp@0.12.1 project set --project-url <url> --cwd <path>` — the deployment is derived from the project URL wherever it can be, so add `--base-url <url>` only when the server says it cannot be determined. `project get --cwd <path>` prints what resolves and which source won. It exits `0` when it resolved, `1` when nothing is mapped for that directory, `2` when the command could not answer (a usage error, a malformed URL, an unreadable `~/.formio/projects.json`), and `3` when a project resolved but its Base URL could not be determined — so a caller can tell "nothing here yet" from "this failed" from "half configured, and here is the one value missing". `project set --cwd <path>` exits `0` when the directory is ready to serve a call, `1` when a named value is still missing, `2` when the command could not answer, and `3` when the record WAS written and the directory still resolves no Base URL — a committed `formio.json` governs it and supplies none, so the remedy is an edit to that file rather than another write.</sub>
 
@@ -295,0 +295,0 @@ ---

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

370257

0.83%

Lines of code

6251

0.82%

No dependency changes