New:Socket for Asana Is Now Available.Learn more →
Get Started

@formio/mcp

Package Overview
Dependencies
Maintainers
7
Versions
21
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@formio/mcp - npm Package Compare versions

Comparing version
0.12.1
 to
0.12.2
+10
-4
dist/config.d.ts

@@ -14,4 +14,5 @@ export declare const DEFAULT_BASE_URL = "https://api.form.io";

* The prohibitions are not lost: they stay in PROJECT_URL_GUIDANCE, which the server's
* own instructions carry, so an agent with no skills installed still meets them at
* connect time — the surface they were written for.
* own instructions carry — and carry ALONE, so this text reaches no agent-only surface
* and that one reaches no user. An agent with no skills installed still meets the
* prohibitions at connect time, which is what they were written for.
*/

@@ -21,4 +22,9 @@ export declare const PROJECT_URL_FOR_A_USER: string;

* The same thing for an AGENT, with the rules that stop it building a URL rather than
* asking for one. Carried by the server's instructions and by the surfaces only a model
* reads — never by a report a user is shown; see PROJECT_URL_FOR_A_USER.
* asking for one. Carried by the server's instructions and by nothing else — never by a
* report a user is shown; see PROJECT_URL_FOR_A_USER.
*
* Neither text explains the base URL, and that is deliberate. It is derived from
* whichever project URL is about to be supplied, so guidance about it cannot be acted on
* before that answer exists — and carrying it here made a message asking for one value
* read as asking for two.
*/

@@ -25,0 +31,0 @@ export declare const PROJECT_URL_GUIDANCE: string;

+10
-12
dist/config.js
export const DEFAULT_BASE_URL = 'https://api.form.io';
// What a Project URL is, with an example per deployment kind. This is the guidance
// the unset-project error and the server's instructions carry, because the project
// URL is the one value a user is asked for.
//
// It deliberately does NOT explain the base URL. That value is derived from
// whichever project URL the user is about to supply, so guidance about it cannot be
// acted on before that answer exists — and carrying it here made a message asking
// for one value read as asking for two.
/**

@@ -22,4 +14,5 @@ * The Project URL, for the PERSON being asked for one.

* The prohibitions are not lost: they stay in PROJECT_URL_GUIDANCE, which the server's
* own instructions carry, so an agent with no skills installed still meets them at
* connect time — the surface they were written for.
* own instructions carry — and carry ALONE, so this text reaches no agent-only surface
* and that one reaches no user. An agent with no skills installed still meets the
* prohibitions at connect time, which is what they were written for.
*/

@@ -33,4 +26,9 @@ export const PROJECT_URL_FOR_A_USER = [

* The same thing for an AGENT, with the rules that stop it building a URL rather than
* asking for one. Carried by the server's instructions and by the surfaces only a model
* reads — never by a report a user is shown; see PROJECT_URL_FOR_A_USER.
* asking for one. Carried by the server's instructions and by nothing else — never by a
* report a user is shown; see PROJECT_URL_FOR_A_USER.
*
* Neither text explains the base URL, and that is deliberate. It is derived from
* whichever project URL is about to be supplied, so guidance about it cannot be acted on
* before that answer exists — and carrying it here made a message asking for one value
* read as asking for two.
*/

@@ -37,0 +35,0 @@ export const PROJECT_URL_GUIDANCE = [

+1
-1
package.json
{
"name": "@formio/mcp",
"version": "0.12.1",
"version": "0.12.2",
"mcpName": "io.form/formio-mcp",

@@ -5,0 +5,0 @@ "description": "Form.io MCP Server",

+3
-3
README.md

@@ -22,3 +22,3 @@ ## Formio MCP server

| --- | --- | --- |
| stdio | `npx -y @formio/mcp@0.12.1` (or `node dist/stdio.js`) | Claude Code, Claude Desktop, Cursor, VS Code, Codex, Windsurf, Cline — anything that speaks MCP over stdio |
| stdio | `npx -y @formio/mcp@0.12.2` (or `node dist/stdio.js`) | Claude Code, Claude Desktop, Cursor, VS Code, Codex, Windsurf, Cline — anything that speaks MCP over stdio |

@@ -36,3 +36,3 @@ There is no HTTP or SSE transport. The server's only HTTP listener is the temporary browser-login page described under [Authentication](#authentication), which carries no MCP traffic.

"command": "npx",
"args": ["-y", "@formio/mcp@0.12.1"],
"args": ["-y", "@formio/mcp@0.12.2"],
"env": {

@@ -292,3 +292,3 @@ "FORMIO_PROJECT_URL": "https://your-project.form.io"

<sub>\* Not at startup — the server starts, lists every tool, and answers `hello` without it; only the tools that read or write Form.io data error, naming `project_set` and this variable. The alternative is the `project_set` tool, which maps a working directory to a project in `~/.formio/projects.json`. Resolution runs by scope, narrowest first: a committed `formio.json` found by walking up from the caller's `cwd`, then the mapping for that `cwd`, then `FORMIO_PROJECT_URL` in the environment as the weakest source, then the error. Map a directory before any client connects with `npx -y @formio/mcp@0.12.1 project set --project-url <url> --cwd <path>` — the deployment is derived from the project URL wherever it can be, so add `--base-url <url>` only when the server says it cannot be determined. `project get --cwd <path>` prints what resolves and which source won. It exits `0` when it resolved, `1` when nothing is mapped for that directory, `2` when the command could not answer (a usage error, a malformed URL, an unreadable `~/.formio/projects.json`), and `3` when a project resolved but its Base URL could not be determined — so a caller can tell "nothing here yet" from "this failed" from "half configured, and here is the one value missing". `project set --cwd <path>` exits `0` when the directory is ready to serve a call, `1` when a named value is still missing, `2` when the command could not answer, and `3` when the record WAS written and the directory still resolves no Base URL — a committed `formio.json` governs it and supplies none, so the remedy is an edit to that file rather than another write.</sub>
<sub>\* Not at startup — the server starts, lists every tool, and answers `hello` without it; only the tools that read or write Form.io data error, naming `project_set` and this variable. The alternative is the `project_set` tool, which maps a working directory to a project in `~/.formio/projects.json`. Resolution runs by scope, narrowest first: a committed `formio.json` found by walking up from the caller's `cwd`, then the mapping for that `cwd`, then `FORMIO_PROJECT_URL` in the environment as the weakest source, then the error. Map a directory before any client connects with `npx -y @formio/mcp@0.12.2 project set --project-url <url> --cwd <path>` — the deployment is derived from the project URL wherever it can be, so add `--base-url <url>` only when the server says it cannot be determined. `project get --cwd <path>` prints what resolves and which source won. It exits `0` when it resolved, `1` when nothing is mapped for that directory, `2` when the command could not answer (a usage error, a malformed URL, an unreadable `~/.formio/projects.json`), and `3` when a project resolved but its Base URL could not be determined — so a caller can tell "nothing here yet" from "this failed" from "half configured, and here is the one value missing". `project set --cwd <path>` exits `0` when the directory is ready to serve a call, `1` when a named value is still missing, `2` when the command could not answer, and `3` when the record WAS written and the directory still resolves no Base URL — a committed `formio.json` governs it and supplies none, so the remedy is an edit to that file rather than another write.</sub>

@@ -295,0 +295,0 @@ ---