
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@usefillo/mcp
Advanced tools
Fillo MCP server — provision, scaffold, publish, and query forms from your coding agent.
The Fillo MCP server. It gives a coding agent the full Fillo loop — provision a workspace, scaffold a form into the host repo, publish it, and query its responses — without leaving the session, authenticated exactly like a human CLI user.
Claude Code:
claude mcp add fillo -- npx -y @usefillo/mcp
Cursor / VS Code / any MCP client: run npx -y @usefillo/mcp over stdio. Set
FILLO_API to point at a non-production deployment.
The server reads the same credentials the CLI writes to ~/.fillo/config.json,
or from the environment:
FILLO_TOKEN — a fcli_… login token (from npx @usefillo/cli login).
Authenticated tools (fillo_list_forms, publishing to a claimed workspace).FILLO_PK — a pk_… publishable key. fillo_provision_workspace mints one
and saves it for you.FILLO_API_KEY — a fsk_… workspace API key, minted in Settings →
Connections of a claimed workspace. Required by the response tools.FILLO_API — overrides the origin (default https://fillo.so).FILLO_CONFIG_DIR — overrides the config directory (default ~/.fillo).The server never prints login tokens, API keys, or claim tokens into the
transcript. The pk_ publishable key is safe to surface (it lives in browser
code), so fillo_provision_workspace returns it for you to wire into the app's
public env.
| Tool | Auth | What it does |
|---|---|---|
fillo_provision_workspace | none (needs an email) | Create an unclaimed preview workspace, return its pk_ key and caps, and email its claim link. |
fillo_whoami | login token or pk_ | Report the active credential and workspace. |
fillo_push_form | login token or pk_ | Create or update a form from a schema + handle. |
fillo_list_forms | login token | List the workspace's forms. |
fillo_get_form | none (published) | Fetch a published form's schema, theme, and capabilities. |
fillo_search_examples | none | Search the curated Fillo example library. |
fillo_docs | none | Fetch a Fillo docs page as Markdown by topic. |
fillo_list_responses | fsk_ API key | List a form's responses (claimed workspaces only). |
fillo_get_response | fsk_ API key | Fetch one response (claimed workspaces only). |
fillo_claim_status | pk_ | Report the provisioned workspace's caps and claim deadline. |
No destructive tools. Every tool is a thin wrapper over Fillo's public HTTP API — the server never touches the database and imports no app code, so workspace scoping, rate limits, and validation stay in one place.
MIT licensed.
FAQs
Fillo MCP server — provision, scaffold, publish, and query forms from your coding agent.
The npm package @usefillo/mcp receives a total of 481 weekly downloads. As such, @usefillo/mcp popularity was classified as not popular.
We found that @usefillo/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.