Back to Browse

Formvault MCP Server

Developer ToolsModerate7.8MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Create and manage GDPR-compliant, EU-hosted forms from any MCP-compatible AI assistant.

About

Create and manage GDPR-compliant, EU-hosted forms from any MCP-compatible AI assistant.

Remote endpoints: streamable-http: https://api.formvault.eu/mcp

Security Report

7.8
Moderate7.8Low Risk

FormVault is a legitimate form-builder MCP server that authenticates with a per-user API key from an environment variable or bearer header, with no hardcoded secrets and no standing credentials. The main concern is that list_submissions returns respondents' decrypted personal data into the AI model's context, which is disclosed and gated by tool descriptions but still warrants user caution. Remaining issues are low-severity hardening gaps in the HTTP wrapper and minor code quality items. Package verification found 1 issue.

12 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

network_listen

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

FormVault API key (fv_...), created at https://formvault.eu/app/api-keysRequired

Environment variable: FORMVAULT_API_KEY

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

FormVault MCP server

npm License: MIT

Create and manage GDPR-compliant, EU-hosted forms from any MCP-compatible AI assistant.

This is an MCP server for FormVault, a form builder hosted in Germany. Point Claude, ChatGPT, Cursor, Copilot or any MCP-compatible assistant at your FormVault account and build forms by describing them.

Prerequisites

A FormVault account and an API key. Create the key at formvault.eu/app/api-keys.

Setup (hosted — recommended)

Add the hosted server to your assistant's MCP configuration — no install, no local process:

{
  "mcpServers": {
    "formvault": {
      "url": "https://api.formvault.eu/mcp",
      "headers": {
        "Authorization": "Bearer fv_your_key_here"
      }
    }
  }
}

Claude Desktop's support for remote/header-based MCP servers depends on your version — check its current docs if the above doesn't show up as an option.

No tool takes a tenant id. The API key carries its own, so it cannot read or write another organisation's forms — and a form id it may not touch reports as not found rather than forbidden, so a key cannot be used to discover what exists. The server itself holds no standing credentials of its own; every request is scoped to whichever key you send. Revoke a key at any time from the API keys page.

Setup (npx / stdio)

For clients that don't yet support a remote/header-based server:

{
  "mcpServers": {
    "formvault": {
      "command": "npx",
      "args": ["-y", "@formvault/mcp"],
      "env": {
        "FORMVAULT_API_KEY": "fv_your_key_here"
      }
    }
  }
}

Restart your assistant and ask for what you need, for example:

  • "Build me a client intake form with a GDPR consent checkbox."
  • "List my forms and tell me which have no fields yet."
  • "Delete the test form I made earlier."
VariableRequiredDefault
FORMVAULT_API_KEYyes—
FORMVAULT_API_URLnohttps://api.formvault.eu

Self-hosting / local development

You can run this package yourself, either as a local stdio server or as your own HTTP deployment. It is a client of the FormVault API, so it still needs a FormVault account and API key:

npm install
npm run build

# stdio (for a local Claude Desktop/Code config using "command"/"args")
FORMVAULT_API_KEY=fv_... node dist/index.js

# HTTP (what the hosted deployment runs)
PORT=3003 FORMVAULT_API_URL=https://api.formvault.eu node dist/httpServer.js

To develop against a local FormVault API, point FORMVAULT_API_URL at it (for example http://localhost:3000).

Tools

ToolWhat it does
list_formsEvery form in your account, with field counts
get_formOne form's full field and settings definition
create_formBuild a form from a description
delete_formRemove a form (irreversible)
list_submissionsDecrypted responses for a form

About respondent data

list_submissions returns your respondents' personal data in the clear. It is described to the model with an instruction not to call it unless you explicitly ask for responses, so ordinary form-building work never pulls it into context.

That is a deliberate boundary, not a limitation. FormVault stores submissions encrypted with AES-256-GCM on servers in Nuremberg, Germany, with a signed DPA on every plan. Whatever you send to your AI provider is your decision — this server's job is to make sure it is a decision rather than a side effect.

Links

Support

Questions and bug reports: open an issue. Pull requests are welcome.

License

MIT

Reviews

No reviews yet

Be the first to review this server!