FormVault

io.github.terjetylPublished by GitHub account terjetylv0.1.2Updated Nov 4, 2026

Create and manage GDPR-compliant, EU-hosted forms from any MCP-compatible AI assistant.

VerifiedStreamable HTTPWeb executableProductivity & WorkflowBusiness & Commerce

Overview

AI-generated overview

FormVault MCP lets an AI assistant create, inspect and delete EU-hosted, GDPR-oriented forms and list their submissions in your FormVault account.

What you can do
  • List every form in the account with field counts, and read one form's full field and settings definition
  • Create a new form from a plain-language description
  • Delete a form permanently
  • List decrypted responses submitted to a form
When to use it
Useful when you build and maintain forms in FormVault and want to draft, review or clean them up by describing what you need in an assistant, for example a client intake form with a consent checkbox. Also handy for checking which forms are still empty.
Requirements
A FormVault account and an API key created in the FormVault dashboard. Hosted option: connect to the remote endpoint with an Authorization bearer header. Local option: run the npm package @formvault/mcp via npx with FORMVAULT_API_KEY set; FORMVAULT_API_URL optionally overrides the API base URL. Network access to the FormVault API.
Before you install
The API key (FORMVAULT_API_KEY or the Authorization bearer header) grants access to your organisation's forms, so keep it private and revoke it if exposed. delete_form is irreversible. list_submissions returns respondents' personal data in the clear, which may then be sent to your AI provider; only call it when you intend to. The server can create and delete data in your account.

Installation

In SourceWeft

  1. Open FormVault in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.terjetyl%2Fformvault/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "formvault": {
      "type": "http",
      "url": "https://api.formvault.eu/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

FormVault MCP server

[npm] [License: MIT]

Create and manage GDPR-compliant, EU-hosted forms from any MCP-compatible AI assistant.

This is an MCP server for FormVault, a form builder hosted in Germany. Point Claude, ChatGPT, Cursor, Copilot or any MCP-compatible assistant at your FormVault account and build forms by describing them.

Prerequisites

A FormVault account and an API key. Create the key at formvault.eu/app/api-keys.

Setup (hosted — recommended)

Add the hosted server to your assistant's MCP configuration — no install, no local process:

json
{  "mcpServers": {    "formvault": {      "url": "https://api.formvault.eu/mcp",      "headers": {        "Authorization": "Bearer fv_your_key_here"      }    }  }}

Claude Desktop's support for remote/header-based MCP servers depends on your version — check its current docs if the above doesn't show up as an option.

No tool takes a tenant id. The API key carries its own, so it cannot read or write another organisation's forms — and a form id it may not touch reports as not found rather than forbidden, so a key cannot be used to discover what exists. The server itself holds no standing credentials of its own; every request is scoped to whichever key you send. Revoke a key at any time from the API keys page.

Setup (npx / stdio)

For clients that don't yet support a remote/header-based server:

json
{  "mcpServers": {    "formvault": {      "command": "npx",      "args": ["-y", "@formvault/mcp"],      "env": {        "FORMVAULT_API_KEY": "fv_your_key_here"      }    }  }}

Restart your assistant and ask for what you need, for example:

  • "Build me a client intake form with a GDPR consent checkbox."
  • "List my forms and tell me which have no fields yet."
  • "Delete the test form I made earlier."
VariableRequiredDefault
FORMVAULT_API_KEYyes—
FORMVAULT_API_URLnohttps://api.formvault.eu

Self-hosting / local development

You can run this package yourself, either as a local stdio server or as your own HTTP deployment. It is a client of the FormVault API, so it still needs a FormVault account and API key:

bash
npm installnpm run build
# stdio (for a local Claude Desktop/Code config using "command"/"args")FORMVAULT_API_KEY=fv_... node dist/index.js
# HTTP (what the hosted deployment runs)PORT=3003 FORMVAULT_API_URL=https://api.formvault.eu node dist/httpServer.js

To develop against a local FormVault API, point FORMVAULT_API_URL at it (for example http://localhost:3000).

Tools

ToolWhat it does
list_formsEvery form in your account, with field counts
get_formOne form's full field and settings definition
create_formBuild a form from a description
delete_formRemove a form (irreversible)
list_submissionsDecrypted responses for a form

About respondent data

list_submissions returns your respondents' personal data in the clear. It is described to the model with an instruction not to call it unless you explicitly ask for responses, so ordinary form-building work never pulls it into context.

That is a deliberate boundary, not a limitation. FormVault stores submissions encrypted with AES-256-GCM on servers in Nuremberg, Germany, with a signed DPA on every plan. Whatever you send to your AI provider is your decision — this server's job is to make sure it is a decision rather than a side effect.

Links

Support

Questions and bug reports: open an issue. Pull requests are welcome.

License

MIT

Source: README.md at commit b460972

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v0.1.2LatestOct 21, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts