Preflight — the Form.io MCP server

Before your first Form.io tool call, check that the Form.io MCP tools are available to you — form_list, form_create, project_import, project_set.

If they are missing, stop and connect the server before doing anything else. Load the formio-mcp-setup skill and follow it; it writes the MCP configuration for every client and tells the user how to reload. If that skill is not installed either, tell the user:

I have no Form.io tools, so the Form.io MCP server isn't connected. Run npx skills add formio/ai to get the setup skill, or add the server to your agent's MCP configuration as npx -y @formio/mcp.

Do not work around missing tools by making direct HTTP requests against a Form.io deployment, and do not write code that does. This library documents the whole Form.io REST surface, which makes hand-rolling requests tempting and wrong — it bypasses the guardrails the tools enforce and can write to a live deployment unreviewed. Stop and report what is blocking instead.

Overview

formio-auth is the stand-alone skill for everything authentication and authorization in Form.io. It covers how a user proves identity (Resource login, SSO, Token Swap, Custom JWT, email token), how Form.io carries that identity on the wire (x-jwt-token header, JWT payload, jti Session ID), and how that identity gates access at three scopes (project, form definition, submission data) and through two access models (role-based and group-based).

The skill is documentation-only. It does not emit template.json. When a configuration depends on resources, roles, or forms, this skill points to formio-resource-planner, which owns the canonical JSON shapes for roles, the Login Action, the Role Assignment Action, the Group Assignment Action, access arrays, submissionAccess arrays, and field-based submissionAccess on group-reference selects.

When to use this

Activate formio-auth when the user is asking about identity, sessions, or access control inside a Form.io project. Sample triggers: