@formvault/mcp

An MCP server for FormVault — a GDPR-first form builder hosted entirely in the EU.

Point Claude, ChatGPT, Cursor, Copilot or any MCP-compatible assistant at your FormVault account and build forms by describing them.

Setup

Create an API key at formvault.eu/app/api-keys, then add the server to your assistant's MCP configuration:

{
  "mcpServers": {
    "formvault": {
      "command": "npx",
      "args": ["-y", "@formvault/mcp"],
      "env": {
        "FORMVAULT_API_KEY": "fv_your_key_here"
      }
    }
  }
}

Restart your assistant and ask for what you need — "build me a client intake form with a GDPR consent checkbox".

| Variable | Required | Default | | ------------------- | -------- | -------------------------- | | FORMVAULT_API_KEY | yes | — | | FORMVAULT_API_URL | no | https://api.formvault.eu |

Tools

| Tool | What it does | | ------------------ | --------------------------------------------- | | list_forms | Every form in your account, with field counts | | get_form | One form's full field and settings definition | | create_form | Build a form from a description | | delete_form | Remove a form (irreversible) | | list_submissions | Decrypted responses for a form |

No tool takes a tenant id. The API key carries its own, so it cannot read or write another organisation's forms — and a form id it may not touch reports as not found rather than forbidden, so a key cannot be used to discover what exists. Revoke a key at any time from the API keys page.

About respondent data

list_submissions returns your respondents' personal data in the clear. It is described to the model with an instruction not to call it unless you explicitly ask for responses, so ordinary form-building work never pulls it into context.

That is a deliberate boundary, not a limitation. FormVault stores submissions encrypted with AES-256-GCM on servers in Nuremberg, Germany, with no US sub-processors and a signed DPA on every plan. Whatever you send to your AI provider is your decision — this server's job is to make sure it is a decision rather than a side effect.

Links

• formvault.eu/mcp
• Data processing agreement
• Privacy