The Fillo MCP server. It gives a coding agent the full Fillo loop — provision a workspace, scaffold a form into the host repo, publish it, and query its responses — without leaving the session, authenticated exactly like a human CLI user.

Install

One click, if your editor supports it:

Claude Code:

claude mcp add fillo -- npx -y @usefillo/mcp

Any other MCP client: run npx -y @usefillo/mcp over stdio. Set FILLO_API to point at a non-production deployment.

Credentials

The server reads the same credentials the CLI writes to ~/.fillo/config.json, or from the environment:

• FILLO_TOKEN — a fcli_… login token (from npx @usefillo/cli login). Authenticated tools (fillo_list_forms, fillo_publish_form, and trusted pushes to a claimed workspace), plus local project selection with an ordinary login. File-request pushes remain draft/staged for review.
• FILLO_PK — a pk_… publishable key. fillo_provision_workspace mints one and saves it for you.
• FILLO_API_KEY — a fsk_… project API key, minted in Settings → Connections of a claimed workspace. Required by the response tools.
• FILLO_API — overrides the origin (default https://fillo.so).
• FILLO_CONFIG_DIR — overrides the config directory (default ~/.fillo).

The server never prints login tokens, API keys, or claim tokens into the transcript. The pk_ publishable key is safe to surface (it lives in browser code), so fillo_provision_workspace returns it for you to wire into the app's public env. Provisioning also makes that temporary project the active local MCP context, so an older saved account login cannot receive the next push. Selecting a project switches the context back to the account.

Tools

| Tool | Auth | What it does | | --- | --- | --- | | fillo_provision_workspace | none (needs an email) | Create an unclaimed preview workspace, return its pk_ key and caps, and email its claim link. | | fillo_whoami | login token or pk_ | Report the active credential, workspace, and project. | | fillo_list_projects | ordinary login token | List projects in the current workspace and mark the current selection. | | fillo_create_project | ordinary login token | Create and select an isolated project and save its pk_ key. | | fillo_select_project | ordinary login token | Select by id, slug, or unique exact name and update local project state. | | fillo_push_form | login token or pk_ | Create or update a form and publish by default; set publish: false with a login token for explicit review workflows. Storage-blocked file requests remain draft. | | fillo_publish_form | login token | Take a draft or staged changes live after review; return the exact storage setup link when blocked. | | fillo_list_forms | login token | List the project's forms. | | fillo_get_form | none (published) | Fetch a published form's schema, theme, and capabilities. | | fillo_search_examples | none | Search the curated Fillo example library. | | fillo_docs | none | Fetch a Fillo docs page as Markdown by topic. | | fillo_list_responses | login token or fsk_ key | List a form's accepted responses (claimed workspaces only). | | fillo_search_library / fillo_get_library_form | none | Search and read the public form library. | | fillo_get_response | fsk_ API key | Fetch one response (claimed workspaces only). | | fillo_response_summary | fsk_ API key | Summarize a form's responses without reading every row (claimed workspaces only). | | fillo_claim_status | pk_ | Report the provisioned workspace's caps and claim deadline. |

Managing a claimed workspace

Everything a member can do in the Fillo dashboard also has a tool, under the SAME NAME the hosted Fillo MCP server uses — one name, one capability, whichever server your agent reached. Each one calls the HTTP route the Fillo CLI calls: your fcli_ login token when you have one (npx @usefillo/cli login or FILLO_TOKEN), otherwise an fsk_ project API key in FILLO_API_KEY carrying the named scope. With both, the login token wins — a key has no acting human.

| Area | Tools | Scope | | --- | --- | --- | | Form lifecycle | fillo_pull_form, fillo_rename_form, fillo_duplicate_form, fillo_unpublish_form, fillo_discard_changes, fillo_delete_form, fillo_list_versions | forms:read, forms:write | | Uploads | fillo_get_storage, fillo_set_storage, fillo_list_drive_folders, fillo_set_drive_folder, fillo_reset_drive_folder | storage:manage | | Settings | fillo_get_settings, fillo_update_settings | settings:manage (plus forms:write for the presentation keys) | | Destinations | fillo_get_integration, fillo_enable_integration, fillo_disable_integration, fillo_list_connections, fillo_select_connection, fillo_disconnect_integration, fillo_remove_connection_account, fillo_rename_discord_channel, fillo_hubspot_properties, fillo_hubspot_pipelines | integrations:manage | | Responses and delivery | fillo_list_held_responses, fillo_release_responses, fillo_delete_response, fillo_delivery_status, fillo_retry_deliveries, fillo_redeliver_responses, fillo_list_drafts, fillo_form_insights, fillo_list_respondents, fillo_delete_respondent | responses:manage, respondents:*; fillo_form_insights needs forms:read and responses:read | | Webhooks | fillo_list_webhooks, fillo_add_webhook, fillo_update_webhook, fillo_remove_webhook | webhooks:manage | | Workspace | fillo_rename_workspace, fillo_rename_project, fillo_get_branding, fillo_set_branding, fillo_list_members, fillo_invite_member, fillo_change_member_role, fillo_remove_member | workspace:manage, members:manage | | Credentials | fillo_list_tokens, fillo_revoke_token, fillo_list_sync_tokens, fillo_create_sync_token, fillo_revoke_sync_token, fillo_list_api_keys, fillo_revoke_api_key, fillo_list_agents, fillo_revoke_agent | workspace:manage | | Developer settings | fillo_get_code_sync_policy, fillo_set_code_sync_policy, fillo_get_origins, fillo_set_origins, fillo_identity_status, fillo_enable_identity, fillo_disable_identity | workspace:manage |

fillo_delete_form, fillo_get_branding, fillo_set_branding, fillo_list_api_keys, and fillo_revoke_api_key need a login token — there is no project-API-key route for them, so a leaked key can never enumerate or revoke the workspace's credentials. fillo_delete_response needs one too, for a different reason: its scoped route takes no typed confirmation, so on a project API key the confirmation would be checked only by the caller, which is no confirmation at all.

A webhook's target URL is a credential — the path of a Zapier catch hook or an n8n webhook is what authorizes posting to it — so fillo_delivery_status names destinations without spelling them out: connector-owned hooks come back as "Zapier" or "n8n", and other webhooks as their host plus a short fingerprint of the path. Read the full URL in the dashboard's Activity page.

The human layer

Routine, reversible actions run on the credential alone. Two kinds do not:

• Outward — unpublishing, starting a third-party destination, adding a webhook, releasing or re-sending responses, inviting a member or changing a role, a code-sync policy, the allowed origins, or identity verification. These take confirm: true, and the tool refuses without it with a message telling the model to ask a person first. Nothing has changed when it refuses. Publishing is the exception on this server: fillo_push_form and fillo_publish_form take no confirm, because a login token IS the person who ran fillo login on this machine — the same reason fillo publish runs without a flag. The hosted OAuth server, where the grant belongs to an agent rather than to you, is what gates publishing behind an approval link.
• Destructive — deleting a form, a response, or a respondent, removing a member or an integration account, disconnecting a provider or a Discord server, revoking a token, sync token, API key, or MCP grant, turning identity verification off. These take confirm as a string that must equal the target exactly — a member's email, a token id, a response id — and the server compares it, so a guess is a 409 that quotes the value to retry with.

A secret Fillo mints once (a webhook signing secret, an fsync_ token, an identity-verification secret) is returned in that one tool result and never again. Store it in a secret manager; it is never written to a log.

Write annotations use the conservative worst-case hint because a push can replace draft state and a publish can replace the public schema, and openWorldHint marks exactly the actions whose effect leaves the workspace. Every tool is a thin wrapper over Fillo's public HTTP API — the server never touches the database and imports no app code, so workspace scoping, rate limits, authorization, and validation stay in one place.

The three project tools are local-only and require the general token minted by fillo login. A project-specific handoff and a hosted remote-MCP OAuth grant remain pinned to the project a human approved. Selecting locally also clears cached preview and fsk_ state from the prior project; replace any FILLO_PK or FILLO_API_KEY environment overrides yourself.

Projects are sites/apps beneath one billed workspace. They isolate forms, publishable/API keys, allowed origins, respondent identities, and agent authority. Workspace membership, billing, storage connections, and usage totals remain shared.

Links

• Docs: fillo.so/docs
• Website: fillo.so

MIT licensed.