aoreshkov-oracle-formsCAUTION
MCP server that exposes Oracle Forms modules (.fmb/.mmb/.pll/.olb) — blocks, triggers, PL/SQL, object XML — to AI assistants for legacy modernization and code review.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/aoreshkov/oracle-forms-mcp/actions/workflows/ci.yml) [](https://github.com/aoreshkov/oracle-forms-mcp/actions/workflows/codeql.yml) [](https://github.com/aoreshkov/oracle-forms-mcp/releases/latest) [](LICENSE) [](https://kotlinlang.org)
An MCP server that serves the content of Oracle Forms modules (.fmb forms, .mmb menus, .pll PL/SQL libraries, .olb object libraries) found in a directory, so AI assistants can inspect blocks, items, triggers, program units, and raw object XML without opening Forms Builder.
Built as a Kotlin Multiplatform core (pure @Serializable models and ports) with a JVM MCP server on top: declarative tool adapters over a single FormsService, stdio and HTTP transports, and a fingerprint-based on-disk cache. Oracle tool conversion feeds a streaming StAX parser that turns Forms XML into a structured index.
Why
Oracle Forms applications from the 1990s–2000s are still running critical business processes, but their logic is locked inside binary .fmb/.pll modules that only Forms Builder can open. That makes them opaque to modern AI tooling and painful to review, document, or migrate.
Oracle Forms MCP turns those modules into structured, queryable content so an AI assistant can:
- Understand a legacy app — enumerate blocks, items, triggers, and program units without a Forms IDE.
- Review & document PL/SQL — pull decoded trigger and program-unit bodies straight into the model's context.
- **Assist
6bb02de4702cOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add oracle-forms-mcp:0.6.0 -- docker run -i --rm ghcr.io/aoreshkov/oracle-forms-mcp:0.6.0:None /forms
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (8)
gradle-wrapper.jar
server --forms-dir /srv/forms --transport http --port 3000 # http://127.0.0.1:3000/mcp
* connect via `http://127.0.0.1:port/mcp`. Passing extra hosts *appends* to the localhost
log.i { "MCP Streamable HTTP endpoint on http://127.0.0.1:$port/mcp" }server --forms-dir C:\forms --transport http --port 3000 # endpoint: http://127.0.0.1:3000/mcp
val request = HttpRequest.newBuilder(URI("http://127.0.0.1:$port/slow"))You are a senior Kotlin compiler/tooling engineer who tracks Kotlin releases, Kotlin
Gates applied: no_behavioural_pass.
6bb02de4702cfull audit observations/trust-audit/mcp-server/aoreshkov__oracle-forms-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 6bb02de4702c | CAUTION | B | 89 | first audit |
Questions
What is the aoreshkov-oracle-forms MCP server?
MCP server that exposes Oracle Forms modules (.fmb/.mmb/.pll/.olb) — blocks, triggers, PL/SQL, object XML — to AI assistants for legacy modernization and code review.
Is aoreshkov-oracle-forms safe to connect to an agent?
With care. The audit graded it B (89/100) and found 8 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does aoreshkov-oracle-forms need?
No credential environment variables were found in its source, so it appears to need none.
How does aoreshkov-oracle-forms run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (6bb02de4702c), read on 2026-10-10. The repository is watched and re-audited when it changes.