formhausCAUTION
JSON form definition for React, Vue, Figma and AI agents: validation, conditional fields, multi-step and branching in one file. Zero-dependency core, MCP server, JSON Schema.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@formhaus/core) [](https://www.npmjs.com/package/@formhaus/react) [](https://www.npmjs.com/package/@formhaus/vue) [](https://www.npmjs.com/package/@formhaus/mcp) [](https://bundlejs.com/?q=@formhaus/core) [](LICENSE)
Formhaus is a JSON form definition with a zero-dependency engine, React and Vue renderers, a Figma plugin, a JSON Schema and an MCP server for AI agents. One file describes fields, validation, conditional fields, multi-step navigation, branching routes and skippable steps.
Example · Packages · Install · Quick start · Custom components · Figma plugin · [Docs](https://formhaus.dev) · [Spec](https://formhaus.dev/spec.html) · [Playground](https://formhaus.dev/playground.html)
What it's for
- Multi-step forms with branching in React or Vue.
- Rendering a form from JSON with your own components.
- Designing the form in Figma from the same file.
- Generating and checking definitions with AI agents: Claude Code skills, the MCP server (
claude plugin marketplace add ignsm/formhaus && claude plugin install formhaus@formhaus), the JSON Schema and the format specification. - A [he
73395a9f4b11OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp -- npx -y @formhaus/[email protected]
Exposed tools (8)
6 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
capabilities | read | |
example_definitions | read | |
get_submissions | read | |
list_forms | read | |
publish_form | write | |
simulate_path | read | |
update_form_settings | write | |
validate_definition | read |
Trust audit
CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (20)
.claude/skills/formhaus-create-form
.claude/skills/formhaus-figma-connect
import basicForm from '../../../../examples/definitions/basic-form.json';
import conditionalFields from '../../../../examples/definitions/conditional-fields.json';
import multiStep from '../../../../examples/definitions/multi-step.json';
import validation from '../../../../examples/definitions/validation.json';
import AppTsx from '../../../../../examples/react-mui/src/App.tsx?raw';
const { isError, body } = await call('update_form_settings', { form_id: 'f1', webhook_url: 'http://10.0.0.1' });"code": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
"code": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
"name": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
"name": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
"rating": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
const binary = atob(body);
@codemirror/commands, @codemirror/lang-json, @codemirror/language, @codemirror/state, @codemirror/view, @formhaus/core, @formhaus/vue, @lezer/highlight
@formhaus/core, @formhaus/react, next, react, react-dom, @types/node, @types/react, @types/react-dom
@formhaus/core, @formhaus/vue, nuxt, vue, vue-router, typescript, vue-tsc
@formhaus/core, @formhaus/react, @mui/material, @emotion/react, @emotion/styled, react, react-dom, @types/react
@formhaus/core, @formhaus/react, react, react-dom, @types/react, @types/react-dom, @vitejs/plugin-react, typescript
mask?: string; // Input mask pattern (shown as placeholder, custom components get full access)
Gates applied: no_behavioural_pass.
73395a9f4b11full audit observations/trust-audit/mcp-server/ignsm__formhaus.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 73395a9f4b11 | CAUTION | B | 86 | first audit |
Questions
What is the formhaus MCP server?
JSON form definition for React, Vue, Figma and AI agents: validation, conditional fields, multi-step and branching in one file. Zero-dependency core, MCP server, JSON Schema.
What tools does formhaus expose?
8 in total: 6 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is formhaus safe to connect to an agent?
With care. The audit graded it B (86/100) and found 20 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does formhaus need?
It reads FORMHAUS_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does formhaus run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @formhaus/vue at 0.9.0.
How current is this page?
The grade is for one exact copy of the source (73395a9f4b11), read on 2026-10-11. The repository is watched and re-audited when it changes.