Sign inSign up

formio/uag

Verified Publisher

By Form.io

Updated about 1 month ago

The Form.io Universal Agent Gateway — an MCP server for agentic form automation with AI agents.

Image
Machine learning & AI
Developer tools
0

8.8K

formio/uag repository overview

Form.io Universal Agent Gateway (UAG)

The UAG uses the Model Context Protocol to let AI agents work with Form.io forms, resources, and workflows. It converts a Form JSON schema into an AI-readable markdown description — giving an agent the same understanding of a form that the JavaScript renderer gives a human — then validates and submits the result against the same rules the renderer enforces.

Also published as @formio/uag on npm and listed in the official MCP Registry as io.form/formio-uag.

What it enables

Conversation to a validated submission. An agent collects data through natural language and produces a deterministic, schema-valid Form.io submission — no bespoke parsing, and the form's own validation still applies.

Agentic workflows. An agent reads existing submission data plus your criteria, then contributes its own data and analysis back into the record — review steps, enrichment, triage, and similar automation driven by a form submission.

Quick start

Against a Form.io Open Source server:

docker run -d --name formio-uag -p 3200:3200 \
  -e PROJECT=https://forms.example.com \
  -e ADMIN_KEY=your-admin-key \
  -e JWT_SECRET=your-jwt-secret \
  -e BASE_URL=https://forms.example.com \
  -e LOGIN_FORM=https://forms.example.com/user/login \
  --restart unless-stopped \
  formio/uag

Against a Form.io Enterprise project, use PROJECT_KEY and UAG_LICENSE in place of ADMIN_KEY:

docker run -d --name formio-uag -p 3200:3200 \
  -e PROJECT=https://forms.example.com/myproject \
  -e PROJECT_KEY=your-project-api-key \
  -e UAG_LICENSE=your-license \
  -e JWT_SECRET=your-jwt-secret \
  -e BASE_URL=https://forms.example.com \
  --restart unless-stopped \
  formio/uag

Docker Compose is the recommended path for anything beyond a single container. Working stacks — including one that runs the UAG alongside a Form.io OSS server — are in the examples directory.

Connecting an agent

The MCP endpoint is http://<host>:<port>/mcp, served over Streamable HTTP (default port 3200).

Integrations run their own MCP client and connect outward to the UAG, so the UAG does not need to be publicly reachable for them — only reachable from the integration, such as over a private Docker network or localhost. The bundled Claude integration is published as formio/uag-claude.

Configuration

VariableDescription
PROJECTRequired. API endpoint of the Enterprise project or the OSS server.
JWT_SECRETRequired. Secret used to sign and validate the UAG's own JWTs. Need not match the Form.io server's.
BASE_URLRequired. The URL clients reach the UAG at. Published in the .well-known OIDC (PKCE) definitions and used for auth callbacks. Must be public when remote agents connect in; a private or localhost URL is fine for a local MCP client.
PROJECT_KEYEnterprise only. Project API key, from Project Settings → API Keys.
ADMIN_KEYOpen Source only. Used instead of PROJECT_KEY.
UAG_LICENSERequired to run against a Form.io Enterprise deployment.
PORTServer port. Default 3200.
PROJECT_TTLSeconds between project refreshes. Default 900; 0 disables refresh entirely. Values under 60 are not recommended — a refresh calls the project export API, which is expensive.
LOGIN_FORMURL of the login form JSON used by the browser login flow, so it must be reachable by that browser.
JWT_EXPIRE_TIMEJWT lifetime in seconds. Default 3600.
PORTAL_SECRETEnterprise only. Allows connecting from the Form.io Enterprise Portal.
MONGO / MONGO_CONFIGEnterprise only. Connect directly to MongoDB instead of routing submissions through the Form.io submission APIs.
CORSCORS domain, or JSON configuration for the cors module.
DEBUGDebug log filter, e.g. formio.*.
NODE_TLS_REJECT_UNAUTHORIZEDSet to 0 only when PROJECT is an HTTPS URL with a self-signed or otherwise untrusted certificate, which is common for local and internal deployments. Never set it on a deployment reachable from outside your network — it disables certificate verification for all outbound requests.

Treat every key, secret, and license as sensitive: supply them through an .env file or your platform's secret store rather than inline in a committed file.

Caching behaviour worth knowing

Forms and resources are cached and refreshed on the PROJECT_TTL interval, so a change to a form can take up to that long to appear to an agent. Set PROJECT_TTL=0 to disable refreshing entirely, in which case a restart is the only way to pick up changes.

Tag summary

Content type

Image

Digest

sha256:cb48301a6

Size

109.2 MB

Last updated

about 1 month ago

docker pull formio/uag

This week's pulls

Pulls:

131

Last week