MCP server

The REST APIs (read and write) are for your own code. MCP is for handing an AI agent direct, structured, read-only access to a workspace so it can look up forms and submissions and answer questions about them inside whatever client you already use: Claude Desktop, Cursor, or your own agent runtime. It cannot change anything in your workspace.

Endpoint: https://agents.webforms.to. Transport is Streamable HTTP with JSON responses: JSON-RPC 2.0 over a single POST /. Supported protocol versions are 2025-06-18, 2025-03-26 and 2024-11-05; initialize answers with the version your client asks for, or the latest if it asks for one not listed. Authenticate with the same API key you would use for the REST API, as a bearer token or X-API-Key header.

{
  "mcpServers": {
    "webforms": {
      "url": "https://agents.webforms.to",
      "headers": {
        "Authorization": "Bearer wf_live_your_key"
      }
    }
  }
}

Create the key the same way as any other: Settings → API keys in the dashboard. A key created for MCP works for the REST APIs too and vice versa: scopes, not the transport, decide what it can do.

Each key can make 120 tool calls a minute. Every item in a JSON-RPC batch counts as one call, and a batch that does not fit in what is left of the minute is rejected as a whole with 429 and a Retry-After header.

Deliberately read-only. An API key handed to a language model should not be able to delete a form or change a plan, and a model that can only read cannot be talked into a destructive action by a prompt injected through a form submission, which is exactly the kind of content these tools return. To create or configure forms programmatically, use the write API directly.

Submission content is whatever a visitor typed into a public form, so get_submissions and search_submissions return each submission's data inside an <untrusted_submission id="..."> block, after a note telling the model to treat it as data and never follow instructions found in it.

• list_formsList the forms in this workspace with their submission and spam counts.limit (1-100, default 25)
• get_submissionsRead recent submissions for a form, newest first.formId (required), limit (1-50, default 20), includeSpam (default false)
• search_submissionsSearch submission content across every form in the workspace.query (required), limit (1-50, default 20)
• get_usageCurrent plan, submission quota and usage for this workspace.(none)
• get_statsSubmission counts for this workspace over the last N days.days (1-90, default 7)

Every tool call is scoped to the workspace the API key belongs to: there is no tool that accepts an organization id or a workspace parameter, so one customer's assistant cannot read another customer's submissions by guessing an id, and a prompt cannot talk it into trying.

The server answers a plain GET at the root with its own capabilities:

curl https://agents.webforms.to/

And a tool call is a standard MCP JSON-RPC request:

curl -X POST https://agents.webforms.to/ \
  -H "Authorization: Bearer wf_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "get_usage", "arguments": {}}}'