Superforms

REMOTE · SUPERFORMS.CO · SCANNED AUG 3

Human-input bridge for AI agents with voice-first answer links, MCP tools, and HTTP APIs.

Available components

−27 this week 25 25 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →

Endpoint Security63

The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. View diagnostics → Unverified
HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail

Transport & Reachability0

Transport check failed: declared streamable-http, but the endpoint returned HTTP 402. See how to fix → View diagnostics → Fail

Schema Quality & AI Usability0

Schema not yet verified: we couldn't read the endpoint's schema.Unverified

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage0

Tool coverage not yet verified: we couldn't read the endpoint's tools.Unverified

Capabilities0

Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified

Unverified: 4 categories

Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

remote · superforms.co

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add --transport http co-superforms-superforms https://superforms.co/mcp

# ~/.codex/config.toml

[mcp_servers.co-superforms-superforms]
url = "https://superforms.co/mcp"

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "co-superforms-superforms": {
      "type": "remote",
      "url": "https://superforms.co/mcp",
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add co-superforms-superforms --url https://superforms.co/mcp --transport streamable-http

# ~/.hermes/config.yaml

mcp_servers:
  co-superforms-superforms:
    url: "https://superforms.co/mcp"

// mcp.json

{
  "mcpServers": {
    "co-superforms-superforms": {
      "type": "http",
      "url": "https://superforms.co/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 −35
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: 0.23 → unverified ▼ security
- Transport: pass → fail ▼ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
1 Aug 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “watch_ask” rewrote its description, which is the text the model reads security
- Tool “watch_my_form_responses” rewrote its description, which is the text the model reads security
31 Jul 26 +3
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 +3
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
28 Jul 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
27 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
26 Jul 26 51

First indexed and scored.

Show 5 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Probed https://superforms.co/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject	Issuer	Valid from	Valid until	Key	Signature	Serial
CN=superforms.co	CN=YR1,O=Let's Encrypt,C=US	20 Jul 2026	18 Oct 2026	RSA 2048	SHA256-RSA	578c586784fba210fda10f877df0dcf2291
SANs: superforms.co
CN=YR1,O=Let's Encrypt,C=US (CA)	CN=Root YR,O=ISRG,C=US	3 Sept 2025	2 Sept 2028	RSA 2048	SHA256-RSA	a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA)	CN=ISRG Root X1,O=Internet Security Research Group,C=US	13 May 2026	2 Sept 2032	RSA 4096	SHA256-RSA	f24b6d17f9d9ad7cb1c9fea78782699f

DNSSEC insecure

Validation of superforms.co. — Not signed

Zone	DS	Keys	Algorithms	Outcome
.	trust_anchor	20326, 38696	8, 8	Verified
co.	present	7786	8	Verified
superforms.co.	absent			Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation

Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result	No authorisation required
HTTP status	402

Header	Value
strict-transport-security	max-age=63072000

Transports 2 probes

Transport	URL	Outcome	Status	Location
streamable-http	https://superforms.co/mcp	HTTP error	402
http (plaintext)	http://superforms.co/mcp	HTTPS enforced	308	https://superforms.co/mcp

MCP tools — 11 exposed · ~1,496 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

create_ask Create Superforms Ask ~294

Create a voice-first Superforms answer link for human input. Backward-compatible alias for create_form.

Input Output Examples

Name	Type	Req	Description
context	string	—	Private context for smart follow-ups. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
creationSessionUrl	string	—	—
followUpMode	string	—	For exactly one question, set this only after asking the creator "Want smart follow-up questions?" Use deep_dive for yes or none for no. For multiple questions, use none unless explicitly requested.
goal	string	—	—
max_followups_per_question	number	—	Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
max_total_questions	number	—	Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
persistent	boolean	—	—
prompt	string	—	Plain-English ask or request. Use only when explicit questions are not already known.
questionContext	object	—	—
questions	array	—	Explicit questions to ask the respondent. Use this whenever questions already exist; preserve them exactly.
responseLimit	string	—	Use "one" for a form intended for one named person/client. Use "multiple" for forms, surveys, feedback, customers, users, and public/embedded links.
responseMode	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

create_feedback_form Create Feedback Form ~296

Create a voice-first feedback, cancellation, feature request, survey, or research form with optional smart follow-ups.

Input Output Examples

Name	Type	Req	Description
context	string	—	Private context for smart follow-ups. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
creationSessionUrl	string	—	—
followUpMode	string	—	For exactly one question, set this only after asking the creator "Want smart follow-up questions?" Use deep_dive for yes or none for no. For multiple questions, use none unless explicitly requested.
goal	string	—	—
max_followups_per_question	number	—	Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
max_total_questions	number	—	Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
persistent	boolean	—	—
prompt	string	—	Plain-English ask or request. Use only when explicit questions are not already known.
questionContext	object	—	—
questions	array	—	Explicit questions to ask the respondent. Use this whenever questions already exist; preserve them exactly.
responseLimit	string	—	Use "one" for a form intended for one named person/client. Use "multiple" for forms, surveys, feedback, customers, users, and public/embedded links.
responseMode	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

create_form Create Superforms Form ~291

Create a voice-first form link that collects human answers and pipes responses back to the agent.

Input Output Examples

Name	Type	Req	Description
context	string	—	Private context for smart follow-ups. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
creationSessionUrl	string	—	—
followUpMode	string	—	For exactly one question, set this only after asking the creator "Want smart follow-up questions?" Use deep_dive for yes or none for no. For multiple questions, use none unless explicitly requested.
goal	string	—	—
max_followups_per_question	number	—	Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
max_total_questions	number	—	Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
persistent	boolean	—	—
prompt	string	—	Plain-English ask or request. Use only when explicit questions are not already known.
questionContext	object	—	—
questions	array	—	Explicit questions to ask the respondent. Use this whenever questions already exist; preserve them exactly.
responseLimit	string	—	Use "one" for a form intended for one named person/client. Use "multiple" for forms, surveys, feedback, customers, users, and public/embedded links.
responseMode	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

get_my_form_responses Get My Form Responses ~53

Read persisted raw responses for a form owned by the connected Superforms account. No per-form agent token is required.

Input Output Examples

Name	Type	Req	Description
askId	string	yes	—
since	string	—	Optional ISO timestamp cursor.

No output schema declared.

No examples provided.

get_responses Get Superforms Responses ~54

Fetch persisted raw responses for a Superforms ask. This is the MCP equivalent of the HTTP bridge answers endpoint.

Input Output Examples

Name	Type	Req	Description
agentToken	string	yes	—
askId	string	yes	—
since	string	—	—

No output schema declared.

No examples provided.

join_creation_session Join Superforms Creation Session ~65

Join a Superforms homepage creation handoff session before creating the real form. Pass agentName with the client name, such as Codex, Claude Code, Claude, ChatGPT, or Cursor.

Input Output Examples

Name	Type	Req	Description
agentName	string	—	—
creationSessionUrl	string	yes	—

No output schema declared.

No examples provided.

list_asks List Superforms Asks ~27

List recent asks for a provided private agent token.

Input Output Examples

Name	Type	Req	Description
agentToken	string	yes	—

No output schema declared.

No examples provided.

list_my_forms List My Superforms ~27

List forms owned by the connected Superforms account, including response counts and latest response timestamps.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

update_creation_session Update Superforms Draft ~202

Update a homepage creation handoff draft with the current form title, questions, and settings before the user clicks Set live.

Input Output Examples

Name	Type	Req	Description
context	string	—	Private smart-follow-up context. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
creationSessionUrl	string	yes	—
followUpMode	string	—	—
goal	string	—	—
max_followups_per_question	number	—	Use 0 by default. Use 1 only when smart follow-ups are explicitly requested.
max_total_questions	number	—	Use 20 for deep-dive interviews.
questions	array	—	Current draft questions to show in the live form preview.
responseLimit	string	—	Use one for a named person/client. Use multiple for feedback forms, surveys, customers, users, and public links.
responseMode	string	—	—
title	string	—	—

No output schema declared.

No examples provided.

watch_ask Watch Superforms Ask ~113

Return as soon as an individual answer is saved, including answers received while an agent was reconnecting and while the form remains in progress. Use since for durable per-answer catch-up; the HTTP bridge also exposes an SSE stream endpoint.

Input Output Examples

Name	Type	Req	Description
agentToken	string	yes	—
askId	string	—	—
since	string	—	ISO timestamp cursor from the last response the agent processed.
timeoutMs	number	—	Maximum wait in milliseconds, capped at 120000.
url	string	yes	—

No output schema declared.

No examples provided.

watch_my_form_responses Watch My Form Responses ~74

Return any existing individual answers immediately, or wait briefly until the respondent saves their next answer, even while the form remains in progress.

Input Output Examples

Name	Type	Req	Description
askId	string	yes	—
since	string	—	Optional ISO timestamp cursor.
timeoutMs	number	—	Maximum wait in milliseconds, capped at 120000.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug

Day	Score
26 Jul	51
27 Jul	52
28 Jul	53
29 Jul	53
30 Jul	56
31 Jul	59
1 Aug	60
2 Aug	60
3 Aug	25