# Superforms (remote · superforms.co)

Human-input bridge for AI agents with voice-first answer links, MCP tools, and HTTP APIs.

- Trust score: 25/100 (low)
- Change this week: −27
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `superforms.co`: 25/100 (this document), [markdown](https://verifymcp.io/servers/co-superforms-superforms/superforms.md), [page](https://verifymcp.io/servers/co-superforms-superforms/superforms)

## Channel facts

- Endpoint: `https://superforms.co/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint returned HTTP 402.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 4 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add --transport http co-superforms-superforms https://superforms.co/mcp
```

### Codex

```toml
[mcp_servers.co-superforms-superforms]
url = "https://superforms.co/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "co-superforms-superforms": {
      "type": "remote",
      "url": "https://superforms.co/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add co-superforms-superforms --url https://superforms.co/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  co-superforms-superforms:
    url: "https://superforms.co/mcp"
```

### Other

```json
{
  "mcpServers": {
    "co-superforms-superforms": {
      "type": "http",
      "url": "https://superforms.co/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 25, −35)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.23 → unverified
- [security regression] Transport: pass → fail
- [security] Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-08-01 (score 60, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “watch_ask” rewrote its description, which is the text the model reads
- [security] Tool “watch_my_form_responses” rewrote its description, which is the text the model reads

### 2026-07-31 (score 59, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 56, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 53, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 52, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 51)

First indexed and scored.

## MCP tools (11)

### `create_form` (~291 tokens)

Create Superforms Form

Create a voice-first form link that collects human answers and pipes responses back to the agent.

Input parameters:

- `context` (string): Private context for smart follow-ups. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
- `creationSessionUrl` (string)
- `followUpMode` (string): For exactly one question, set this only after asking the creator "Want smart follow-up questions?" Use deep_dive for yes or none for no. For multiple questions, use none unless explicitly requested.
- `goal` (string)
- `max_followups_per_question` (number): Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
- `max_total_questions` (number): Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
- `persistent` (boolean)
- `prompt` (string): Plain-English ask or request. Use only when explicit questions are not already known.
- `questionContext` (object)
- `questions` (array): Explicit questions to ask the respondent. Use this whenever questions already exist; preserve them exactly.
- `responseLimit` (string): Use "one" for a form intended for one named person/client. Use "multiple" for forms, surveys, feedback, customers, users, and public/embedded links.
- `responseMode` (string)
- `title` (string)

### `create_feedback_form` (~296 tokens)

Create Feedback Form

Create a voice-first feedback, cancellation, feature request, survey, or research form with optional smart follow-ups.

Input parameters:

- `context` (string): Private context for smart follow-ups. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
- `creationSessionUrl` (string)
- `followUpMode` (string): For exactly one question, set this only after asking the creator "Want smart follow-up questions?" Use deep_dive for yes or none for no. For multiple questions, use none unless explicitly requested.
- `goal` (string)
- `max_followups_per_question` (number): Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
- `max_total_questions` (number): Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
- `persistent` (boolean)
- `prompt` (string): Plain-English ask or request. Use only when explicit questions are not already known.
- `questionContext` (object)
- `questions` (array): Explicit questions to ask the respondent. Use this whenever questions already exist; preserve them exactly.
- `responseLimit` (string): Use "one" for a form intended for one named person/client. Use "multiple" for forms, surveys, feedback, customers, users, and public/embedded links.
- `responseMode` (string)
- `title` (string)

### `create_ask` (~294 tokens)

Create Superforms Ask

Create a voice-first Superforms answer link for human input. Backward-compatible alias for create_form.

Input parameters:

- `context` (string): Private context for smart follow-ups. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
- `creationSessionUrl` (string)
- `followUpMode` (string): For exactly one question, set this only after asking the creator "Want smart follow-up questions?" Use deep_dive for yes or none for no. For multiple questions, use none unless explicitly requested.
- `goal` (string)
- `max_followups_per_question` (number): Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
- `max_total_questions` (number): Optional compatibility setting. Omit for adaptive one-question smart follow-ups.
- `persistent` (boolean)
- `prompt` (string): Plain-English ask or request. Use only when explicit questions are not already known.
- `questionContext` (object)
- `questions` (array): Explicit questions to ask the respondent. Use this whenever questions already exist; preserve them exactly.
- `responseLimit` (string): Use "one" for a form intended for one named person/client. Use "multiple" for forms, surveys, feedback, customers, users, and public/embedded links.
- `responseMode` (string)
- `title` (string)

### `join_creation_session` (~65 tokens)

Join Superforms Creation Session

Join a Superforms homepage creation handoff session before creating the real form. Pass agentName with the client name, such as Codex, Claude Code, Claude, ChatGPT, or Cursor.

Input parameters:

- `agentName` (string)
- `creationSessionUrl` (string, required)

### `update_creation_session` (~202 tokens)

Update Superforms Draft

Update a homepage creation handoff draft with the current form title, questions, and settings before the user clicks Set live.

Input parameters:

- `context` (string): Private smart-follow-up context. Summarize relevant non-sensitive host-conversation context and append any extra context the creator provides. Never shown to respondents.
- `creationSessionUrl` (string, required)
- `followUpMode` (string)
- `goal` (string)
- `max_followups_per_question` (number): Use 0 by default. Use 1 only when smart follow-ups are explicitly requested.
- `max_total_questions` (number): Use 20 for deep-dive interviews.
- `questions` (array): Current draft questions to show in the live form preview.
- `responseLimit` (string): Use one for a named person/client. Use multiple for feedback forms, surveys, customers, users, and public links.
- `responseMode` (string)
- `title` (string)

### `get_responses` (~54 tokens)

Get Superforms Responses

Fetch persisted raw responses for a Superforms ask. This is the MCP equivalent of the HTTP bridge answers endpoint.

Input parameters:

- `agentToken` (string, required)
- `askId` (string, required)
- `since` (string)

### `list_asks` (~27 tokens)

List Superforms Asks

List recent asks for a provided private agent token.

Input parameters:

- `agentToken` (string, required)

### `watch_ask` (~113 tokens)

Watch Superforms Ask

Return as soon as an individual answer is saved, including answers received while an agent was reconnecting and while the form remains in progress. Use since for durable per-answer catch-up; the HTTP bridge also exposes an SSE stream endpoint.

Input parameters:

- `agentToken` (string, required)
- `askId` (string)
- `since` (string): ISO timestamp cursor from the last response the agent processed.
- `timeoutMs` (number): Maximum wait in milliseconds, capped at 120000.
- `url` (string, required)

### `list_my_forms` (~27 tokens)

List My Superforms

List forms owned by the connected Superforms account, including response counts and latest response timestamps.

### `get_my_form_responses` (~53 tokens)

Get My Form Responses

Read persisted raw responses for a form owned by the connected Superforms account. No per-form agent token is required.

Input parameters:

- `askId` (string, required)
- `since` (string): Optional ISO timestamp cursor.

### `watch_my_form_responses` (~74 tokens)

Watch My Form Responses

Return any existing individual answers immediately, or wait briefly until the respondent saves their next answer, even while the form remains in progress.

Input parameters:

- `askId` (string, required)
- `since` (string): Optional ISO timestamp cursor.
- `timeoutMs` (number): Maximum wait in milliseconds, capped at 120000.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/co-superforms-superforms/superforms#diagnostics

## Score history

- 2026-08-03: 25
- 2026-08-02: 60
- 2026-08-01: 60
- 2026-07-31: 59
- 2026-07-30: 56
- 2026-07-29: 53
- 2026-07-28: 53
- 2026-07-27: 52
- 2026-07-26: 51

## Links

- Remote endpoint: https://superforms.co/mcp
- Repository: https://github.com/brentgilmore/superforms-v2
- Changelog RSS feed: https://verifymcp.io/servers/co-superforms-superforms/superforms/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/co-superforms-superforms/superforms/changelog.json
- HTML version of this page: https://verifymcp.io/servers/co-superforms-superforms/superforms