Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

com.furrowforms/furrow-forms

REMOTE · API.FURROWFORMS.COM · 2 COMPONENTS · SCANNED SEP 20

Form backend an agent runs end to end: provision forms, snippets, spam, signed webhooks.

+3 this week 89 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security97
Transport & Reachability100
Schema Quality & AI Usability79
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 7416 tokens (~224/item across 33 items; 27 tools + 6 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management57
  • Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 27 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Install

How do I install the com.furrowforms/furrow-forms MCP server?

com.furrowforms/furrow-forms is a hosted endpoint at https://api.furrowforms.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · api.furrowforms.com

# add to Claude Code
claude mcp add --transport http com-furrowforms-furrow-forms 'https://api.furrowforms.com/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "com-furrowforms-furrow-forms": {
      "url": "https://api.furrowforms.com/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "com-furrowforms-furrow-forms": {
      "type": "http",
      "url": "https://api.furrowforms.com/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.com-furrowforms-furrow-forms]
url = "https://api.furrowforms.com/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-furrowforms-furrow-forms": {
      "type": "remote",
      "url": "https://api.furrowforms.com/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-furrowforms-furrow-forms --url 'https://api.furrowforms.com/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  com-furrowforms-furrow-forms:
    url: "https://api.furrowforms.com/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "com-furrowforms-furrow-forms": {
      "Transport": "http",
      "Url": "https://api.furrowforms.com/mcp"
    }
  }
}
# add to Vellum
assistant mcp add com-furrowforms-furrow-forms -t streamable-http -u 'https://api.furrowforms.com/mcp'
// mcp.json
{
  "mcpServers": {
    "com-furrowforms-furrow-forms": {
      "type": "http",
      "url": "https://api.furrowforms.com/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 9 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Schema Quality & AI Usability rose 1.

  • 7 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

  • 5 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Probed https://api.furrowforms.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=api.furrowforms.com CN=WE1,O=Google Trust Services,C=US 18 Aug 2026 16 Nov 2026 ECDSA 256 ECDSA-SHA256 19a2f143d01dfadd0e67536500baabec
SANs: api.furrowforms.com
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of api.furrowforms.com. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
furrowforms.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer resource_metadata="https://api.furrowforms.com/.well-known/oauth-protected-resource/mcp", scope="openid profile email offline_access"

Bearer resource_metadata="https://api.furrowforms.com/.well-known/oauth-protected-resource/mcp", scope="openid profile email offline_access"
Header Value
strict-transport-security max-age=15552000; includeSubDomains
content-security-policy default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin

Protected resource metadata

Document https://api.furrowforms.com/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://api.furrowforms.com/mcp
Authorisation server https://api.furrowforms.com/api/auth

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://api.furrowforms.com/mcp Verified 200
http (plaintext) http://api.furrowforms.com/mcp HTTPS enforced 301 https://api.furrowforms.com/mcp
MCP tools · 27 exposed · ~7,287 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
archive_client ~49

Use to archive a client. Do not use this as a hard delete. There is no unarchive tool in v1.

NameTypeReqDescription
client_idstringyesClient id from list_clients or create_client.

No output schema declared.

No examples provided.

archive_form ~49

Use to archive a form so public submit returns 404. Do not use this as a hard delete.

NameTypeReqDescription
form_idstringyesForm id from list_forms, create_form, or bootstrap_site.

No output schema declared.

No examples provided.

archive_project ~62

Use to archive a website. Archived projects reject public submit. Do not use this as a hard delete. There is no unarchive tool in v1.

NameTypeReqDescription
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.

No output schema declared.

No examples provided.

bootstrap_site ~1,078

Use this to stand up a client, one website (project), and its forms in a single call. name/slug are the client; optional project_name/project_slug default to the same. Free accounts cannot create a fourth active project — call create_upgrade_link if bootstrap_site returns plan_limit. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Idempotent on client, project, and form slugs. Site settings (domains, Turnstile, notify emails, webhook, email templates, uploads) live on the project. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromE…

NameTypeReqDescription
allowed_domainsarrayHostnames allowed to post to this project's forms (example.com, www.example.com). Empty accepts any origin.
default_redirect_urlWhere classic HTML posts redirect after success. Null returns JSON/inline success instead.
emailobjectNotification email template for the project: subject, from_name, intro, footer_mode, include_meta.
formsarrayForms to create or update on the site, matched by slug. Re-running is safe.
from_nameLegacy From display name. Prefer email.from_name.
honeypot_fieldstringName of the hidden honeypot input the snippet emits. Defaults to _gotcha.
namestringyesClient (company) display name.
notify_emailsarrayAddresses that receive each clean submission (max 10). Inherited by every form.
project_namestringWebsite display name. Defaults to the client name.
project_slugstringWebsite slug. Defaults to the client slug.
rate_limit_per_ipintegerMax submissions per IP within rate_limit_window_s.
rate_limit_window_sintegerRate-limit window in seconds (max 86400).
require_turnstilebooleanReject submissions that lack a valid Turnstile token.
slugstringyesLowercase hyphenated identifier, unique per team. Used for idempotent re-runs.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.
turnstile_secretCloudflare Turnstile secret used to verify tokens server-side. Null removes it.
turnstile_site_keyCloudflare Turnstile site key for the frontend widget. Null removes it.
upload_allowed_typesarrayAllowed upload MIME types, e.g. application/pdf or image/*.
upload_max_file_bytesintegerMax bytes per file (up to 25 MB).
upload_max_filesintegerMax files per submission (up to 20).
upload_max_total_bytesintegerMax total upload bytes per submission (up to 50 MB).
uploads_enabledbooleanAccept multipart file fields on this project's forms.
webhook_secretHMAC-SHA256 secret for the X-Furrow-Signature header. Omit to have one generated and returned.
webhook_urlPublic https endpoint that receives a signed JSON POST per clean submission. Null disables it.

No output schema declared.

No examples provided.

create_client ~184

Use to add a client (company) by slug. Idempotent on slug unless strict is true. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Prefer bootstrap_site when also creating a website and forms. Do not put Turnstile or webhooks on a client — those live on the project.

NameTypeReqDescription
namestringyesClient (company) display name.
slugstringyesLowercase hyphenated identifier, unique per team. Used for idempotent re-runs.
strictbooleanWhen true, fail if the slug already exists instead of returning the existing record.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

create_form ~480

Use to add a form under an existing project_id. Idempotent on slug unless strict is true. Overrides are nullable; omit them to inherit project notify emails, webhook, redirect, require_turnstile, and email templates. Pass email.subject / email.intro to override notification copy for this form only. Pass webhook_url_override to send this form to a different URL. Field contract labels (label) are used on notification emails. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet.

NameTypeReqDescription
emailobjectPer-form subject and intro overrides for the notification email.
field_contractDeclared fields (name, type, label, report). Drives get_snippet and the email layout. Null clears it.
namestringyesForm display name, e.g. Contact or Quote request.
notify_emails_overrideRecipients for this form only. Null inherits the project's notify_emails.
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.
redirect_url_overrideSuccess redirect for this form only. Null inherits default_redirect_url.
require_turnstile_overrideForce Turnstile on or off for this form. Null inherits the project setting.
slugstringyesLowercase hyphenated identifier, unique per project. Used for idempotent re-runs.
strictbooleanWhen true, fail if the slug already exists instead of returning the existing record.
webhook_secret_overrideHMAC secret for this form's webhook. Null inherits the project secret.
webhook_url_overrideWebhook endpoint for this form only. Null inherits the project webhook.

No output schema declared.

No examples provided.

create_project ~906

Use to add one website under an existing client_id. Idempotent on slug unless strict is true. Free accounts are limited to 3 active (non-archived) projects; yearly is unlimited. If create_project returns plan_limit, call create_upgrade_link and hand the human the Stripe URL. Prefer bootstrap_site when the client does not exist yet. Optional email sets notification templates (subject, from_name, intro, footer_mode, include_meta). Free accounts cannot set footer_mode off. Set uploads_enabled on the project to accept files. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. Do not put Turnstile keys on a form.

NameTypeReqDescription
allowed_domainsarrayHostnames allowed to post to this project's forms (example.com, www.example.com). Empty accepts any origin.
client_idstringyesClient id from list_clients or create_client.
default_redirect_urlWhere classic HTML posts redirect after success. Null returns JSON/inline success instead.
emailobjectNotification email template for the project: subject, from_name, intro, footer_mode, include_meta.
from_nameLegacy From display name. Prefer email.from_name.
honeypot_fieldstringName of the hidden honeypot input the snippet emits. Defaults to _gotcha.
namestringyesProject (website) display name.
notify_emailsarrayAddresses that receive each clean submission (max 10). Inherited by every form.
rate_limit_per_ipintegerMax submissions per IP within rate_limit_window_s.
rate_limit_window_sintegerRate-limit window in seconds (max 86400).
require_turnstilebooleanReject submissions that lack a valid Turnstile token.
slugstringyesLowercase hyphenated identifier, unique per client. Used for idempotent re-runs.
strictbooleanWhen true, fail if the slug already exists instead of returning the existing record.
turnstile_secretCloudflare Turnstile secret used to verify tokens server-side. Null removes it.
turnstile_site_keyCloudflare Turnstile site key for the frontend widget. Null removes it.
upload_allowed_typesarrayAllowed upload MIME types, e.g. application/pdf or image/*.
upload_max_file_bytesintegerMax bytes per file (up to 25 MB).
upload_max_filesintegerMax files per submission (up to 20).
upload_max_total_bytesintegerMax total upload bytes per submission (up to 50 MB).
uploads_enabledbooleanAccept multipart file fields on this project's forms.
webhook_secretHMAC-SHA256 secret for the X-Furrow-Signature header. Omit to have one generated and returned.
webhook_urlPublic https endpoint that receives a signed JSON POST per clean submission. Null disables it.

No output schema declared.

No examples provided.

create_upgrade_link ~390

Use when a free team is blocked on the 3-project, 100-submission, or one-workspace limit, or when a human should upgrade to yearly ($199/year) so you can keep adding projects, workspaces, and storing new submissions. Returns a Stripe Checkout URL to hand the human. If the team is already yearly, omit product to get a Stripe Customer Portal URL, or pass product=expansion for a $99/year pack that adds 5,000 submissions/month. Do not change plan in the database — Stripe webhooks do that. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace.

NameTypeReqDescription
productstringyearly starts the $199/year plan; expansion adds a $99/year 5,000-submission pack to a yearly team.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

get_account ~279

Use to read the team's plan, usage this month, limits, expansion_packs, retention_days, and branding. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use this to list projects — call list_projects.

NameTypeReqDescription
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

get_client ~46

Use to inspect one client. Do not use to list that client's sites — call list_projects with client_id.

NameTypeReqDescription
client_idstringyesClient id from list_clients or create_client.

No output schema declared.

No examples provided.

get_form ~126

Use to read a form plus resolved and inherited settings, including resolved.email and resolved.uploads. files_url is the private inbox folder for this form under the project inbox (do not put it in a public snippet). Turnstile always inherits from the project (inherited.turnstile is true). Form webhook_url_override is nullable; null means inherit the project webhook. Forms may override email.subject and email.intro only. Do not use to generate embed code — call get_snippet.

NameTypeReqDescription
form_idstringyesForm id from list_forms, create_form, or bootstrap_site.

No output schema declared.

No examples provided.

get_project ~259

Use to inspect one website's settings, domains, webhook URL, email templates, upload policy, plan, usage this month, limits, retention_days, and branding. Returns stored values plus resolved.email. Secrets are never returned. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Do not use to list forms — call list_forms.

NameTypeReqDescription
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.

No output schema declared.

No examples provided.

get_snippet ~304

Use after the form exists to get copy-paste html, astro, or next code that posts to /s/:publicKey. Do not invent a submit URL — this tool returns it. Snippets are single-value inputs; write checkbox groups and multi-selects yourself. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. After dropping the snippet, add visitor-facing success UI: a thank-you page plus default_redirect_url for classic HTML POST, or an on-page message when using fetch/{ok:true}. Do not leave visitors looking at JSON. See furrow://docs/submit-success.

NameTypeReqDescription
form_idstringyesForm id from list_forms, create_form, or bootstrap_site.
frameworkstringyesSnippet flavor: html (plain form), astro (component), or next (React client component).

No output schema declared.

No examples provided.

get_submission ~76

Use to read one stored submission by id, including file metadata and files_url (the form inbox). Do not use this for live submit tests — POST to /s/:publicKey instead. Do not expect signed bucket URLs — download from the inbox.

NameTypeReqDescription
submission_idstringyesSubmission id from list_submissions or a webhook payload.

No output schema declared.

No examples provided.

list_clients ~149

Use to browse clients (companies). Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use to list websites — call list_projects with client_id. Archived clients are hidden unless status=all or archived.

NameTypeReqDescription
cursorstringOpaque cursor from the previous page's next_cursor.
limitintegerPage size, max 100.
statusstringFilter by archive state. Defaults to active.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

list_forms ~179

Use to list forms. Pass project_id for one website or client_id for one company (team is inferred). Otherwise Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use to read resolved inheritance — call get_form.

NameTypeReqDescription
client_idstringOnly forms under this client's projects.
cursorstringOpaque cursor from the previous page's next_cursor.
limitintegerPage size, max 100.
project_idstringOnly forms in this project.
statusstringFilter by archive state. Defaults to active.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

list_projects ~176

Use to browse websites. Pass client_id to list one client's sites (team is inferred). Without client_id, Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use to read one project's settings — call get_project. Archived projects are hidden unless status=all or archived.

NameTypeReqDescription
client_idstringOnly projects under this client.
cursorstringOpaque cursor from the previous page's next_cursor.
limitintegerPage size, max 100.
statusstringFilter by archive state. Defaults to active.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

list_submissions ~217

Use to inspect recent posts. Available on free and yearly. Pass project_id or form_id to infer the team; omit both and Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Free teams prune submissions after 30 days; yearly after 730 days. Do not use to read a single submission — call get_submission.

NameTypeReqDescription
cursorstringOpaque cursor from the previous page's next_cursor.
form_idstringOnly submissions to this form.
limitintegerPage size, max 100.
project_idstringOnly submissions in this project.
sincestringISO 8601 timestamp; only submissions created after this instant.
spamstringWhich submissions to return. Defaults to clean.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

list_teams ~96

Use to see workspaces this token can act on. A team-scoped frw_ token returns that team only. An operator token or an MCP OAuth login returns every team you belong to — pass team_id on list_clients, create_client, and bootstrap_site. Creating another workspace is dashboard-only after signing in and requires a yearly plan; free accounts stay on one team. Do not use this to list clients — call list_clients.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

rotate_project_inbox ~67

Use when a project's private inbox URL may have leaked. Issues a new inbox key; every previously shared inbox link stops working immediately. get_project returns the new files_url.

NameTypeReqDescription
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.

No output schema declared.

No examples provided.

test_webhook ~87

Use to POST a signed webhook.test event to the project's webhook URL. Available on free and yearly. Do not use this to inspect past deliveries — that is REST GET /api/projects/:id/webhook-deliveries. Fails if no webhook URL and secret are set.

NameTypeReqDescription
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.

No output schema declared.

No examples provided.

update_account ~348

Use to rename the workspace or set branding. Free accounts cannot set branding.mode or email.footer_mode to anything but furrow — those writes are ignored. Yearly may set branding.mode to furrow, off, or agency (name + optional link + optional logo; Furrow keeps the layout, no raw HTML). Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use this to change the plan — call create_upgrade_link.

NameTypeReqDescription
brandingobjectAccount-wide branding for notification emails and hosted pages.
namestringNew workspace display name.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

update_client ~61

Use to rename a client. Do not use this to change domains, Turnstile, or webhooks — call update_project.

NameTypeReqDescription
client_idstringyesClient id from list_clients or create_client.
namestringNew client display name.

No output schema declared.

No examples provided.

update_form ~493

Use to patch form overrides. Pass null on an override to inherit again. Set email.subject or email.intro to override project notification copy for this form only; from_name, footer_mode, and include_meta stay on the project. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Set webhook_url_override to override the project webhook for this form. Do not use this to change Turnstile keys — those live on the project. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet.

NameTypeReqDescription
emailobjectPer-form subject and intro overrides for the notification email.
field_contractDeclared fields (name, type, label, report). Drives get_snippet and the email layout. Null clears it.
form_idstringyesForm id from list_forms, create_form, or bootstrap_site.
namestringNew form display name.
notify_emails_overrideRecipients for this form only. Null inherits the project's notify_emails.
redirect_url_overrideSuccess redirect for this form only. Null inherits default_redirect_url.
require_turnstile_overrideForce Turnstile on or off for this form. Null inherits the project setting.
webhook_secret_overrideHMAC secret for this form's webhook. Null inherits the project secret.
webhook_url_overrideWebhook endpoint for this form only. Null inherits the project webhook.

No output schema declared.

No examples provided.

update_project ~852

Use to patch website settings. Nested email sets notification templates: email.subject, email.from_name, email.intro, email.footer_mode (furrow | minimal | off), email.include_meta. Optional branding updates the team (mode furrow | off | agency on yearly only; ignored on free except furrow). Set uploads_enabled and upload_allowed_types here — forms inherit them. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. Null Turnstile or webhook fields clear them. Do not use this to create forms. Updating project keys changes resolved settings on existing forms unless a form override is set.

NameTypeReqDescription
allowed_domainsarrayReplace the allowed hostnames. Empty array accepts any origin.
brandingobjectPer-project branding override for notification emails and hosted pages.
default_redirect_urlWhere classic HTML posts redirect after success. Null returns JSON/inline success instead.
emailobjectNotification email template for the project: subject, from_name, intro, footer_mode, include_meta.
from_nameLegacy From display name. Prefer email.from_name.
honeypot_fieldstringName of the hidden honeypot input the snippet emits. Defaults to _gotcha.
namestringNew project display name.
notify_emailsarrayReplace the notification recipients (max 10).
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.
rate_limit_per_ipintegerMax submissions per IP within rate_limit_window_s.
rate_limit_window_sintegerRate-limit window in seconds (max 86400).
require_turnstilebooleanReject submissions that lack a valid Turnstile token.
turnstile_secretCloudflare Turnstile secret used to verify tokens server-side. Null removes it.
turnstile_site_keyCloudflare Turnstile site key for the frontend widget. Null removes it.
upload_allowed_typesarrayAllowed upload MIME types, e.g. application/pdf or image/*.
upload_max_file_bytesintegerMax bytes per file (up to 25 MB).
upload_max_filesintegerMax files per submission (up to 20).
upload_max_total_bytesintegerMax total upload bytes per submission (up to 50 MB).
uploads_enabledbooleanAccept multipart file fields on this project's forms.
webhook_secretHMAC-SHA256 secret for the X-Furrow-Signature header. Omit to have one generated and returned.
webhook_urlPublic https endpoint that receives a signed JSON POST per clean submission. Null disables it.

No output schema declared.

No examples provided.

update_team ~136

Use to rename a team. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use this to create another workspace — that is dashboard-only and requires yearly. For plan, usage, retention, and branding, call get_account / update_account. Do not use this to change clients or projects.

NameTypeReqDescription
namestringyesNew team (workspace) display name.
team_idstringTeam id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

No output schema declared.

No examples provided.

upsert_project_webhook ~138

Use to set or replace the project webhook URL. Available on free and yearly. A signing secret is generated once if the project has none. Forms inherit this unless webhook_url_override is set. Do not use this for a one-off delivery — call test_webhook.

NameTypeReqDescription
project_idstringyesProject (website) id from list_projects, create_project, or bootstrap_site.
webhook_secretHMAC-SHA256 secret for X-Furrow-Signature. Omit to have one generated and returned.
webhook_urlyesPublic https endpoint that receives a signed JSON POST per clean submission. Null disables it.

No output schema declared.

No examples provided.

Common questions

What is the com.furrowforms/furrow-forms MCP server?

com.furrowforms/furrow-forms is an MCP server listed in the public MCP registry as com.furrowforms/furrow-forms. Form backend an agent runs end to end: provision forms, snippets, spam, signed webhooks. This page covers its hosted endpoint (https://api.furrowforms.com/mcp).

Is the com.furrowforms/furrow-forms MCP server safe to use?

com.furrowforms/furrow-forms scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the com.furrowforms/furrow-forms MCP server expose?

com.furrowforms/furrow-forms exposes 27 tools: list_teams, update_team, get_account, update_account, create_upgrade_link, and 22 more. Their descriptions and schemas cost roughly 7,287 tokens of context every time the server is loaded.

Does the com.furrowforms/furrow-forms MCP server require authentication?

Yes. com.furrowforms/furrow-forms asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the com.furrowforms/furrow-forms MCP server still maintained?

com.furrowforms/furrow-forms is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.