ShipMyForm
REMOTE · SHIPMYFORM.COM · SCANNED SEP 30
Create form endpoints for any site, get paste-ready markup, and read submission stats.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 29 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability73
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2017 tokens (~69/item across 29 items; 29 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage77
- 90% of tools have a non-trivial description (not blank, and not just the tool's name).Partial
- 52% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "revoke_api_key" implies "revoke" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
How do I install the ShipMyForm MCP server?
ShipMyForm is a hosted endpoint at https://shipmyform.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · shipmyform.com
claude mcp add --transport http com-shipmyform-shipmyform 'https://shipmyform.com/api/mcp'
{
"mcpServers": {
"com-shipmyform-shipmyform": {
"url": "https://shipmyform.com/api/mcp"
}
}
} {
"servers": {
"com-shipmyform-shipmyform": {
"type": "http",
"url": "https://shipmyform.com/api/mcp"
}
}
} [mcp_servers.com-shipmyform-shipmyform] url = "https://shipmyform.com/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-shipmyform-shipmyform": {
"type": "remote",
"url": "https://shipmyform.com/api/mcp",
"enabled": true
}
}
} openclaw mcp add com-shipmyform-shipmyform --url 'https://shipmyform.com/api/mcp' --transport streamable-http
mcp_servers:
com-shipmyform-shipmyform:
url: "https://shipmyform.com/api/mcp" {
"McpServers": {
"com-shipmyform-shipmyform": {
"Transport": "http",
"Url": "https://shipmyform.com/api/mcp"
}
}
} assistant mcp add com-shipmyform-shipmyform -t streamable-http -u 'https://shipmyform.com/api/mcp'
{
"mcpServers": {
"com-shipmyform-shipmyform": {
"type": "http",
"url": "https://shipmyform.com/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 30 Sept 26 +28
- Authorization: fail → unverified ▼ security
- Transport: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Tool coverage: unverified → 90 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 0 functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 52 functional
- First check of Schema quality: good functional
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 21 Sept 26 33
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 30 Sept 2026 · Probed https://shipmyform.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=shipmyform.com | CN=WE1,O=Google Trust Services,C=US | 30 Aug 2026 | 28 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 742493236a20c40b0ed72bc0ace2db13 |
| SANs: shipmyform.com, *.shipmyform.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of shipmyform.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| shipmyform.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://shipmyform.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://shipmyform.com/api/mcp | HTTPS enforced | 302 | https://shipmyform.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_connector Add a connector ~111
Route a form's submissions somewhere: email, webhook, Slack, Discord, Airtable, HubSpot, Telegram and more. Get the config fields from list_connector_types. OAuth connectors (Google Sheets, Notion) must be added in the dashboard.
| Name | Type | Req | Description |
|---|---|---|---|
| config | object | yes | Field values keyed by the config field names |
| formId | string | yes | Form id, e.g. frm_abc123 |
| type | string | yes | Connector type from list_connector_types, e.g. 'slack' |
No output schema declared.
No examples provided.
create_api_key Create an API key ~115
Mint another API key for this workspace (shown once), optionally narrower than this one. A key can never grant scopes it does not itself hold, so this is the safe way to hand a limited key to another agent.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| preset | string | – | Named scope bundle: full (everything), wiring (forms only, no submission access), readonly, triage |
| scopes | array | – | Explicit scopes, instead of a preset. Ignored where it would exceed the calling key's own scopes. |
No output schema declared.
No examples provided.
create_form Create a form ~100
Create a form and get its endpoint plus a paste-ready HTML snippet. Email notifications to the account owner are set up automatically. Works on every plan.
| Name | Type | Req | Description |
|---|---|---|---|
| allowedDomains | array | – | Sites allowed to submit, e.g. ['example.com']. Empty = any. |
| name | string | yes | Human-readable form name, e.g. 'Contact form' |
| purpose | string | – | What the form is for, in a sentence. Helps the spam classifier. |
No output schema declared.
No examples provided.
delete_form Delete form ~36
Delete a form; its endpoint stops accepting submissions.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
No output schema declared.
No examples provided.
delete_submissions Delete submissions ~25
Permanently delete submissions (and their files).
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | – |
No output schema declared.
No examples provided.
export_submissions Export submissions as CSV ~57
All of a form's submissions (up to 2,000) as CSV text, optionally filtered by status.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
| status | string | – | – |
No output schema declared.
No examples provided.
get_account Get account ~25
The account's email, verification state, plan, limits, usage and dashboard URL.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_billing_portal Billing portal link ~27
A self-service billing portal URL: change plan, update the card, cancel.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_form Get form ~38
A form's full configuration, connectors and hosted-page status.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
No output schema declared.
No examples provided.
get_form_snippet Get form snippet ~61
A copy-paste form snippet for a framework (html, react, vue, or fetch) wired to the form's endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
| framework | string | – | – |
No output schema declared.
No examples provided.
get_submission Get a submission ~25
One submission with spam signals and delivery history.
| Name | Type | Req | Description |
|---|---|---|---|
| submissionId | string | yes | – |
No output schema declared.
No examples provided.
get_submission_stats Get submission stats ~48
Delivered / spam-held / flagged counts for a form, plus workspace quota usage. Works on every plan.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
No output schema declared.
No examples provided.
label_submissions Classify submissions ~68
Mark submissions as spam, ok (not spam) or flagged. spam/ok also teach the classifier, so your judgement improves future filtering. This is how you triage in your own environment: list, decide, label.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | – |
| label | string | yes | – |
No output schema declared.
No examples provided.
list_api_keys List API keys ~18
API keys on this workspace (metadata only).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_connector_types List connector types ~29
Every destination submissions can be routed to, with the config fields each needs and which plan it requires.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_connectors List a form's connectors ~39
Connectors on a form with their status and last error.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
No output schema declared.
No examples provided.
list_forms List forms ~18
The workspace's forms with their public endpoint URLs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_submissions List submissions ~170
Read submissions across the workspace or for one form, with filters (status, date range, text search, country, attachments, failed deliveries) and paging. Spam is excluded unless status is 'spam'. Requires a paid plan.
| Name | Type | Req | Description |
|---|---|---|---|
| countries | array | – | ISO 3166 alpha-2 codes |
| deliveryFailed | boolean | – | – |
| formId | string | – | Form id, e.g. frm_abc123 |
| hasFiles | boolean | – | – |
| limit | integer | – | – |
| offset | integer | – | – |
| q | string | – | Free-text search across field values |
| since | string | – | ISO date; received on/after |
| sort | string | – | – |
| status | string | – | – |
| until | string | – | ISO date; received before |
No output schema declared.
No examples provided.
publish_hosted_page Publish a hosted form page ~70
Publish a standalone page for the form on shipmyform.com (no website needed) and get its URL plus an embed script. Uses the designed page if one exists, otherwise a default email + message form.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
No output schema declared.
No examples provided.
remove_connector Remove a connector ~13
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| connectorId | string | yes | – |
No output schema declared.
No examples provided.
resend_verification_code Resend the verification code ~24
Email a fresh 6-digit verification code to the account's address.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
revoke_api_key Revoke an API key ~35
Revoke a key by id. The key in use on this connection cannot revoke itself.
| Name | Type | Req | Description |
|---|---|---|---|
| keyId | string | yes | – |
No output schema declared.
No examples provided.
set_connector_active Enable or disable a connector ~21
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | yes | – |
| connectorId | string | yes | – |
No output schema declared.
No examples provided.
sign_up Create an account ~169
Start a ShipMyForm account from an email address, with no browser. A 6-digit code is emailed to the address; verify_account with { email, code } then returns the API key. Works without authentication. Also works for an existing account (the code approves API access).
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Your name, e.g. 'Claude Code', shown in the verification email. |
| string | yes | The user's email address. Ask for it; never invent one. | |
| preset | string | – | Named scope bundle: full (everything), wiring (forms only, no submission access), readonly, triage |
| scopes | array | – | Explicit scopes, instead of a preset. Ignored where it would exceed the calling key's own scopes. |
| workspaceName | string | – | – |
No output schema declared.
No examples provided.
start_upgrade Start a paid plan ~55
Get a hosted checkout URL for the Starter or Pro plan. Payment is completed by a person on that page; the plan activates automatically afterwards (check with get_account).
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | – |
| plan | string | yes | – |
No output schema declared.
No examples provided.
test_connector Test a connector ~28
Send a test delivery through a connector and report the result.
| Name | Type | Req | Description |
|---|---|---|---|
| connectorId | string | yes | – |
No output schema declared.
No examples provided.
unpublish_hosted_page Unpublish the hosted page ~26
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | Form id, e.g. frm_abc123 |
No output schema declared.
No examples provided.
update_form Update form settings ~196
Change any subset of a form's settings: name, purpose, allowedDomains, redirectUrl, spamMode, active, storeSubmissions, validation rules, blocklist, autoResponder (Pro).
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| allowedDomains | array | – | – |
| autoResponder | object | – | – |
| blocklist | array | – | Emails, @domains or keywords that mark a submission as spam |
| formId | string | yes | Form id, e.g. frm_abc123 |
| name | string | – | – |
| purpose | – | – | – |
| redirectUrl | – | – | Absolute URL visitors are sent to after submitting |
| spamMode | string | – | – |
| storeSubmissions | boolean | – | – |
| validation | – | – | Server-side rules by field, e.g. { "email": { "required": true, "type": "email" }, "message": { "minLength": 10 } }. null clears. |
No output schema declared.
No examples provided.
verify_account Verify the account email ~135
Prove the address with the 6-digit code emailed by sign_up. Without a key on the connection, pass the email too: on success this returns the API key (shown once). Turns on email notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | – |
| code | string | yes | – |
| string | – | Required when not yet connected with a key | |
| preset | string | – | Named scope bundle: full (everything), wiring (forms only, no submission access), readonly, triage |
| scopes | array | – | Explicit scopes, instead of a preset. Ignored where it would exceed the calling key's own scopes. |
No output schema declared.
No examples provided.
What is the ShipMyForm MCP server?
ShipMyForm is an MCP server listed in the public MCP registry as com.shipmyform/shipmyform. Create form endpoints for any site, get paste-ready markup, and read submission stats. This page covers its hosted endpoint (https://shipmyform.com/api/mcp).
Is the ShipMyForm MCP server safe to use?
ShipMyForm scores 61 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ShipMyForm MCP server expose?
ShipMyForm exposes 29 tools: sign_up, verify_account, resend_verification_code, get_account, create_api_key, and 24 more. Their descriptions and schemas cost roughly 1,782 tokens of context every time the server is loaded.
Does the ShipMyForm MCP server require authentication?
No. We connected to ShipMyForm without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the ShipMyForm MCP server still maintained?
ShipMyForm is still listed as active in the MCP registry. We last reached this channel on 30 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.