Formstep MCP server

The hosted MCP server for Formstep. Collect verified customer information with one request.

Your agent sends a request to one customer, the recipient: a form in your brand and their language, prefilled with what you know, so they only confirm or correct it. They upload files, sign, book or pay on the same page, without an account. The answers come back under your field keys, with your external ID and, when the form has a decision question, an approve, decline or changes outcome. Your agent reads them with request_get, or Formstep calls your callback URL the moment the recipient submits.

The server lives at:

https://api.formstep.io/api/mcp

This repository holds documentation, example configs and a Grok Build plugin manifest. There is nothing to install or run.

• What an agent can do
• Connect your AI tool
• Try it
• Tools
• Limits
• Protocol details
• Docs
• Report a problem

What an agent can do

• Send requests. Ask one named person for information, with answers filled in or locked, and read what they answered.
• Build forms. Create a form and add, edit or remove its questions, pages and logic.
• Publish and share. Publish a form, create share links, translate it, and set its theme and settings.
• Read results. List a form's submissions and read its analytics.

Most AI tools sign in to Formstep with OAuth: you paste the URL, sign in to Formstep in the browser, and pick a workspace. Scripts and headless agents send an API token instead.

Connect your AI tool

Leave any client ID, secret or token field empty. The AI tool finds the Formstep sign-in page from the server and registers itself.

Claude Code

claude mcp add --transport http formstep https://api.formstep.io/api/mcp

Then type /mcp in Claude Code to sign in.

To share the server with everyone who works on a project, commit a .mcp.json to the project instead:

{
  "mcpServers": {
    "formstep": {
      "type": "http",
      "url": "https://api.formstep.io/api/mcp"
    }
  }
}

Claude desktop and claude.ai

Open Customize › Connectors › + › Add custom connector and paste the URL. A connector added on claude.ai also works in the desktop and mobile apps.

On Team and Enterprise, an owner adds the connector first under Organization settings › Connectors. Members then click Connect on it. On Free you can add one custom connector. Claude's own guide: Get started with custom connectors.

ChatGPT

Turn on developer mode under Settings › Apps › Advanced settings. Then open Settings › Apps › Create, paste the URL, choose OAuth, click Scan Tools, sign in to Formstep, and click Create.

Developer mode works on the web only. On Pro, ChatGPT can only read: tools that change something, such as sending a request or editing a form, need Business, Enterprise or Edu. On Business, only admins and owners can use developer mode. OpenAI's own guide: Developer mode and MCP apps in ChatGPT.

Cursor

Add this to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "formstep": {
      "url": "https://api.formstep.io/api/mcp"
    }
  }
}

Cline

Cline connects with an API token (see below for how to create one). Add this to Cline's cline_mcp_settings.json:

{
  "mcpServers": {
    "formstep": {
      "type": "streamableHttp",
      "url": "https://api.formstep.io/api/mcp",
      "headers": {
        "Authorization": "Bearer fs_YOUR_TOKEN"
      }
    }
  }
}

Or ask Cline to install it: llms-install.md has the steps it follows.

Grok Build

This repository is also a Grok Build plugin: .grok-plugin/plugin.json, the .mcp.json server config and one skill, formstep-requests. The plugin runs nothing on your machine. It calls one network endpoint, https://api.formstep.io/api/mcp, and signs in with Formstep OAuth, or with an API token you add as a header.

Other tools

Any tool that supports remote MCP servers with sign-in works the same way: look for where it adds a server by URL. The connect guide links each tool's own instructions.

Sign in and pick a workspace

The first time the agent uses Formstep, your AI tool opens a Formstep page in the browser. Sign in, pick the workspace, and click Authorize.

A connection reaches that one workspace only. To use another workspace, add Formstep a second time and pick the other one.

To check that it works, ask:

List my Formstep forms and whether each one is published.

To remove the connection, open OAuth and API Keys in the Formstep workspace sidebar. Under Connected apps, click the trash icon next to the connection and confirm with Disconnect.

Scripts and headless agents: use an API token

Anything that cannot open a browser, such as a script, a CI job or a headless agent, sends an API token as a header instead.

1. Open OAuth and API Keys in your workspace sidebar and click Create token (API tokens).
2. Copy the token. It starts with fs_.
3. Send it as an Authorization: Bearer header.

A token reaches exactly one workspace, like an OAuth connection. It expires 30 days after you create it and cannot be extended, so plan to replace it. Keep it out of git.

Claude Code, from the command line:

claude mcp add --transport http formstep https://api.formstep.io/api/mcp \
  --header "Authorization: Bearer fs_YOUR_TOKEN"

Or in a config file. This is .mcp.json for Claude Code; Cursor takes the same headers object in its mcp.json:

{
  "mcpServers": {
    "formstep": {
      "type": "http",
      "url": "https://api.formstep.io/api/mcp",
      "headers": {
        "Authorization": "Bearer fs_YOUR_TOKEN"
      }
    }
  }
}

Other tools take the same URL and header. See their documentation for where.

Try it

Send a request to one person. Use the name of one of your published forms:

Send a Formstep request with the "Supplier onboarding" form to Ada Lovelace (ada@acme.example). Fill in the company name "Analytical Engines Ltd" and lock it so it cannot be changed. Use supplier-2041 as the external ID. Don't send the invitation email; give me the link and I will send it myself.

The agent reads the form's field keys with fields_list, creates the request with request_create, and gives you the request link.

If the form has Send reminders on, Formstep still emails the recipient its scheduled reminders. To prevent that, also say no reminders.

The agent is not told when the recipient submits, so ask it later:

Has the Formstep request supplier-2041 been answered? Show me the answers.

The agent finds the request by its external ID with request_list, then reads it with request_get. Once the request is completed, the answers come back keyed by field key.

Step by step: Send a request with an AI agent and Build a form with an AI agent.

Tools

Every tool is on tools/list with its full input schema as soon as an AI tool connects. The MCP server reference describes them in detail.

Requests

Ask one named person for information and read the result.

• fields_list: list the field keys a request can address on a published form. Call it before request_create.
• request_create: assign a published form to one recipient, with prefill, locked fields, context, delivery, expiry and an optional callback.
• request_get: read one request by its ID. Returns the status, the timeline and, once completed, the answers keyed by field key.
• request_list: list requests for a form or a workspace, filtered by status, outcome or your own external ID.
• request_cancel: withdraw a pending request.
• request_remind: send the recipient a reminder email now.
• request_replayCallback: send a callback again when it never reached your endpoint.
• document_create: reserve an upload for a file a request hands to its recipient. One upload can serve any number of requests.

Forms

• form_list, form_get, form_create, form_update: find, read, create and rename forms, and set the folder, emoji, cover and logo.
• form_publish, form_unpublish: start and stop accepting submissions. form_publish is safe to call twice.
• form_delete, form_restore: move a form to the trash, which also revokes its share links, and bring it back.

form_get returns the questions of the last published version. For a draft, read the content with editor_getDocument.

Editor

• editor_getDocument: read the full structure of a form.
• editor_updateElement, editor_deleteElement: edit, move or remove a block.
• editor_formatText: format text inside a block.
• editor_setLogic, editor_testLogic: change the rule of a logic block and test it. Create the block with editor_insertLogic.

Each block type has its own insert tool with a precise schema:

• Questions: editor_insertTextQuestion, editor_insertContactQuestion, editor_insertNumberQuestion, editor_insertDateQuestion, editor_insertTimeQuestion, editor_insertRadioQuestion, editor_insertCheckboxQuestion, editor_insertSelectQuestion, editor_insertPictureChoiceQuestion, editor_insertSwitchQuestion, editor_insertRatingQuestion, editor_insertLinearScaleQuestion, editor_insertRankingQuestion, editor_insertMatrixQuestion, editor_insertFileQuestion, editor_insertSignatureQuestion, editor_insertPaymentQuestion, editor_insertScheduleAppointmentQuestion
• Decision: editor_insertDecisionQuestion inserts the approve / decline / changes choice whose answer becomes the request outcome. A radio question built by hand never produces one.
• Content: editor_insertHeader, editor_insertParagraph, editor_insertImage, editor_insertList, editor_insertTable, editor_insertRow, editor_insertEmbedded, editor_insertPageDivider, editor_insertDocumentsBlock
• Data and logic: editor_insertHiddenField, editor_insertCalculatedField, editor_insertVariable, editor_insertRepeatingGroup, editor_insertLogic

Sharing and results

• formShareLink_list, formShareLink_create, formShareLink_update: manage share links, also on a custom domain.
• formSubmission_list: list a form's completed submissions, and drafts on request.
• formAnalytics_get: views, submissions, completion rate, and unique visitors by device, country, browser and source.

Appearance, settings and translations

• formTheme_get, formTheme_set: light and dark themes.
• formSettings_get, formSettings_update: notification emails, completion redirect, password, retention and language.
• translationLanguage_list, translationDraft_get, translationDraft_update, translationDraft_publish, translationLanguage_delete: translate a form as a draft, then publish it.

Workspace

• workspace_list: the one workspace your connection reaches, with its ID.
• workspaceFolder_list, workspaceFolder_create, workspaceFolder_update, workspaceFolder_delete: manage folders.

Built-in guides

Two tools return documentation instead of doing work:

• load_skill loads a guide on one topic: requests, question-types, logic-rules, editing-flows, form-best-practices, form-themes, form-settings, analytics or toon-format.
• load_tools loads usage notes for a group of tools, called a catalog: request-lifecycle, editor-inserts, editor-actions, form-lifecycle, form-appearance, form-behavior, form-sharing, form-translations, form-data or workspace-management.

Every guide and catalog is also an MCP resource at skill://<name>, such as skill://requests. The server also serves four prompts: identity, capabilities, data_tools and editor_tools.

Tools that ask first

Six tools are marked destructive, because undoing them takes another call or is not possible: form_delete, form_unpublish, workspaceFolder_delete, editor_deleteElement, translationLanguage_delete and request_cancel. Most AI tools ask you before running them. The prompt comes from your AI tool, so check its approval settings if you need a hard stop.

Two actions cannot be undone:

• workspaceFolder_delete permanently deletes the folder, its subfolders and every form inside.
• formShareLink_update with revoked: true permanently disables a share link. This tool is not marked destructive, so your AI tool may not ask first.

Limits

• Rate limit. 120 tool calls per minute per token, shared with the REST API. Only tools/call counts. Over the limit, the call returns a failed tool result with RATE_LIMITED and a retryAfterMs. request_create and document_create also share a second limit of 60 calls per minute per token.
• Monthly allowance. Each request_create spends one unit of the monthly allowance of the workspace owner's plan, whether or not the recipient ever answers. A test request (test: true) spends nothing. When the allowance is spent, request_create fails with MONTHLY_ALLOWANCE_REACHED.
• Paid plans. Emailing a recipient (the invitation and reminders) and formAnalytics_get need the Pro or Business plan. See plans and pricing.
• No notification when a recipient submits. The server never calls your agent. Ask again later, or pass a callbackUrl to request_create so Formstep calls your endpoint (callbacks).
• No file uploads through a tool call. Images are set by URL: an http(s):// URL or a data:image URI. A document for a request is the exception: document_create returns an upload URL you PUT the file to within one hour. PDF and images only, 25 MB per file.
• No workspace AI skills. Skills you write in Formstep only work in Formstep's built-in AI chat. The server's own guides (load_skill) work over MCP.

Protocol details

For anyone who writes their own MCP client or debugs a connection.

• Transport. Streamable HTTP, POST only. Every response is JSON. There is no event stream and no session ID, so each call stands alone. As the MCP spec requires, send Content-Type: application/json and Accept: application/json, text/event-stream.
• Protocol version. 2025-11-25.
• Sign-in. Every call needs Authorization: Bearer <token>, initialize included. Without one, the server answers 401 with a WWW-Authenticate header that points to https://api.formstep.io/.well-known/oauth-protected-resource. From there a client finds the OAuth 2.1 server, which requires PKCE (S256) and supports dynamic client registration. The reference lists each step.
• Tokens. Both kinds reach one workspace and the same tools.
  • An API token starts with fs_ and lasts 30 days from creation.
  • An OAuth access token starts with fso_ and lasts 1 hour. Your AI tool renews it with a refresh token, which lasts 30 days and is replaced on every use.
• Results. A tool result is one text item that holds JSON. A failure has success: false and an error message. Request tools add a reason code such as UNKNOWN_FIELD_KEY under details, and a suggestion that says how to fix the call. Troubleshooting requests explains the common ones.
• Browsers. The server allows cross-origin calls from Formstep's own sites only, so a web page on another origin cannot call it directly.

Docs

• MCP server reference: every tool, OAuth for your own client, and limits
• Connect an AI agent
• Build a form with an AI agent
• Send a request with an AI agent
• Requests overview, field keys, and callbacks
• API tokens and the REST API
• Privacy policy and terms of service

Report a problem

• Email support@formstep.io.
• Or open an issue in this repository. Say which AI tool you use, how it signs in, the tool it called, and the error it got back.

Issues are public. Never paste a token (fs_... or fso_...) or a recipient's answers into one; email us instead. To report a security problem, see SECURITY.md.

Fixes to these docs are welcome as pull requests.

License

The files in this repository are MIT licensed; see LICENSE. Using the Formstep service is covered by the terms of service.