MCP

Basestack Forms exposes a remote Model Context Protocol endpoint at:

https://<your-forms-api-host>/mcp

Create a tokenCopy Anchor Link

Open your profile settings and go to MCP Tokens. Create a token and copy it immediately. Tokens are read-only by default; select the write option only when the client needs to create forms, update supported form settings, or replace validation rules. Set an expiration date when the connection is temporary.

An MCP token works across every form its owner can access, including forms they join later. Operations on existing forms check the owner's current membership and role, so removing access or changing a role takes effect immediately. Creating a form makes the token owner its administrator.

Connect a clientCopy Anchor Link

MCP clients use different configuration formats. Store the token in an environment variable before starting a local client:

export BASESTACK_FORMS_MCP_TOKEN="<forms-mcp-token>"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "servers": {
      "basestack-forms": {
        "type": "remote",
        "url": "https://<your-forms-api-host>/mcp",
        "disabled": false,
        "oauth": false,
        "headers": {
          "Authorization": "Bearer {env:BASESTACK_FORMS_MCP_TOKEN}"
        }
      }
    }
  }
}

Never commit an MCP token to a shared client configuration or source control.

Available toolsCopy Anchor Link

• list_forms
• get_form
• get_form_rules
• list_submissions
• create_form
• update_form
• set_form_rules

Resource tools accept a formId; call list_forms to discover valid forms. All form members can use the read tools. create_form requires a write-enabled token and makes the token owner the form administrator. update_form and set_form_rules also require the current form role to be administrator or developer.

Prompt examplesCopy Anchor Link

You can refer to a form by name and ask the client to discover its formId before using another tool.

Explore your formsCopy Anchor Link

List every form I can access. For each form, show its name, form ID, enabled
status, and my role. Do not make any changes.

Review configuration and rulesCopy Anchor Link

Find the form named "Contact Us", then show its configuration and validation
rules. Highlight its spam protection, data retention, redirects, and required
fields. Do not change anything.

Summarize recent submissionsCopy Anchor Link

Retrieve the 25 most recent non-spam submissions from "Customer Feedback" and
summarize recurring themes. Exclude names, email addresses, phone numbers, and
raw responses from the summary.

Prepare a rules changeCopy Anchor Link

For "Newsletter Signup", propose validation rules that require an email address
and reject invalid email values. Show me the complete replacement rule set and
wait for my approval before calling set_form_rules.

Create a formCopy Anchor Link

Create a form named "Partner Inquiry", then show me its form ID and my role.
Do not make any other changes.

Update form protectionCopy Anchor Link

For "Contact Us", prepare a change that enables spam protection and sets the
honeypot field to "website". Show the form ID and exact fields that will change,
then wait for my approval before calling update_form.

For the strongest protection against accidental changes, use a read-only token. Instructions such as “wait for my approval” depend on the connected client's confirmation behavior and do not replace token permissions.

Billing usageCopy Anchor Link

Every authenticated HTTP request to the Forms MCP endpoint records one request against the token owner's forms_api_requests billing meter. Protocol requests such as initialize and tools/list count in the same way as tools/call. One HTTP request always counts as one request, regardless of which tool it invokes or whether the tool succeeds.

Form submissions can contain personal or sensitive data. Only connect trusted MCP clients, use the shortest practical token lifetime, and revoke tokens that are no longer needed.