Skip to content

com.formpaste/formpaste

by formpaste.com · remote · local (npm) · no sign-in to list tools · v1.0.0 · published by com.formpaste

Create and wire up contact forms from your coding agent. Forms, snippets, and submissions.

Final · 1Changes · 1
CompareRegistry entry

6 tools: 1 do something that can't be undone, 1 change things and 4 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http formpaste https://api.formpaste.com/mcp --header 'Authorization: <your-authorization>'

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Can't be undone 1Claude Code: ask
  • send_test_submissionStore a TEST submission so you can prove a form is live and receiving.No findings

    Why it is in this group

    • The name "send_test_submission" says "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Store a TEST submission so you can prove a form is live and receiving. Stored only: it appears in the owner's Inbox with a Test badge but sends NO email, runs NO spam scoring, and never counts toward quota. Optionally pass sample fields; omit to use a default payload. Capped at the 5 newest test rows per form. Errors with: unauthorized, not_found, invalid_input, too_many_fields, field_too_large.
Changes things 1Claude Code: ask
  • create_formCreate a Formpaste form and return its access key + a wired snippet.No findings

    Why it is in this group

    • The name "create_form" says "create": a word for a change.
    Description, as the server wrote it
    Create a Formpaste form and return its access key + a wired snippet. Triggers destination verification for a new address (the owner completes it in the dashboard); an already-verified destination delivers immediately. Errors with: unauthorized, upgrade_required.
Only reads 4Claude Code: allow
  • get_formRead one of your forms to verify it is wired correctly: returns its access_key, destination_email, destination_verified (whether submissions will be emailed yet), allowed_domains, …No findings

    Why it is in this group

    • The name "get_form" says "get": a word for reading.
    Description, as the server wrote it
    Read one of your forms to verify it is wired correctly: returns its access_key, destination_email, destination_verified (whether submissions will be emailed yet), allowed_domains, and notification/autoresponder/webhook config. Never returns the webhook signing secret. Errors with: unauthorized, not_found.
  • get_snippetReturn a copy-paste form snippet for a framework (html, react, nextjs, astro, vue, svelte).No findings

    Why it is in this group

    • The name "get_snippet" says "get": a word for reading.
    Description, as the server wrote it
    Return a copy-paste form snippet for a framework (html, react, nextjs, astro, vue, svelte). Pass formId to fill in a real access key; otherwise a placeholder is used. Errors with: unauthorized, invalid_framework.
  • list_formsList all forms on your account, each with its id, name, access_key, and inbox/spam counts.No findings

    Why it is in this group

    • The name "list_forms" says "list": a word for reading.
    Description, as the server wrote it
    List all forms on your account, each with its id, name, access_key, and inbox/spam counts. Use this to discover form ids or confirm a form you just created exists. Errors with: unauthorized.
  • list_submissionsList submissions for one of your forms.No findings

    Why it is in this group

    • The name "list_submissions" says "list": a word for reading.
    Description, as the server wrote it
    List submissions for one of your forms. Returns counts + per-submission metadata by default; set includeContent to include message bodies (third-party PII). Errors with: unauthorized, not_found, forbidden. Requires a full-access token.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http formpaste https://api.formpaste.com/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__formpaste__get_snippet",
      "mcp__formpaste__list_submissions",
      "mcp__formpaste__list_forms",
      "mcp__formpaste__get_form"
    ],
    "ask": [
      "mcp__formpaste__create_form",
      "mcp__formpaste__send_test_submission"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as formpaste. Review it before you use it.