ShipMyForm
by shipmyform.com · remote · no sign-in to list tools · v1.1.0 · published by com.shipmyform
Form backend as 29 tools: create endpoints, route submissions, publish pages, run the inbox.
Deletes · 4Final · 3Changes · 12
29 tools: 4 can delete or cancel things, 3 do something that can't be undone, 12 change things and 10 only read.
Scanned Oct 21, 2026
- Deletes or cancels4Claude Code: deny: see these tools
- Can't be undone3Claude Code: ask: see these tools
- Changes things12Claude Code: ask: see these tools
- Only reads10Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http shipmyform https://shipmyform.com/api/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
29 tools
Deletes or cancels 4Claude Code: deny
delete_formDelete a form; its endpoint stops accepting submissions.No findings
Why it is in this group
- The name "delete_form" says "delete": a word for removing or ending something.
Description, as the server wrote it Delete a form; its endpoint stops accepting submissions.
delete_submissionsPermanently delete submissions (and their files).No findings
Why it is in this group
- The name "delete_submissions" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
Description, as the server wrote it Permanently delete submissions (and their files).
remove_connectorNo findings
Why it is in this group
- The name "remove_connector" says "remove": a word for removing or ending something.
revoke_api_keyRevoke a key by id.No findings
Why it is in this group
- The name "revoke_api_key" says "revoke": a word for removing or ending something.
Description, as the server wrote it Revoke a key by id. The key in use on this connection cannot revoke itself.
Can't be undone 3Claude Code: ask
publish_hosted_pagePublish a standalone page for the form on shipmyform.com (no website needed) and get its URL plus an embed script.No findings
Why it is in this group
- The name "publish_hosted_page" says "publish": a word for a change that another call does not undo.
Description, as the server wrote it Publish a standalone page for the form on shipmyform.com (no website needed) and get its URL plus an embed script. Uses the designed page if one exists, otherwise a default email + message form.
resend_verification_codeEmail a fresh 6-digit verification code to the account's address.No findings
Why it is in this group
- The name "resend_verification_code" says "resend": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it Email a fresh 6-digit verification code to the account's address.
test_connectorSend a test delivery through a connector and report the result.No findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it Send a test delivery through a connector and report the result.
Changes things 12Claude Code: ask
add_connectorRoute a form's submissions somewhere: email, webhook, Slack, Discord, Airtable, HubSpot, Telegram and more.No findings
Why it is in this group
- The name "add_connector" says "add": a word for a change.
Description, as the server wrote it Route a form's submissions somewhere: email, webhook, Slack, Discord, Airtable, HubSpot, Telegram and more. Get the config fields from list_connector_types. OAuth connectors (Google Sheets, Notion) must be added in the dashboard.
create_api_keyMint another API key for this workspace (shown once), optionally narrower than this one.No findings
Why it is in this group
- The name "create_api_key" says "create": a word for a change.
Description, as the server wrote it Mint another API key for this workspace (shown once), optionally narrower than this one. A key can never grant scopes it does not itself hold, so this is the safe way to hand a limited key to another agent.
create_formCreate a form and get its endpoint plus a paste-ready HTML snippet.No findings
Why it is in this group
- The name "create_form" says "create": a word for a change.
Description, as the server wrote it Create a form and get its endpoint plus a paste-ready HTML snippet. Email notifications to the account owner are set up automatically. Works on every plan.
export_submissionsAll of a form's submissions (up to 2,000) as CSV text, optionally filtered by status.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it All of a form's submissions (up to 2,000) as CSV text, optionally filtered by status.
get_form_snippetA copy-paste form snippet for a framework (html, react, vue, or fetch) wired to the form's endpoint.No findings
Why it is in this group
- The name "get_form_snippet" says "get": a word for reading.
- The description's first verb is "copy": a word for a change.
Description, as the server wrote it A copy-paste form snippet for a framework (html, react, vue, or fetch) wired to the form's endpoint.
label_submissionsMark submissions as spam, ok (not spam) or flagged.No findings
Why it is in this group
- The name "label_submissions" says "label": a word for a change.
Description, as the server wrote it Mark submissions as spam, ok (not spam) or flagged. spam/ok also teach the classifier, so your judgement improves future filtering. This is how you triage in your own environment: list, decide, label.
set_connector_activeNo findings
Why it is in this group
- The name "set_connector_active" says "set": a word for a change.
sign_upStart a ShipMyForm account from an email address, with no browser.No findings
Why it is in this group
- The description's first verb is "start": a word for a change.
Description, as the server wrote it Start a ShipMyForm account from an email address, with no browser. A 6-digit code is emailed to the address; verify_account with { email, code } then returns the API key. Works without authentication. Also works for an existing account (the code approves API access).
start_upgradeGet a hosted checkout URL for the Starter or Business plan.No findings
Why it is in this group
- The name "start_upgrade" says "start": a word for a change.
Description, as the server wrote it Get a hosted checkout URL for the Starter or Business plan. Payment is completed by a person on that page; the plan activates automatically afterwards (check with get_account).
unpublish_hosted_pageNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
update_formChange any subset of a form's settings: name, purpose, allowedDomains, redirectUrl, spamMode, active, storeSubmissions, validation rules, blocklist, autoResponder (Pro).No findings
Why it is in this group
- The name "update_form" says "update": a word for a change.
Description, as the server wrote it Change any subset of a form's settings: name, purpose, allowedDomains, redirectUrl, spamMode, active, storeSubmissions, validation rules, blocklist, autoResponder (Pro).
verify_accountProve the address with the 6-digit code emailed by sign_up.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it Prove the address with the 6-digit code emailed by sign_up. Without a key on the connection, pass the email too: on success this returns the API key (shown once). Turns on email notifications.
Only reads 10Claude Code: allow
get_accountThe account's email, verification state, plan, limits, usage and dashboard URL.No findings
Why it is in this group
- The name "get_account" says "get": a word for reading.
Description, as the server wrote it The account's email, verification state, plan, limits, usage and dashboard URL.
get_billing_portalA self-service billing portal URL: change plan, update the card, cancel.No findings
Why it is in this group
- The name "get_billing_portal" says "get": a word for reading.
Description, as the server wrote it A self-service billing portal URL: change plan, update the card, cancel.
get_formA form's full configuration, connectors and hosted-page status.No findings
Why it is in this group
- The name "get_form" says "get": a word for reading.
Description, as the server wrote it A form's full configuration, connectors and hosted-page status.
get_submissionOne submission with spam signals and delivery history.No findings
Why it is in this group
- The name "get_submission" says "get": a word for reading.
Description, as the server wrote it One submission with spam signals and delivery history.
get_submission_statsDelivered / spam-held / flagged counts for a form, plus workspace quota usage.No findings
Why it is in this group
- The name "get_submission_stats" says "get": a word for reading.
Description, as the server wrote it Delivered / spam-held / flagged counts for a form, plus workspace quota usage. Works on every plan.
list_api_keysAPI keys on this workspace (metadata only).No findings
Why it is in this group
- The name "list_api_keys" says "list": a word for reading.
Description, as the server wrote it API keys on this workspace (metadata only).
list_connector_typesEvery destination submissions can be routed to, with the config fields each needs and which plan it requires.No findings
Why it is in this group
- The name "list_connector_types" says "list": a word for reading.
Description, as the server wrote it Every destination submissions can be routed to, with the config fields each needs and which plan it requires.
list_connectorsConnectors on a form with their status and last error.No findings
Why it is in this group
- The name "list_connectors" says "list": a word for reading.
Description, as the server wrote it Connectors on a form with their status and last error.
list_formsThe workspace's forms with their public endpoint URLs.No findings
Why it is in this group
- The name "list_forms" says "list": a word for reading.
Description, as the server wrote it The workspace's forms with their public endpoint URLs.
list_submissionsRead submissions across the workspace or for one form, with filters (status, date range, text search, country, attachments, failed deliveries) and paging.No findings
Why it is in this group
- The name "list_submissions" says "list": a word for reading.
Description, as the server wrote it Read submissions across the workspace or for one form, with filters (status, date range, text search, country, attachments, failed deliveries) and paging. Spam is excluded unless status is 'spam'. Requires a paid plan.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http shipmyform https://shipmyform.com/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__shipmyform__get_account",
"mcp__shipmyform__list_api_keys",
"mcp__shipmyform__get_billing_portal",
"mcp__shipmyform__list_forms",
"mcp__shipmyform__get_form",
"mcp__shipmyform__get_submission_stats",
"mcp__shipmyform__list_connector_types",
"mcp__shipmyform__list_connectors",
"mcp__shipmyform__list_submissions",
"mcp__shipmyform__get_submission"
],
"ask": [
"mcp__shipmyform__sign_up",
"mcp__shipmyform__verify_account",
"mcp__shipmyform__resend_verification_code",
"mcp__shipmyform__create_api_key",
"mcp__shipmyform__start_upgrade",
"mcp__shipmyform__create_form",
"mcp__shipmyform__update_form",
"mcp__shipmyform__get_form_snippet",
"mcp__shipmyform__add_connector",
"mcp__shipmyform__test_connector",
"mcp__shipmyform__set_connector_active",
"mcp__shipmyform__publish_hosted_page",
"mcp__shipmyform__unpublish_hosted_page",
"mcp__shipmyform__label_submissions",
"mcp__shipmyform__export_submissions"
],
"deny": [
"mcp__shipmyform__revoke_api_key",
"mcp__shipmyform__delete_form",
"mcp__shipmyform__remove_connector",
"mcp__shipmyform__delete_submissions"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as shipmyform. Review it before you use it.