SubmitraX

by submitrax.com · remote · no sign-in to list tools · v1.0.0 · published by com.submitrax

Form backend for static sites: create forms, manage submissions, webhooks and exports.

Deletes · 11Final · 3Changes · 28

Compare Registry entry

57 tools: 11 can delete or cancel things, 3 do something that can't be undone, 28 change things and 15 only read.

Scanned Oct 21, 2026

Deletes or cancels11Claude Code: deny: see these tools
Can't be undone3Claude Code: ask: see these tools
Changes things28Claude Code: ask: see these tools
Only reads15Claude Code: allow: see these tools

6 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http submitrax https://mcp.submitrax.com/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

3 warn3 info

Warnlogin
The server marks "login" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "log": a word for reading.
What this check looks for
Warnlogin_with_google
The server marks "login_with_google" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "log": a word for reading.
What this check looks for
Warnbulk_archive_submissions
The server marks "bulk_archive_submissions" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "bulk_archive_submissions" says "archive": a word for removing or ending something.
What this check looks for
Infologin_with_google
The description mentions "credential".
Matched text
description: "...egister using a Google Sign-In ID token credential. Stores the returned token for subseque..."
What this check looks for
Infologin_with_google
The input schema at properties.credential.description mentions "credential".
Matched text
inputSchema.properties.credential.description: "Google ID token credential"
What this check looks for
Infologin_with_google
The input schema at required[0] mentions "credential".
Matched text
inputSchema.required[0]: "credential"
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

57 tools

Deletes or cancels 11Removes, cancels or revokes something.Claude Code: deny

bulk_archive_submissionsArchive several submissions at once.1 finding
Why it is in this group
- The name "bulk_archive_submissions" says "archive": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bulk_archive_submissions" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "bulk_archive_submissions" says "archive": a word for removing or ending something.
  What this check looks for
Description, as the server wrote it
Archive several submissions at once.
Annotations the server declares
- title: Bulk archive submissions
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
bulk_delete_submissionsPermanently delete several submissions at once.No findings
Why it is in this group
- The name "bulk_delete_submissions" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Permanently delete several submissions at once.
Annotations the server declares
- title: Bulk delete submissions
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
bulk_delete_users_adminDelete multiple user accounts at once.No findings
Why it is in this group
- The name "bulk_delete_users_admin" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete multiple user accounts at once. Requires super-admin.
Annotations the server declares
- title: Bulk delete users (admin)
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_all_form_submissionsDelete every submission belonging to a form.No findings
Why it is in this group
- The name "delete_all_form_submissions" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete every submission belonging to a form.
Annotations the server declares
- title: Delete all form submissions
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_formDelete a form.No findings
Why it is in this group
- The name "delete_form" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a form.
Annotations the server declares
- title: Delete form
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_form_webhookRemove a notification webhook URL from a form.No findings
Why it is in this group
- The name "delete_form_webhook" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove a notification webhook URL from a form.
Annotations the server declares
- title: Delete form webhook
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_submissionPermanently delete a single submission.No findings
Why it is in this group
- The name "delete_submission" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Permanently delete a single submission.
Annotations the server declares
- title: Delete submission
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_template_adminDelete a template.No findings
Why it is in this group
- The name "delete_template_admin" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a template. Requires super-admin.
Annotations the server declares
- title: Delete template (admin)
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_user_adminDelete a single user account.No findings
Why it is in this group
- The name "delete_user_admin" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a single user account. Requires super-admin.
Annotations the server declares
- title: Delete user (admin)
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_workspaceDelete a workspace along with all its forms and submissions.No findings
Why it is in this group
- The name "delete_workspace" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a workspace along with all its forms and submissions. Only the owner may do this.
Annotations the server declares
- title: Delete workspace
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
remove_workspace_memberRemove a member (or cancel a pending invitation) from a workspace.No findings
Why it is in this group
- The name "remove_workspace_member" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove a member (or cancel a pending invitation) from a workspace. Requires admin access to the workspace.
Annotations the server declares
- title: Remove workspace member
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true

Can't be undone 3Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

accept_inviteAccept a pending workspace invitation using its invitation token, linking it to the authenticated user.No findings
Why it is in this group
- The name "accept_invite" says "invite": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Accept a pending workspace invitation using its invitation token, linking it to the authenticated user.
Annotations the server declares
- title: Accept workspace invite
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
invite_workspace_memberInvite a new member to a workspace by email.No findings
Why it is in this group
- The name "invite_workspace_member" says "invite": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Invite a new member to a workspace by email. Requires admin access to the workspace.
Annotations the server declares
- title: Invite workspace member
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
resend_submission_emailResend the email notification for a submission.No findings
Why it is in this group
- The name "resend_submission_email" says "resend": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Resend the email notification for a submission.
Annotations the server declares
- title: Resend submission email
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 28Creates or changes something that can be changed back.Claude Code: ask

add_form_webhookAdd a notification webhook URL to a form.No findings
Why it is in this group
- The name "add_form_webhook" says "add": a word for a change.
Description, as the server wrote it
Add a notification webhook URL to a form.
Annotations the server declares
- title: Add form webhook
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_checkout_sessionStart a Stripe subscription checkout for a plan ('free', 'essentials', 'pro').No findings
Why it is in this group
- The name "create_checkout_session" says "create": a word for a change.
Description, as the server wrote it
Start a Stripe subscription checkout for a plan ('free', 'essentials', 'pro'). Downgrades immediately if planType is 'free'.
Annotations the server declares
- title: Create Stripe checkout session
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_exportCreate a CSV or JSON export of a form's submissions, optionally filtered by date range (YYYY-MM-DD).No findings
Why it is in this group
- The name "create_export" says "create": a word for a change.
Description, as the server wrote it
Create a CSV or JSON export of a form's submissions, optionally filtered by date range (YYYY-MM-DD).
Annotations the server declares
- title: Create submission export
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_formCreate a new form in a workspace.No findings
Why it is in this group
- The name "create_form" says "create": a word for a change.
Description, as the server wrote it
Create a new form in a workspace.
Annotations the server declares
- title: Create form
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_template_adminCreate a new template.No findings
Why it is in this group
- The name "create_template_admin" says "create": a word for a change.
Description, as the server wrote it
Create a new template. Requires super-admin.
Annotations the server declares
- title: Create template (admin)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_workspaceCreate a new workspace owned by the authenticated user.No findings
Why it is in this group
- The name "create_workspace" says "create": a word for a change.
Description, as the server wrote it
Create a new workspace owned by the authenticated user.
Annotations the server declares
- title: Create workspace
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
download_exportDownload the contents of a previously created export file (CSV or JSON text).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Download the contents of a previously created export file (CSV or JSON text).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
generate_ai_contentProxy a request to the configured n8n AI generation webhook (e.g.No findings
Why it is in this group
- The name "generate_ai_content" says "generate": a word for a change.
Description, as the server wrote it
Proxy a request to the configured n8n AI generation webhook (e.g. for AI-assisted form/HTML generation). Requires the server to have AI generation configured.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
generate_workspace_api_tokenGenerate (or reset) a long-lived API token (sk_...) scoped to a single workspace, for use with public API integrations.No findings
Why it is in this group
- The name "generate_workspace_api_token" says "generate": a word for a change.
Description, as the server wrote it
Generate (or reset) a long-lived API token (sk_...) scoped to a single workspace, for use with public API integrations.
Annotations the server declares
- title: Generate workspace API token
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
health_checkCheck whether the SubmitraX API is reachable and running.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check whether the SubmitraX API is reachable and running.
Annotations the server declares
- title: Health check
- readOnlyHint: true
- openWorldHint: true
loginLog in with email and password.1 finding
Why it is in this group
- The description's first verb is "log": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
  The server marks "login" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "log": a word for reading.
  What this check looks for
Description, as the server wrote it
Log in with email and password. Stores the returned token for subsequent authenticated tool calls.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
login_with_googleLog in or register using a Google Sign-In ID token credential.4 findings
Why it is in this group
- The description's first verb is "log": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...egister using a Google Sign-In ID token credential. Stores the returned token for subseque..."
  What this check looks for
- Info
  The input schema at properties.credential.description mentions "credential".
  Matched text
  inputSchema.properties.credential.description: "Google ID token credential"
  What this check looks for
- Info
  The input schema at required[0] mentions "credential".
  Matched text
  inputSchema.required[0]: "credential"
  What this check looks for
- Warn
  The server marks "login_with_google" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "log": a word for reading.
  What this check looks for
Description, as the server wrote it
Log in or register using a Google Sign-In ID token credential. Stores the returned token for subsequent authenticated tool calls.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
mark_submission_readMark a submission as read so it no longer shows as new.No findings
Why it is in this group
- The name "mark_submission_read" says "mark": a word for a change.
Description, as the server wrote it
Mark a submission as read so it no longer shows as new.
Annotations the server declares
- title: Mark submission as read
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
redeem_voucherRedeem a voucher code to add submission quota to a workspace's owner.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it
Redeem a voucher code to add submission quota to a workspace's owner.
Annotations the server declares
- title: Redeem voucher
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
registerRegister a new SubmitraX user account.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Register a new SubmitraX user account. Stores the returned token for subsequent authenticated tool calls.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
set_auth_tokenSet the bearer token (JWT from login/register, or a workspace API token starting with sk_) used to authenticate subsequent tool calls.No findings
Why it is in this group
- The name "set_auth_token" says "set": a word for a change.
Description, as the server wrote it
Set the bearer token (JWT from login/register, or a workspace API token starting with sk_) used to authenticate subsequent tool calls.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
submit_demoTrigger a demo submission email for marketing/demo purposes.No findings
Why it is in this group
- The name "submit_demo" says "submit": a word for a change.
Description, as the server wrote it
Trigger a demo submission email for marketing/demo purposes. No authentication required, rate-limited.
Annotations the server declares
- title: Submit demo
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
submit_formSubmit data to a public form endpoint, as an end user would.No findings
Why it is in this group
- The name "submit_form" says "submit": a word for a change.
Description, as the server wrote it
Submit data to a public form endpoint, as an end user would. No authentication required.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
toggle_submission_archivedFlip a submission's archived state.No findings
Why it is in this group
- The name "toggle_submission_archived" says "toggle": a word for a change.
Description, as the server wrote it
Flip a submission's archived state.
Annotations the server declares
- title: Toggle submission archived
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
toggle_submission_spamFlip a submission's spam state.No findings
Why it is in this group
- The name "toggle_submission_spam" says "toggle": a word for a change.
Description, as the server wrote it
Flip a submission's spam state.
Annotations the server declares
- title: Toggle submission spam
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
update_formUpdate a form's settings (name, notification email, Slack webhook, redirect URL, custom HTML, active state, or arbitrary settings).No findings
Why it is in this group
- The name "update_form" says "update": a word for a change.
Description, as the server wrote it
Update a form's settings (name, notification email, Slack webhook, redirect URL, custom HTML, active state, or arbitrary settings).
Annotations the server declares
- title: Update form
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_member_roleChange a workspace member's role.No findings
Why it is in this group
- The name "update_member_role" says "update": a word for a change.
Description, as the server wrote it
Change a workspace member's role. Requires admin access to the workspace.
Annotations the server declares
- title: Update member role
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_template_adminUpdate a template.No findings
Why it is in this group
- The name "update_template_admin" says "update": a word for a change.
Description, as the server wrote it
Update a template. Requires super-admin.
Annotations the server declares
- title: Update template (admin)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_user_plan_adminSet a user's plan ('free' or 'pro') and its associated quota.No findings
Why it is in this group
- The name "update_user_plan_admin" says "update": a word for a change.
Description, as the server wrote it
Set a user's plan ('free' or 'pro') and its associated quota. Requires super-admin.
Annotations the server declares
- title: Update user plan (admin)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_user_quota_adminSet a user's submission quota directly.No findings
Why it is in this group
- The name "update_user_quota_admin" says "update": a word for a change.
Description, as the server wrote it
Set a user's submission quota directly. Requires super-admin.
Annotations the server declares
- title: Update user quota (admin)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_user_role_adminGrant or revoke super-admin status for a user.No findings
Why it is in this group
- The name "update_user_role_admin" says "update": a word for a change.
Description, as the server wrote it
Grant or revoke super-admin status for a user. Requires super-admin.
Annotations the server declares
- title: Update user admin role
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_workspaceRename a workspace or change its settings.No findings
Why it is in this group
- The name "update_workspace" says "update": a word for a change.
Description, as the server wrote it
Rename a workspace or change its settings.
Annotations the server declares
- title: Update workspace
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
upgrade_user_planChange the authenticated user's plan (defaults to 'pro' if not specified).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Change the authenticated user's plan (defaults to 'pro' if not specified).
Annotations the server declares
- title: Upgrade user plan
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 15Looks things up and changes nothing.Claude Code: allow

get_auth_statusCheck whether an auth token is currently configured for this session.No findings
Why it is in this group
- The name "get_auth_status" says "get": a word for reading.
Description, as the server wrote it
Check whether an auth token is currently configured for this session.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_current_userGet the profile of the currently authenticated user.No findings
Why it is in this group
- The name "get_current_user" says "get": a word for reading.
Description, as the server wrote it
Get the profile of the currently authenticated user.
Annotations the server declares
- title: Get current user
- readOnlyHint: true
- openWorldHint: true
get_formGet a single form by id or form key.No findings
Why it is in this group
- The name "get_form" says "get": a word for reading.
Description, as the server wrote it
Get a single form by id or form key.
Annotations the server declares
- title: Get form
- readOnlyHint: true
- openWorldHint: true
get_public_form_htmlFetch the rendered public HTML (custom or default template) for a form by its form key.No findings
Why it is in this group
- The name "get_public_form_html" says "get": a word for reading.
Description, as the server wrote it
Fetch the rendered public HTML (custom or default template) for a form by its form key. No authentication required.
Annotations the server declares
- title: Get public form HTML
- readOnlyHint: true
- openWorldHint: true
get_workspaceGet a single workspace's details and settings.No findings
Why it is in this group
- The name "get_workspace" says "get": a word for reading.
Description, as the server wrote it
Get a single workspace's details and settings.
Annotations the server declares
- title: Get workspace
- readOnlyHint: true
- openWorldHint: true
list_admin_usersPaginated list of all users with plan stats.No findings
Why it is in this group
- The name "list_admin_users" says "list": a word for reading.
Description, as the server wrote it
Paginated list of all users with plan stats. Requires super-admin.
Annotations the server declares
- title: List all users (admin)
- readOnlyHint: true
- openWorldHint: true
list_all_templates_adminPaginated list of every template.No findings
Why it is in this group
- The name "list_all_templates_admin" says "list": a word for reading.
Description, as the server wrote it
Paginated list of every template. Requires super-admin.
Annotations the server declares
- title: List all templates (admin)
- readOnlyHint: true
- openWorldHint: true
list_form_exportsList the export files previously created for a form.No findings
Why it is in this group
- The name "list_form_exports" says "list": a word for reading.
Description, as the server wrote it
List the export files previously created for a form.
Annotations the server declares
- title: List form exports
- readOnlyHint: true
- openWorldHint: true
list_form_submissionsList all submissions for a specific form.No findings
Why it is in this group
- The name "list_form_submissions" says "list": a word for reading.
Description, as the server wrote it
List all submissions for a specific form.
Annotations the server declares
- title: List form submissions
- readOnlyHint: true
- openWorldHint: true
list_form_webhooksList the notification webhook URLs (Slack, Discord, generic) configured on a form.No findings
Why it is in this group
- The name "list_form_webhooks" says "list": a word for reading.
Description, as the server wrote it
List the notification webhook URLs (Slack, Discord, generic) configured on a form.
Annotations the server declares
- title: List form webhooks
- readOnlyHint: true
- openWorldHint: true
list_formsList forms across the user's workspaces, or within one workspace if workspace_id is given.No findings
Why it is in this group
- The name "list_forms" says "list": a word for reading.
Description, as the server wrote it
List forms across the user's workspaces, or within one workspace if workspace_id is given.
Annotations the server declares
- title: List forms
- readOnlyHint: true
- openWorldHint: true
list_submissionsList submissions across the user's workspaces, or within one workspace if workspace_id is given.No findings
Why it is in this group
- The name "list_submissions" says "list": a word for reading.
Description, as the server wrote it
List submissions across the user's workspaces, or within one workspace if workspace_id is given.
Annotations the server declares
- title: List submissions
- readOnlyHint: true
- openWorldHint: true
list_templatesList default templates available to all users, optionally filtered by type ('form' or 'email').No findings
Why it is in this group
- The name "list_templates" says "list": a word for reading.
Description, as the server wrote it
List default templates available to all users, optionally filtered by type ('form' or 'email').
Annotations the server declares
- title: List default templates
- readOnlyHint: true
- openWorldHint: true
list_workspace_membersList members and pending invitations of a workspace, including its owner.No findings
Why it is in this group
- The name "list_workspace_members" says "list": a word for reading.
Description, as the server wrote it
List members and pending invitations of a workspace, including its owner.
Annotations the server declares
- title: List workspace members
- readOnlyHint: true
- openWorldHint: true
list_workspacesList workspaces owned by or shared with the authenticated user.No findings
Why it is in this group
- The name "list_workspaces" says "list": a word for reading.
Description, as the server wrote it
List workspaces owned by or shared with the authenticated user.
Annotations the server declares
- title: List workspaces
- readOnlyHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http submitrax https://mcp.submitrax.com/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__submitrax__get_auth_status",
      "mcp__submitrax__get_current_user",
      "mcp__submitrax__get_public_form_html",
      "mcp__submitrax__list_forms",
      "mcp__submitrax__get_form",
      "mcp__submitrax__list_form_webhooks",
      "mcp__submitrax__list_form_submissions",
      "mcp__submitrax__list_submissions",
      "mcp__submitrax__list_workspaces",
      "mcp__submitrax__get_workspace",
      "mcp__submitrax__list_workspace_members",
      "mcp__submitrax__list_templates",
      "mcp__submitrax__list_all_templates_admin",
      "mcp__submitrax__list_admin_users",
      "mcp__submitrax__list_form_exports"
    ],
    "ask": [
      "mcp__submitrax__set_auth_token",
      "mcp__submitrax__register",
      "mcp__submitrax__login",
      "mcp__submitrax__login_with_google",
      "mcp__submitrax__accept_invite",
      "mcp__submitrax__upgrade_user_plan",
      "mcp__submitrax__create_form",
      "mcp__submitrax__update_form",
      "mcp__submitrax__add_form_webhook",
      "mcp__submitrax__submit_form",
      "mcp__submitrax__submit_demo",
      "mcp__submitrax__mark_submission_read",
      "mcp__submitrax__toggle_submission_archived",
      "mcp__submitrax__toggle_submission_spam",
      "mcp__submitrax__resend_submission_email",
      "mcp__submitrax__create_workspace",
      "mcp__submitrax__update_workspace",
      "mcp__submitrax__redeem_voucher",
      "mcp__submitrax__generate_workspace_api_token",
      "mcp__submitrax__invite_workspace_member",
      "mcp__submitrax__update_member_role",
      "mcp__submitrax__create_template_admin",
      "mcp__submitrax__update_template_admin",
      "mcp__submitrax__create_checkout_session",
      "mcp__submitrax__update_user_role_admin",
      "mcp__submitrax__update_user_plan_admin",
      "mcp__submitrax__update_user_quota_admin",
      "mcp__submitrax__generate_ai_content",
      "mcp__submitrax__create_export",
      "mcp__submitrax__download_export",
      "mcp__submitrax__health_check"
    ],
    "deny": [
      "mcp__submitrax__delete_form",
      "mcp__submitrax__delete_form_webhook",
      "mcp__submitrax__delete_submission",
      "mcp__submitrax__delete_all_form_submissions",
      "mcp__submitrax__bulk_archive_submissions",
      "mcp__submitrax__bulk_delete_submissions",
      "mcp__submitrax__delete_workspace",
      "mcp__submitrax__remove_workspace_member",
      "mcp__submitrax__delete_template_admin",
      "mcp__submitrax__delete_user_admin",
      "mcp__submitrax__bulk_delete_users_admin"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as submitrax. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.submitrax/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

42 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:05 UTC.

For agents: Markdown · JSON · report this listing