Wufoo MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.3 · published by io.usefulapi

Read forms, fields, entries, reports and comments by field title, and submit entries.

Deletes · 3

Compare Registry entry

18 tools: 3 can delete or cancel things and 15 only read.

Scanned Oct 21, 2026

Deletes or cancels3Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things0Claude Code: ask
Only reads15Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http wufoo https://wufoo.usefulapi.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

wufoo_add_webhookWRITE: adds a webhook to a form, so Wufoo POSTs every new entry to the given URL.No findings
Why it is in this group
- The name "wufoo_add_webhook" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: adds a webhook to a form, so Wufoo POSTs every new entry to the given URL. Idempotent per URL: calling again with the same URL updates its handshake key / metadata setting instead of adding a duplicate. Forms allow at most 10 integrations. Returns WebHookPutResult.Hash — keep it, it is needed to delete the webhook. Wufoo: PUT /forms/{identifier}/webhooks.json.
Annotations the server declares
- title: Add a webhook
- destructiveHint: true
wufoo_delete_webhookWRITE: removes a webhook from a form; the receiving URL stops getting new entries immediately.No findings
Why it is in this group
- The name "wufoo_delete_webhook" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: removes a webhook from a form; the receiving URL stops getting new entries immediately. Needs the webhook hash returned by wufoo_add_webhook (Wufoo has no endpoint to list webhooks). Wufoo: DELETE /forms/{identifier}/webhooks/{webhookHash}.json.
Annotations the server declares
- title: Delete a webhook
- destructiveHint: true
wufoo_submit_entryWRITE: submits a new entry to a form, exactly as if someone filled it in — it is stored and triggers the form's notifications, webhooks and integrations.No findings
Why it is in this group
- The name "wufoo_submit_entry" says "submit": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: submits a new entry to a form, exactly as if someone filled it in — it is stored and triggers the form's notifications, webhooks and integrations. Keys are field API IDs from wufoo_get_form_fields (Field1, Field105…); fields with sub-fields (name, address, checkbox) take one key per sub-field ID. Dates must be YYYYMMDD. Field validation and form limits still apply: a rejected submission returns each field error. Limited by Wufoo to 50 submissions per user per 5 minutes. Wufoo: POST /forms/{identifier}/entries.json.
Annotations the server declares
- title: Submit a form entry
- destructiveHint: true

Only reads 15Looks things up and changes nothing.Claude Code: allow

wufoo_count_form_commentsCount all comments on a form's entries.No findings
Why it is in this group
- The name "wufoo_count_form_comments" says "count": a word for reading.
Description, as the server wrote it
Count all comments on a form's entries. Returns {Count}. Wufoo: GET /forms/{identifier}/comments/count.json.
Annotations the server declares
- title: Count entry comments
- readOnlyHint: true
wufoo_count_form_entriesCount a form's entries — all of them, or only those matching filters (same filter format as wufoo_list_form_entries).No findings
Why it is in this group
- The name "wufoo_count_form_entries" says "count": a word for reading.
Description, as the server wrote it
Count a form's entries — all of them, or only those matching filters (same filter format as wufoo_list_form_entries). Useful to plan paging. Returns {EntryCount}. Wufoo: GET /forms/{identifier}/entries/count.json.
Annotations the server declares
- title: Count form entries
- readOnlyHint: true
wufoo_count_report_entriesCount the entries in a report.No findings
Why it is in this group
- The name "wufoo_count_report_entries" says "count": a word for reading.
Description, as the server wrote it
Count the entries in a report. Returns {EntryCount}. Wufoo: GET /reports/{identifier}/entries/count.json.
Annotations the server declares
- title: Count report entries
- readOnlyHint: true
wufoo_get_formFetch one form's settings by hash or URL title — name, description, confirmation message, notification emails, public flag, language, start/end dates, entry limit and links.No findings
Why it is in this group
- The name "wufoo_get_form" says "get": a word for reading.
Description, as the server wrote it
Fetch one form's settings by hash or URL title — name, description, confirmation message, notification emails, public flag, language, start/end dates, entry limit and links. Wufoo: GET /forms/{identifier}.json.
Annotations the server declares
- title: Get one form
- readOnlyHint: true
wufoo_get_form_fieldsThe field structure of a form: each field's Title, Type, API ID (Field###, used for filters, sorting and submissions), required flag, default value and page.No findings
Why it is in this group
- The name "wufoo_get_form_fields" says "get": a word for reading.
Description, as the server wrote it
The field structure of a form: each field's Title, Type, API ID (Field###, used for filters, sorting and submissions), required flag, default value and page. Checkbox, name, address and likert fields list SubFields with their own IDs; multiple-choice, dropdown and likert fields list Choices. Admin-only fields are not returned. Wufoo: GET /forms/{identifier}/fields.json.
Annotations the server declares
- title: Get form fields
- readOnlyHint: true
wufoo_get_labeled_entriesFetch a page of a form's entries with every Field### key replaced by the field's human title — e.g.No findings
Why it is in this group
- The name "wufoo_get_labeled_entries" says "get": a word for reading.
Description, as the server wrote it
Fetch a page of a form's entries with every Field### key replaced by the field's human title — e.g. "Email", or "Title — Label" for sub-fields of checkbox, name, address and likert fields ("Name — First", "Address — City"). EntryId, DateCreated and the other default/system keys stay as they are. Empty values are dropped unless includeEmpty is set. Also returns fieldIds (title → API ID) for building filters or submissions. Takes the same paging, sorting and filter arguments as wufoo_list_form_entries. Wufoo: GET /forms/{identifier}/fields.json + /entries.json.
Annotations the server declares
- title: Get entries keyed by field title
- readOnlyHint: true
wufoo_get_reportFetch one report by hash or URL title.No findings
Why it is in this group
- The name "wufoo_get_report" says "get": a word for reading.
Description, as the server wrote it
Fetch one report by hash or URL title. Wufoo: GET /reports/{identifier}.json.
Annotations the server declares
- title: Get one report
- readOnlyHint: true
wufoo_get_report_fieldsThe field structure of the form a report is built on (same shape as wufoo_get_form_fields).No findings
Why it is in this group
- The name "wufoo_get_report_fields" says "get": a word for reading.
Description, as the server wrote it
The field structure of the form a report is built on (same shape as wufoo_get_form_fields). Wufoo: GET /reports/{identifier}/fields.json.
Annotations the server declares
- title: Get report fields
- readOnlyHint: true
wufoo_list_form_commentsList the comments team members left on a form's entries in the Entry Manager: CommentId, EntryId, Text, CommentedBy, DateCreated.No findings
Why it is in this group
- The name "wufoo_list_form_comments" says "list": a word for reading.
Description, as the server wrote it
List the comments team members left on a form's entries in the Entry Manager: CommentId, EntryId, Text, CommentedBy, DateCreated. Optionally only for one entry. Page with pageStart/pageSize (max 100). Wufoo: GET /forms/{identifier}/comments.json.
Annotations the server declares
- title: List entry comments
- readOnlyHint: true
wufoo_list_form_entriesList a form's submitted entries (as in the Entry Manager), keyed by field API ID (Field105…) plus EntryId, DateCreated, CreatedBy, DateUpdated, UpdatedBy.No findings
Why it is in this group
- The name "wufoo_list_form_entries" says "list": a word for reading.
Description, as the server wrote it
List a form's submitted entries (as in the Entry Manager), keyed by field API ID (Field105…) plus EntryId, DateCreated, CreatedBy, DateUpdated, UpdatedBy. Filter like the Entry Manager (Filter1=Field105 Contains foo, combined with match AND/OR), sort by any field ID, and page with pageStart/pageSize (max 100). For entries keyed by human field titles use wufoo_get_labeled_entries. Wufoo: GET /forms/{identifier}/entries.json.
Annotations the server declares
- title: List form entries
- readOnlyHint: true
wufoo_list_formsList the forms the API key's user can access: name, description, hash (permanent identifier), URL title, public/private, start/end dates, entry limit, created/updated timestamps.No findings
Why it is in this group
- The name "wufoo_list_forms" says "list": a word for reading.
Description, as the server wrote it
List the forms the API key's user can access: name, description, hash (permanent identifier), URL title, public/private, start/end dates, entry limit, created/updated timestamps. Set includeTodayCount to add EntryCountToday. Wufoo: GET /forms.json.
Annotations the server declares
- title: List forms
- readOnlyHint: true
wufoo_list_report_entriesThe entries that make up a report — what its datagrid widget or an export would show, keyed by field API ID.No findings
Why it is in this group
- The name "wufoo_list_report_entries" says "list": a word for reading.
Description, as the server wrote it
The entries that make up a report — what its datagrid widget or an export would show, keyed by field API ID. Wufoo documents no paging or filter parameters for this endpoint. Wufoo: GET /reports/{identifier}/entries.json.
Annotations the server declares
- title: List report entries
- readOnlyHint: true
wufoo_list_report_widgetsThe chart, graph (pie/bar/line) and big-number widgets on a report: Name, Type, TypeDesc, Size and Hash (the hash embeds the widget).No findings
Why it is in this group
- The name "wufoo_list_report_widgets" says "list": a word for reading.
Description, as the server wrote it
The chart, graph (pie/bar/line) and big-number widgets on a report: Name, Type, TypeDesc, Size and Hash (the hash embeds the widget). Text and datagrid widgets are not returned. Wufoo: GET /reports/{identifier}/widgets.json.
Annotations the server declares
- title: List report widgets
- readOnlyHint: true
wufoo_list_reportsList the reports the API key's user can access: name, description, hash, URL title, public flag and created/updated timestamps.No findings
Why it is in this group
- The name "wufoo_list_reports" says "list": a word for reading.
Description, as the server wrote it
List the reports the API key's user can access: name, description, hash, URL title, public flag and created/updated timestamps. Wufoo: GET /reports.json.
Annotations the server declares
- title: List reports
- readOnlyHint: true
wufoo_list_usersList the account's users: name, email, timezone, company, owner/admin flags and create-forms/reports/themes permissions.No findings
Why it is in this group
- The name "wufoo_list_users" says "list": a word for reading.
Description, as the server wrote it
List the account's users: name, email, timezone, company, owner/admin flags and create-forms/reports/themes permissions. Each user's API key is redacted from the result. Wufoo: GET /users.json.
Annotations the server declares
- title: List account users
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.16.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http wufoo https://wufoo.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__wufoo__wufoo_list_forms",
      "mcp__wufoo__wufoo_get_form",
      "mcp__wufoo__wufoo_get_form_fields",
      "mcp__wufoo__wufoo_list_form_entries",
      "mcp__wufoo__wufoo_get_labeled_entries",
      "mcp__wufoo__wufoo_count_form_entries",
      "mcp__wufoo__wufoo_list_form_comments",
      "mcp__wufoo__wufoo_count_form_comments",
      "mcp__wufoo__wufoo_list_reports",
      "mcp__wufoo__wufoo_get_report",
      "mcp__wufoo__wufoo_get_report_fields",
      "mcp__wufoo__wufoo_list_report_entries",
      "mcp__wufoo__wufoo_count_report_entries",
      "mcp__wufoo__wufoo_list_report_widgets",
      "mcp__wufoo__wufoo_list_users"
    ],
    "ask": [],
    "deny": [
      "mcp__wufoo__wufoo_submit_entry",
      "mcp__wufoo__wufoo_add_webhook",
      "mcp__wufoo__wufoo_delete_webhook"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as wufoo. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/wufoo/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 19:23 UTC.

For agents: Markdown · JSON · report this listing