MCP setup

quickforms runs a streamable HTTP MCP server at https://YOUR-QUICKFORMS-HOST/mcp. It uses the same team API keys as the REST API, with the same API key abilities and team roles: read-only tools need the read ability, and anything that changes data needs write and an admin or owner role.

Claude Code

claude mcp add --transport http quickforms https://YOUR-QUICKFORMS-HOST/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"

Other clients

Most clients that support remote MCP servers accept a config like this. Check your client’s docs for the exact file and key names.

{
  "mcpServers": {
    "quickforms": {
      "type": "http",
      "url": "https://YOUR-QUICKFORMS-HOST/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Tools

The server is called quickforms (version 1.0.0) and has 19 tools.

Drafts

Pass draft: true to create-form or update-form to keep changes unpublished. Live submissions keep using the published version, while send-test-submission runs against the draft. When the draft is right, call publish-form, or publish-form with discard: true to throw it away. See drafts and publishing.

Settings

settings on create-form and update-form accepts every key in the REST API’s form settings table, including routing rules, reply-to, Altcha, geo filters, disposable email blocking, payments and partial submissions.

Hosted forms

create-form and update-form accept settings.hosted (enabled, layout, appearance, accent, font, radius, background, title, intro, submit_label, logo_url, favicon_url, show_branding) to change the hosted form page. Only the keys you pass change. get-form returns the settings and the page’s URL.

Personal links

create-form-links takes form_id and a links list. It returns each link with its url, ready to send. list-form-links shows which links are open, completed, expired or revoked, and revokes one with revoke_link_id. create-form and update-form accept settings.require_link to only accept submissions through links. Submissions made through a link have link_id and the link’s details in meta.link. Pass link_id to list-submissions to see a link’s submissions. See personal links.

Spam

Submissions get two separate checks from the spam filter: the base spam check sets spam: true, and breaking the form’s smart rules sets failed_rules: true. Either one holds the deliveries. Pass spam or failed_rules (true or false) to list-submissions to filter by either check, and use review-submission to release a false positive. Marking a submission as not spam clears both flags. create-form and update-form accept description and settings.spam (enabled, threshold, rules).

Webhook events

create-form and update-form accept settings.webhook.events, a list of the webhook events to send: submission.created, submission.held, submission.deleted, submission.confirmation_expired and payment.needs_attention. The default is submission.created only.

Double opt-in

create-form and update-form accept settings.confirmation (enabled, email_field, subject, body, button_label, expires_hours, on_expiry, redirect_url, confirmed_message). On those forms a submission only sends a confirmation email until the person clicks its link, and submissions have confirmation_status (null, pending, confirmed or expired) and confirmed_at. Pass confirmation to list-submissions to filter by status, and use confirm-submission to confirm on the person’s behalf or resend the email. See double opt-in.

Spam protection

create-form and update-form accept settings.honeypot_field and settings.honeypot_fields, a list of up to 5 extra honeypots with realistic names such as website or fax. Passing honeypot_fields replaces the whole list, and a honeypot named like one of the form’s fields is rejected.

get-form returns settings.turnstile (enabled, site_key) and turnstile_secret_set, but never the Turnstile secret key. Set the secret key with turnstile_secret on create-form or update-form. It is write-only.

Creating forms

generate-form is limited to 30 generated forms an hour per user by default (QUICKFORMS_FORM_BUILDER_PER_HOUR). Past that it returns an error saying to try again later. It needs the AI form builder to be configured on the server (see configuration). See creating forms for the template list and examples.

Payments

create-form and update-form accept stripe_secret, your Stripe secret key (sk_ or a restricted rk_ key). It is write-only: get-form returns stripe_secret_set instead. Switch payments on with settings.payment (enabled, publishable_key, currency, amount in the smallest currency unit, or amount_field plus prices, and description). See payments.

Partial submissions

With settings.partials on (enabled, abandon_after_minutes, retention_days), the embed and hosted page save progress while people fill the form in. list-partial-submissions returns a funnel (started, completed, abandoned, in_progress, completion_rate and drop_off, the fields where people stop) over the last days (1 to 365, default 30), and data, the 50 most recently active partial submissions. Pass sandbox: true for sandbox ones. See partial submissions.

Destinations

manage-destination takes an action:

Secrets in config are write-only and come back masked. mapping maps each target key to a template with {{field}} placeholders, plus {{_form_name}}, {{_submission_id}}, {{_submitted_at}} and {{_summary}}. conditions is a list of {field, operator, value}, all of which must match, with operator one of equals, not_equals, contains, is_set or is_empty. Deliveries are retried and logged like webhooks, and simulated in sandbox. See destinations.

Analytics

get-form-analytics takes form_id and days (1 to 365, default 30). It returns views, visitors, starts, submissions, conversion_rate, a daily series, and the top sources, campaigns, referrers and click_ids behind live submissions. The same data as GET /api/v1/forms/{form}/analytics. See analytics and tracking.