MCP & AI agents

BootForm has a full MCP (Model Context Protocol) server, letting an AI coding agent - Claude Code, Cursor, Windsurf, or anything else that speaks MCP - create and configure forms, read submissions, and manage notification destinations directly, without you visiting the dashboard. MCP access is included on every plan, including Free - it's a core part of the product, not an add-on.

Every tool call is a thin wrapper over the same account/form/destination logic as the REST API - the same auth, the same plan limits, the same error codes.

Connecting an agent

Create an API key from Account → API Keys (label it something like "Claude Code MCP"), then point your agent at:

https://mcp.bootform.com/sse?api_key=bf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Or, preferred (keeps the key out of proxy/access logs), pass it as a header instead of a query param:

Authorization: Bearer bf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Typical MCP client config, query-param style:

{
  "mcpServers": {
    "bootform": {
      "url": "https://mcp.bootform.com/sse?api_key=bf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    }
  }
}

Or the preferred header style, for a client that supports a headers field on its server config:

{
  "mcpServers": {
    "bootform": {
      "url": "https://mcp.bootform.com/sse",
      "headers": {
        "Authorization": "Bearer bf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

/sse is a route name, not a transport. The server actually speaks Streamable HTTP (POST-based JSON-RPC), not classic GET-based SSE, despite the path. A client that infers transport from the URL (e.g. claude mcp add --transport sse ...) will connect but every call fails with 405 - use --transport http (or your client's equivalent "Streamable HTTP"/"HTTP" option) instead.

Available tools

Tool	What it does
bootform_create_form	Creates a form and returns its live endpoint immediately
bootform_configure_form	Updates a form's name, allowed origins, redirect, or subject template
bootform_list_forms	Lists every form on the authenticated account
bootform_get_snippet	Returns a ready-to-paste HTML snippet for an existing form
bootform_delete_form	Permanently deletes a form and all its submissions - irreversible, requires an explicit confirm: true
bootform_add_email	Adds an email notification recipient to a form
bootform_add_discord	Adds a Discord webhook notification destination
bootform_add_slack	Adds a Slack webhook notification destination
bootform_add_webhook	Adds an outgoing webhook notification destination (Starter plan or higher)
bootform_get_submissions	Lists recent submissions for a form - optionally filtered by read/unread state
bootform_mark_submission	Marks a submission read/unread, starred/unstarred, and/or archived/unarchived
bootform_moderate_submission	Approves or rejects a submission for the form's public moderated content feed

Every tool call authenticates the key, loads the account, and applies the same plan-limit checks as the REST API (quota, email recipient cap, integration availability) before executing - a tool call that would fail over REST fails the same way here, with the same error code.

Security notes

• An API key created for MCP use has the same account-wide access as any other API key - scope it by only labeling and sharing keys you're comfortable an agent using on your behalf.
• Revoking a key immediately closes any open connection and rejects reconnection with 401 UNAUTHORIZED.
• bootform_delete_form is genuinely irreversible - forms and submissions deleted through it don't come back. Its confirm: true requirement is the only safety gate; there's no undo after that.

For AI agents reading this directly

A condensed, machine-readable summary of the whole platform (not just MCP) is available at llms.txt, with a fuller version at llms-full.txt - useful context to load before making tool calls.