com.furrowforms/furrow-forms

Est-ce que com.furrowforms/furrow-forms est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.furrowforms/furrow-forms » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 27 outils

• archive_client≈ 172 tokens

  Use to archive a client. Do not use this as a hard delete. There is no unarchive tool in v1.

  Paramètres, retour & exemple (1)

  Paramètres

  • client_id · string · requis
    Client id from list_clients or create_client.

  Exemple d'appel

  {"name": "archive_client", "arguments": {"client_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• archive_form≈ 170 tokens

  Use to archive a form so public submit returns 404. Do not use this as a hard delete.

  Paramètres, retour & exemple (1)

  Paramètres

  • form_id · string · requis
    Form id from list_forms, create_form, or bootstrap_site.

  Exemple d'appel

  {"name": "archive_form", "arguments": {"form_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• archive_project≈ 190 tokens

  Use to archive a website. Archived projects reject public submit. Do not use this as a hard delete. There is no unarchive tool in v1.

  Paramètres, retour & exemple (1)

  Paramètres

  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.

  Exemple d'appel

  {"name": "archive_project", "arguments": {"project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• bootstrap_site≈ 2922 tokens

  Use this to stand up a client, one website (project), and its forms in a single call. name/slug are the client; optional project_name/project_slug default to the same. Free accounts cannot create a fourth active project — call create_upgrade_link if bootstrap_site returns plan_limit. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Idempotent on client, project, and form slugs. Site settings (domains, Turnstile, notify emails, webhook, email templates, uploads) live on the project. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. Do not use when you only need to patch an existing form — call update_form.

  Paramètres, retour & exemple (24)

  Paramètres

  • name · string · requis
    Client (company) display name.
  • slug · string · requis
    Lowercase hyphenated identifier, unique per team. Used for idempotent re-runs.
  • email · object · optionnel
    Notification email template for the project: subject, from_name, intro, footer_mode, include_meta.
  • forms · array · optionnel
    Forms to create or update on the site, matched by slug. Re-running is safe.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.
  • from_name · ? · optionnel
    Legacy From display name. Prefer email.from_name.
  • webhook_url · ? · optionnel
    Public https endpoint that receives a signed JSON POST per clean submission. Null disables it.
  • project_name · string · optionnel
    Website display name. Defaults to the client name.
  • project_slug · string · optionnel
    Website slug. Defaults to the client slug.
  • notify_emails · array · optionnel
    Addresses that receive each clean submission (max 10). Inherited by every form.
  • honeypot_field · string · optionnel
    Name of the hidden honeypot input the snippet emits. Defaults to _gotcha.
  • webhook_secret · ? · optionnel
    HMAC-SHA256 secret for the X-Furrow-Signature header. Omit to have one generated and returned.
  • allowed_domains · array · optionnel
    Hostnames allowed to post to this project's forms (example.com, www.example.com). Empty accepts any origin.
  • uploads_enabled · boolean · optionnel
    Accept multipart file fields on this project's forms.
  • turnstile_secret · ? · optionnel
    Cloudflare Turnstile secret used to verify tokens server-side. Null removes it.
  • upload_max_files · integer · optionnel
    Max files per submission (up to 20).
  • rate_limit_per_ip · integer · optionnel
    Max submissions per IP within rate_limit_window_s.
  • require_turnstile · boolean · optionnel
    Reject submissions that lack a valid Turnstile token.
  • turnstile_site_key · ? · optionnel
    Cloudflare Turnstile site key for the frontend widget. Null removes it.
  • rate_limit_window_s · integer · optionnel
    Rate-limit window in seconds (max 86400).
  • default_redirect_url · ? · optionnel
    Where classic HTML posts redirect after success. Null returns JSON/inline success instead.
  • upload_allowed_types · array · optionnel
    Allowed upload MIME types, e.g. application/pdf or image/*.
  • upload_max_file_bytes · integer · optionnel
    Max bytes per file (up to 25 MB).
  • upload_max_total_bytes · integer · optionnel
    Max total upload bytes per submission (up to 50 MB).

  Exemple d'appel

  {"name": "bootstrap_site", "arguments": {"name": "texte", "slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_client≈ 362 tokens

  Use to add a client (company) by slug. Idempotent on slug unless strict is true. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Prefer bootstrap_site when also creating a website and forms. Do not put Turnstile or webhooks on a client — those live on the project.

  Paramètres, retour & exemple (4)

  Paramètres

  • name · string · requis
    Client (company) display name.
  • slug · string · requis
    Lowercase hyphenated identifier, unique per team. Used for idempotent re-runs.
  • strict · boolean · optionnel
    When true, fail if the slug already exists instead of returning the existing record.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

  Exemple d'appel

  {"name": "create_client", "arguments": {"name": "texte", "slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_form≈ 1181 tokens

  Use to add a form under an existing project_id. Idempotent on slug unless strict is true. Overrides are nullable; omit them to inherit project notify emails, webhook, redirect, require_turnstile, and email templates. Pass email.subject / email.intro to override notification copy for this form only. Pass webhook_url_override to send this form to a different URL. Field contract labels (label) are used on notification emails. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet.

  Paramètres, retour & exemple (11)

  Paramètres

  • name · string · requis
    Form display name, e.g. Contact or Quote request.
  • slug · string · requis
    Lowercase hyphenated identifier, unique per project. Used for idempotent re-runs.
  • email · object · optionnel
    Per-form subject and intro overrides for the notification email.
  • strict · boolean · optionnel
    When true, fail if the slug already exists instead of returning the existing record.
  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.
  • field_contract · ? · optionnel
    Declared fields (name, type, label, report). Drives get_snippet and the email layout. Null clears it.
  • webhook_url_override · ? · optionnel
    Webhook endpoint for this form only. Null inherits the project webhook.
  • redirect_url_override · ? · optionnel
    Success redirect for this form only. Null inherits default_redirect_url.
  • notify_emails_override · ? · optionnel
    Recipients for this form only. Null inherits the project's notify_emails.
  • webhook_secret_override · ? · optionnel
    HMAC secret for this form's webhook. Null inherits the project secret.
  • require_turnstile_override · ? · optionnel
    Force Turnstile on or off for this form. Null inherits the project setting.

  Exemple d'appel

  {"name": "create_form", "arguments": {"name": "texte", "slug": "texte", "project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_project≈ 1746 tokens

  Use to add one website under an existing client_id. Idempotent on slug unless strict is true. Free accounts are limited to 3 active (non-archived) projects; yearly is unlimited. If create_project returns plan_limit, call create_upgrade_link and hand the human the Stripe URL. Prefer bootstrap_site when the client does not exist yet. Optional email sets notification templates (subject, from_name, intro, footer_mode, include_meta). Free accounts cannot set footer_mode off. Set uploads_enabled on the project to accept files. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. Do not put Turnstile keys on a form.

  Paramètres, retour & exemple (22)

  Paramètres

  • name · string · requis
    Project (website) display name.
  • slug · string · requis
    Lowercase hyphenated identifier, unique per client. Used for idempotent re-runs.
  • email · object · optionnel
    Notification email template for the project: subject, from_name, intro, footer_mode, include_meta.
  • strict · boolean · optionnel
    When true, fail if the slug already exists instead of returning the existing record.
  • client_id · string · requis
    Client id from list_clients or create_client.
  • from_name · ? · optionnel
    Legacy From display name. Prefer email.from_name.
  • webhook_url · ? · optionnel
    Public https endpoint that receives a signed JSON POST per clean submission. Null disables it.
  • notify_emails · array · optionnel
    Addresses that receive each clean submission (max 10). Inherited by every form.
  • honeypot_field · string · optionnel
    Name of the hidden honeypot input the snippet emits. Defaults to _gotcha.
  • webhook_secret · ? · optionnel
    HMAC-SHA256 secret for the X-Furrow-Signature header. Omit to have one generated and returned.
  • allowed_domains · array · optionnel
    Hostnames allowed to post to this project's forms (example.com, www.example.com). Empty accepts any origin.
  • uploads_enabled · boolean · optionnel
    Accept multipart file fields on this project's forms.
  • turnstile_secret · ? · optionnel
    Cloudflare Turnstile secret used to verify tokens server-side. Null removes it.
  • upload_max_files · integer · optionnel
    Max files per submission (up to 20).
  • rate_limit_per_ip · integer · optionnel
    Max submissions per IP within rate_limit_window_s.
  • require_turnstile · boolean · optionnel
    Reject submissions that lack a valid Turnstile token.
  • turnstile_site_key · ? · optionnel
    Cloudflare Turnstile site key for the frontend widget. Null removes it.
  • rate_limit_window_s · integer · optionnel
    Rate-limit window in seconds (max 86400).
  • default_redirect_url · ? · optionnel
    Where classic HTML posts redirect after success. Null returns JSON/inline success instead.
  • upload_allowed_types · array · optionnel
    Allowed upload MIME types, e.g. application/pdf or image/*.
  • upload_max_file_bytes · integer · optionnel
    Max bytes per file (up to 25 MB).
  • upload_max_total_bytes · integer · optionnel
    Max total upload bytes per submission (up to 50 MB).

  Exemple d'appel

  {"name": "create_project", "arguments": {"name": "texte", "slug": "texte", "client_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_upgrade_link≈ 540 tokens

  Use when a free team is blocked on the 3-project, 100-submission, or one-workspace limit, or when a human should upgrade to yearly ($199/year) so you can keep adding projects, workspaces, and storing new submissions. Returns a Stripe Checkout URL to hand the human. If the team is already yearly, omit product to get a Stripe Customer Portal URL, or pass product=expansion for a $99/year pack that adds 5,000 submissions/month. Do not change plan in the database — Stripe webhooks do that. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace.

  Paramètres, retour & exemple (2)

  Paramètres

  • product · string · optionnel · yearly | expansion
    yearly starts the $199/year plan; expansion adds a $99/year 5,000-submission pack to a yearly team.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

  Exemple d'appel

  {"name": "create_upgrade_link", "arguments": {"product": "yearly", "team_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_account≈ 433 tokens

  Use to read the team's plan, usage this month, limits, expansion_packs, retention_days, branding, and AI spam filter (ai.typesafe_key_set, ai.notify_suspected_spam). The TypeSafe key itself is never returned. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use this to list projects — call list_projects.

  Paramètres, retour & exemple (1)

  Paramètres

  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

  Exemple d'appel

  {"name": "get_account", "arguments": {"team_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_client≈ 166 tokens

  Use to inspect one client. Do not use to list that client's sites — call list_projects with client_id.

  Paramètres, retour & exemple (1)

  Paramètres

  • client_id · string · requis
    Client id from list_clients or create_client.

  Exemple d'appel

  {"name": "get_client", "arguments": {"client_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_form≈ 260 tokens

  Use to read a form plus resolved and inherited settings, including resolved.email and resolved.uploads. files_url is the private inbox folder for this form under the project inbox (do not put it in a public snippet). Turnstile always inherits from the project (inherited.turnstile is true). Form webhook_url_override is nullable; null means inherit the project webhook. Forms may override email.subject and email.intro only. Do not use to generate embed code — call get_snippet.

  Paramètres, retour & exemple (1)

  Paramètres

  • form_id · string · requis
    Form id from list_forms, create_form, or bootstrap_site.

  Exemple d'appel

  {"name": "get_form", "arguments": {"form_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_project≈ 399 tokens

  Use to inspect one website's settings, domains, webhook URL, email templates, upload policy, plan, usage this month, limits, retention_days, and branding. Returns stored values plus resolved.email. Secrets are never returned. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Do not use to list forms — call list_forms.

  Paramètres, retour & exemple (1)

  Paramètres

  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.

  Exemple d'appel

  {"name": "get_project", "arguments": {"project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_snippet≈ 473 tokens

  Use after the form exists to get copy-paste html, astro, or next code that posts to /s/:publicKey. Do not invent a submit URL — this tool returns it. Snippets are single-value inputs; write checkbox groups and multi-selects yourself. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. After dropping the snippet, add visitor-facing success UI: a thank-you page plus default_redirect_url for classic HTML POST, or an on-page message when using fetch/{ok:true}. Do not leave visitors looking at JSON. See furrow://docs/submit-success.

  Paramètres, retour & exemple (2)

  Paramètres

  • form_id · string · requis
    Form id from list_forms, create_form, or bootstrap_site.
  • framework · string · requis · html | astro | next
    Snippet flavor: html (plain form), astro (component), or next (React client component).

  Exemple d'appel

  {"name": "get_snippet", "arguments": {"form_id": "texte", "framework": "html"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_submission≈ 204 tokens

  Use to read one stored submission by id, including file metadata and files_url (the form inbox). Do not use this for live submit tests — POST to /s/:publicKey instead. Do not expect signed bucket URLs — download from the inbox.

  Paramètres, retour & exemple (1)

  Paramètres

  • submission_id · string · requis
    Submission id from list_submissions or a webhook payload.

  Exemple d'appel

  {"name": "get_submission", "arguments": {"submission_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_clients≈ 313 tokens

  Use to browse clients (companies). Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use to list websites — call list_projects with client_id. Archived clients are hidden unless status=all or archived.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Page size, max 100.
  • cursor · string · optionnel
    Opaque cursor from the previous page's next_cursor.
  • status · string · optionnel · active | archived | all
    Filter by archive state. Defaults to active.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

  Exemple d'appel

  {"name": "list_clients", "arguments": {"limit": 1, "cursor": "texte", "status": "active", "team_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_forms≈ 456 tokens

  Use to list forms. Pass project_id for one website or client_id for one company (team is inferred). Otherwise Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use to read resolved inheritance — call get_form.

  Paramètres, retour & exemple (6)

  Paramètres

  • limit · integer · optionnel
    Page size, max 100.
  • cursor · string · optionnel
    Opaque cursor from the previous page's next_cursor.
  • status · string · optionnel · active | archived | all
    Filter by archive state. Defaults to active.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.
  • client_id · string · optionnel
    Only forms under this client's projects.
  • project_id · string · optionnel
    Only forms in this project.

  Exemple d'appel

  {"name": "list_forms", "arguments": {"limit": 1, "cursor": "texte", "status": "active", "team_id": "texte", "client_id": "texte", "project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_projects≈ 401 tokens

  Use to browse websites. Pass client_id to list one client's sites (team is inferred). Without client_id, Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use to read one project's settings — call get_project. Archived projects are hidden unless status=all or archived.

  Paramètres, retour & exemple (5)

  Paramètres

  • limit · integer · optionnel
    Page size, max 100.
  • cursor · string · optionnel
    Opaque cursor from the previous page's next_cursor.
  • status · string · optionnel · active | archived | all
    Filter by archive state. Defaults to active.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.
  • client_id · string · optionnel
    Only projects under this client.

  Exemple d'appel

  {"name": "list_projects", "arguments": {"limit": 1, "cursor": "texte", "status": "active", "team_id": "texte", "client_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_submissions≈ 517 tokens

  Use to inspect recent posts. Available on free and yearly. Pass project_id or form_id to infer the team; omit both and Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Free teams prune submissions after 30 days; yearly after 730 days. Do not use to read a single submission — call get_submission.

  Paramètres, retour & exemple (7)

  Paramètres

  • spam · string · optionnel · clean | spam | unknown | all
    Which submissions to return. Defaults to clean.
  • limit · integer · optionnel
    Page size, max 100.
  • since · string · optionnel
    ISO 8601 timestamp; only submissions created after this instant.
  • cursor · string · optionnel
    Opaque cursor from the previous page's next_cursor.
  • form_id · string · optionnel
    Only submissions to this form.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.
  • project_id · string · optionnel
    Only submissions in this project.

  Exemple d'appel

  {"name": "list_submissions", "arguments": {"spam": "clean", "limit": 1, "since": "texte", "cursor": "texte", "form_id": "texte", "team_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_teams≈ 162 tokens

  Use to see workspaces this token can act on. A team-scoped frw_ token returns that team only. An operator token or an MCP OAuth login returns every team you belong to — pass team_id on list_clients, create_client, and bootstrap_site. Creating another workspace is dashboard-only after signing in and requires a yearly plan; free accounts stay on one team. Do not use this to list clients — call list_clients.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_teams", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• rotate_project_inbox≈ 206 tokens

  Use when a project's private inbox URL may have leaked. Issues a new inbox key; every previously shared inbox link stops working immediately. get_project returns the new files_url.

  Paramètres, retour & exemple (1)

  Paramètres

  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.

  Exemple d'appel

  {"name": "rotate_project_inbox", "arguments": {"project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• test_webhook≈ 210 tokens

  Use to POST a signed webhook.test event to the project's webhook URL. Available on free and yearly. Do not use this to inspect past deliveries — that is REST GET /api/projects/:id/webhook-deliveries. Fails if no webhook URL and secret are set.

  Paramètres, retour & exemple (1)

  Paramètres

  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.

  Exemple d'appel

  {"name": "test_webhook", "arguments": {"project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_account≈ 934 tokens

  Use to rename the workspace, set branding, or configure the AI spam filter. Pass ai.typesafe_api_key to save this team's TypeSafe key (null clears it; the key is write-only). ai.notify_suspected_spam (default true) emails notify addresses with a Potential spam label when Jev flags a submission; no webhook is sent either way. Heuristic spam stays silent. Free accounts cannot set branding.mode or email.footer_mode to anything but furrow — those writes are ignored. Yearly may set branding.mode to furrow, off, or agency (name + optional link + optional logo; Furrow keeps the layout, no raw HTML). Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use this to change the plan — call create_upgrade_link.

  Paramètres, retour & exemple (4)

  Paramètres

  • ai · object · optionnel
    AI spam filter. Off until this team saves its own TypeSafe key. One Jev call per heuristics-clean submission.
  • name · string · optionnel
    New workspace display name.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.
  • branding · object · optionnel
    Account-wide branding for notification emails and hosted pages.

  Exemple d'appel

  {"name": "update_account", "arguments": {"ai": {}, "name": "texte", "team_id": "texte", "branding": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_client≈ 194 tokens

  Use to rename a client. Do not use this to change domains, Turnstile, or webhooks — call update_project.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · optionnel
    New client display name.
  • client_id · string · requis
    Client id from list_clients or create_client.

  Exemple d'appel

  {"name": "update_client", "arguments": {"client_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_form≈ 1154 tokens

  Use to patch form overrides. Pass null on an override to inherit again. Set email.subject or email.intro to override project notification copy for this form only; from_name, footer_mode, and include_meta stay on the project. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Set webhook_url_override to override the project webhook for this form. Do not use this to change Turnstile keys — those live on the project. Checkbox groups, select multiple, and other multi-value HTML fields must use a [] suffix on the name (name="services[]") or only the last checked value is stored. Put services[] on field_contract.name too. JSON/fetch should send a real array without brackets ({ "services": ["a", "b"] }) and must not use Object.fromEntries(formData) — use formData.getAll("services"). Single checkbox, select, or combobox: no brackets. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet.

  Paramètres, retour & exemple (9)

  Paramètres

  • name · string · optionnel
    New form display name.
  • email · object · optionnel
    Per-form subject and intro overrides for the notification email.
  • form_id · string · requis
    Form id from list_forms, create_form, or bootstrap_site.
  • field_contract · ? · optionnel
    Declared fields (name, type, label, report). Drives get_snippet and the email layout. Null clears it.
  • webhook_url_override · ? · optionnel
    Webhook endpoint for this form only. Null inherits the project webhook.
  • redirect_url_override · ? · optionnel
    Success redirect for this form only. Null inherits default_redirect_url.
  • notify_emails_override · ? · optionnel
    Recipients for this form only. Null inherits the project's notify_emails.
  • webhook_secret_override · ? · optionnel
    HMAC secret for this form's webhook. Null inherits the project secret.
  • require_turnstile_override · ? · optionnel
    Force Turnstile on or off for this form. Null inherits the project setting.

  Exemple d'appel

  {"name": "update_form", "arguments": {"form_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_project≈ 1845 tokens

  Use to patch website settings. Nested email sets notification templates: email.subject, email.from_name, email.intro, email.footer_mode (furrow | minimal | off), email.include_meta. Optional branding updates the team (mode furrow | off | agency on yearly only; ignored on free except furrow). Set uploads_enabled and upload_allowed_types here — forms inherit them. Email templates support {{project.name}}, {{project.slug}}, {{form.name}}, {{form.slug}}, {{count}} (1-based clean submissions on this form, including the current one), and any submission field such as {{name}} or {{email}}. Use a fallback with {{name | "New submission"}}. Missing fields render empty and never error. Do not pass HTML; Furrow renders one owned layout. Plans are capacity, not a feature ladder. Free: one workspace, 100 clean submissions/month pooled on the team, 3 active (non-archived) projects, 30-day submission retention, and email.footer_mode / branding.mode stay furrow. Yearly ($199/year): extra workspaces, 10,000 submissions/month, unlimited projects, 730-day retention, branding.mode furrow | off | agency. Expansion packs are $99/year each and add 5,000 submissions/month on a yearly account. MCP, webhooks, snippets, inheritance, Turnstile, and email templates stay available on free. Spam, honeypot, and rejected posts do not count. Use create_upgrade_link to hand a human a Stripe Checkout (or Customer Portal) URL. Pass product=expansion on a yearly team to add a pack. File inputs use multipart POST (name="resume[]" for multiple). Enable uploads on the project first. Downloads are the project inbox at files_url, with the form slug as a folder — never put that URL in a public snippet. Null Turnstile or webhook fields clear them. Do not use this to create forms. Updating project keys changes resolved settings on existing forms unless a form override is set.

  Paramètres, retour & exemple (21)

  Paramètres

  • name · string · optionnel
    New project display name.
  • email · object · optionnel
    Notification email template for the project: subject, from_name, intro, footer_mode, include_meta.
  • branding · object · optionnel
    Per-project branding override for notification emails and hosted pages.
  • from_name · ? · optionnel
    Legacy From display name. Prefer email.from_name.
  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.
  • webhook_url · ? · optionnel
    Public https endpoint that receives a signed JSON POST per clean submission. Null disables it.
  • notify_emails · array · optionnel
    Replace the notification recipients (max 10).
  • honeypot_field · string · optionnel
    Name of the hidden honeypot input the snippet emits. Defaults to _gotcha.
  • webhook_secret · ? · optionnel
    HMAC-SHA256 secret for the X-Furrow-Signature header. Omit to have one generated and returned.
  • allowed_domains · array · optionnel
    Replace the allowed hostnames. Empty array accepts any origin.
  • uploads_enabled · boolean · optionnel
    Accept multipart file fields on this project's forms.
  • turnstile_secret · ? · optionnel
    Cloudflare Turnstile secret used to verify tokens server-side. Null removes it.
  • upload_max_files · integer · optionnel
    Max files per submission (up to 20).
  • rate_limit_per_ip · integer · optionnel
    Max submissions per IP within rate_limit_window_s.
  • require_turnstile · boolean · optionnel
    Reject submissions that lack a valid Turnstile token.
  • turnstile_site_key · ? · optionnel
    Cloudflare Turnstile site key for the frontend widget. Null removes it.
  • rate_limit_window_s · integer · optionnel
    Rate-limit window in seconds (max 86400).
  • default_redirect_url · ? · optionnel
    Where classic HTML posts redirect after success. Null returns JSON/inline success instead.
  • upload_allowed_types · array · optionnel
    Allowed upload MIME types, e.g. application/pdf or image/*.
  • upload_max_file_bytes · integer · optionnel
    Max bytes per file (up to 25 MB).
  • upload_max_total_bytes · integer · optionnel
    Max total upload bytes per submission (up to 50 MB).

  Exemple d'appel

  {"name": "update_project", "arguments": {"project_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_team≈ 278 tokens

  Use to rename a team. Operator tokens (all workspaces) must pass team_id from list_teams. Team-scoped tokens may omit team_id and cannot target another workspace. Do not use this to create another workspace — that is dashboard-only and requires yearly. For plan, usage, retention, and branding, call get_account / update_account. Do not use this to change clients or projects.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    New team (workspace) display name.
  • team_id · string · optionnel
    Team id from list_teams. Required for operator tokens and OAuth logins; team-scoped frw_ tokens may omit it.

  Exemple d'appel

  {"name": "update_team", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• upsert_project_webhook≈ 316 tokens

  Use to set or replace the project webhook URL. Available on free and yearly. A signing secret is generated once if the project has none. Forms inherit this unless webhook_url_override is set. Do not use this for a one-off delivery — call test_webhook.

  Paramètres, retour & exemple (3)

  Paramètres

  • project_id · string · requis
    Project (website) id from list_projects, create_project, or bootstrap_site.
  • webhook_url · ? · requis
    Public https endpoint that receives a signed JSON POST per clean submission. Null disables it.
  • webhook_secret · ? · optionnel
    HMAC-SHA256 secret for X-Furrow-Signature. Omit to have one generated and returned.

  Exemple d'appel

  {"name": "upsert_project_webhook", "arguments": {"project_id": "texte", "webhook_url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.furrowforms.com/mcp