Developers

MCP server

GRTforms exposes a remote Model Context Protocol server at /api/mcp. It wraps REST API v1 with the same scoped API keys and per-key rate limits. There is no separate OAuth path — paste a key you created in the dashboard.

REST API documentation

1. Create an API key

  1. Sign in and open Account → API Keys.
  2. Create a key. For form creation include forms:write. Add forms:read, entries:read, and webhooks:write for the other tools.
  3. Copy the key once. It looks like grt_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.

2. Cursor

Add a Streamable HTTP server to your MCP client config. Replace the placeholder key with yours.

json
{
  "mcpServers": {
    "grtforms": {
      "url": "https://grtforms.com/api/mcp",
      "headers": {
        "Authorization": "Bearer grt_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

3. Claude Desktop

Clients that support a remote MCP URL use the same shape. If your build only supports a local command, point it at this URL with the Bearer header.

json
{
  "mcpServers": {
    "grtforms": {
      "url": "https://grtforms.com/api/mcp",
      "headers": {
        "Authorization": "Bearer grt_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Transport

The endpoint is Streamable HTTP as defined by the MCP specification. Clients send JSON-RPC over POST. The server can answer with JSON or a request-scoped SSE stream. Protocol versions 2025-03-26 through 2025-11-25 also use MCP-Session-Id, GET SSE, and DELETE to end a session. Send MCP-Protocol-Version on later clients; a missing header is treated as 2025-03-26.

Browser clients must send a known Origin. Unknown Origins are rejected to prevent DNS rebinding. Native clients that omit Origin still work. CORS reflects an allowed Origin and does not use *. Extra browser Origins can be added with ALLOWED_ORIGINS.

Server card

A public Server Card (identity, Streamable HTTP URL, and API-key header) is at /.well-known/mcp/server-card.json. It does not list tools — those stay behind tools/list with a scoped key.

https://grtforms.com/.well-known/mcp/server-card.json

Tools

  • create_form — Create Form, unpublished draft (forms:write)
  • list_forms / get_form — List Forms / Get Form (forms:read)
  • list_submissions — List Submissions, paginated (entries:read)
  • list_webhooks, create_webhook, delete_webhook — List / Create / Delete Webhook (webhooks:write)

Every tool includes a title and MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint). A key without a required scope receives the same forbidden error as REST API v1.

A draft Official MCP Registry manifest lives in this repository and is not published. Listing in a directory or registry is an owner decision and is not done from this page.