Connect to the Makeform MCP server

Use the Makeform MCP server to manage forms and related data from an MCP client. It uses streamable HTTP at https://mcp.makeform.ai.

Connect your client

Send JSON-RPC requests to the server with POST. Replies arrive as text/event-stream frames. Include Accept: application/json, text/event-stream. The server is stateless and does not use a session ID header. It does not support a standalone GET stream. A request can run for at most 300 seconds.

For Codex, add the server with an API key available in the MAKEFORM_API_KEY environment variable:

For a client that accepts an HTTP server configuration, use:

Send an API key or OAuth access token as a Bearer token. API keys need the makeform:mcp or makeform:api scope. Missing or invalid tokens return HTTP 401, separately from tool errors. A missing token has the name missing_api_key; a bad token has the name invalid_token. See MCP authentication for setup and details.

What you can do

The server provides 33 tools to inspect your workspace, create and update form drafts, publish forms, retrieve submission data, view analytics, and manage integrations. It also provides open_makeform_app for clients that support opening the Makeform app UI. Reads do not change your data. Every call, including reads, attempts to append a private execution audit record.

• Forms: read: list forms, inspect form configuration, get embed packages, and view form statistics.
• Forms: write: create and update drafts, propose and apply changes, translate, duplicate, and publish forms.
• Submissions and analytics: list and retrieve submissions, export CSV, and get analytics summaries and trends.
• Webhooks: create, list, test, and delete webhooks.
• Email notifications: update owner or respondent notification settings.
• Headless (Beta): create Headless forms, manage endpoints, and create endpoint API keys.

For a recommended first run, call get_workflow_guide, then get_workspace, then list_forms.

Creating a form creates a draft. Publishing requires a preview followed by a confirmation call. The publish_token from the preview expires after 10 minutes. Reviewed draft updates and AI edits use a propose-and-apply workflow. update_form is also available for an immediate direct write, but every update_form call requires expected_updated_at, equal to the updated_at returned by get_form. Without it, the error is precondition_required and data.current_updated_at gives the current value. Replacing preview_config with a stale value returns conflict. It never publishes. Changes made with update_form_settings and update_email_notification apply to published forms immediately, without a publish step. See the draft and publish workflow.

delete_webhook and create_headless_api_key also require a confirmation call with a token. The delete_token for delete_webhook expires after 5 minutes; the key_token for create_headless_api_key expires after 10 minutes.

MCP cannot delete forms, manage custom domains, configure Turnstile secrets for Headless endpoints, edit webhook headers or enablement, or upload image files. Delete forms and manage custom domains, Turnstile secrets, and webhook headers or enablement in the dashboard. To upload an image, use the REST API, then attach it with update_form.

Results and errors

Successful tool results contain JSON text in content[0].text and structuredContent matching the tool's outputSchema.

Tool errors arrive with HTTP 200 and result.isError: true. Validation errors have code -32602; business rule errors often have code -32600 and a name in data, such as conflict. Unexpected errors have code -32603. Input schema errors start with MCP error -32602: Input validation error. Naming a tool that does not exist returns Tool not found.

Authentication failures return HTTP 401 with this response when no token is provided:

Rate limit

The server allows 60 requests per minute, counted per API key or per OAuth client and user. Requests can be rate limited; the response is HTTP 429 with JSON-RPC error -32029 and data.retry_after_seconds, and includes a Retry-After header. Wait for that value before retrying.