Gravity Forms
+ MCP Server Premium

Let AI agents work with your forms, safely. The Gravity Forms MCP Server Premium Add-on adds a secure Model Context Protocol (MCP) endpoint to your site — the open standard that Claude, ChatGPT, Copilot and other agents speak — so an agent can list your forms, read a form’s fields, and, when you allow it, read entries or submit a form, all over one token-scoped API on your own server.

Security is the whole point, so the defaults are strict. Every agent connects with its own bearer token, and a token is read-only until you grant it more. A token only ever sees the forms you add to its allow-list, nothing else. Entries stay completely private until you opt a form in for entry reading, and writing or triggering an action is off unless you switch it on for that token and that form. Each token has its own rate limit, and every single call — who, what, which form, when, from where — is written to an audit log.

It is own-code through and through. The add-on is a bridge between the WordPress REST API and MCP; it calls no outside service, needs no account and sends your form data nowhere. Token secrets are encrypted at rest, client IPs in the audit log are hashed, and uninstalling removes every option it stored.

The add-on registers one token-authenticated REST route that speaks the Model Context Protocol (JSON-RPC 2.0): initialize, tools/list and tools/call. On every call it verifies the bearer token, applies the token's per-minute rate limit, checks the scope and the per-form allow-list (and, for entries and writes, the admin's per-form opt-in), runs the tool against the Gravity Forms API, and writes an audit row. Token secrets are encrypted at rest and client IPs are hashed. Everything happens on your server; nothing is sent to any outside service.