
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@furrowforms/mcp
Advanced tools
Furrow Forms MCP server over stdio — a form backend your agent can register, provision, and verify on its own.
Furrow Forms is a form backend an agent can run end to end — register the account, provision a site's forms in one call, generate the frontend snippet, filter spam, and verify HMAC-signed webhooks — over MCP and REST, with no dashboard in the loop.
This package is the stdio entry point for clients that can't speak
streamable HTTP directly. It bridges to the hosted server at
https://api.furrowforms.com/mcp and exposes all 26 tools, including
bootstrap_site.
FURROW_TOKEN=frw_... npx -y @furrowforms/mcp
No token yet? Leave FURROW_TOKEN unset and the bridge runs the OAuth flow
in your browser — or let your agent mint one via the API:
GET https://api.furrowforms.com/api/register explains the flow (you read
one 6-digit email code).
Claude Code
claude mcp add furrow-forms -e FURROW_TOKEN=frw_... -- npx -y @furrowforms/mcp
# or, hosted (no bridge):
claude mcp add --transport http furrow-forms https://api.furrowforms.com/mcp --header "Authorization: Bearer frw_..."
Cursor / Windsurf / Claude Desktop (mcp.json / claude_desktop_config.json)
{
"mcpServers": {
"furrow-forms": {
"command": "npx",
"args": ["-y", "@furrowforms/mcp"],
"env": { "FURROW_TOKEN": "frw_..." }
}
}
}
Clients that support remote servers can skip the bridge and use
{ "url": "https://api.furrowforms.com/mcp", "headers": { "Authorization": "Bearer frw_..." } }.
bootstrap_site — client + project (domains, Turnstile, notify emails, webhook) + every form, idempotentget_snippet — HTML / Astro / Next.js form code with honeypot and timing field wiredtest_webhook — signed test delivery, verify 200 OKFull agent instructions: https://furrowforms.com/ai · Docs: https://furrowforms.com/docs/mcp
| Var | Purpose |
|---|---|
FURROW_TOKEN | frw_… bearer token. Optional if you want OAuth instead. |
FURROW_MCP_URL | Override the server URL (self-hosted / local dev). |
MIT
FAQs
Furrow Forms MCP server over stdio — a form backend your agent can register, provision, and verify on its own.
The npm package @furrowforms/mcp receives a total of 39 weekly downloads. As such, @furrowforms/mcp popularity was classified as not popular.
We found that @furrowforms/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.