
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
formpaste-mcp
Advanced tools
Create and wire up contact forms from your coding agent. Six tools for forms, snippets, and submissions.
Create and wire up contact forms from your coding agent. Six tools for forms, snippets, and submissions.
This package is a thin wrapper that launches mcp-remote pointed at the hosted Formpaste MCP server (https://api.formpaste.com/mcp, streamable-http transport). The equivalent manual mcp-remote config works identically; this package exists mainly so agents and clients can discover and install Formpaste's MCP server by name, not because it does anything the manual config cannot.
Each client below is configured to talk to the hosted MCP endpoint at https://api.formpaste.com/mcp. Replace fpat_YOUR_TOKEN with a token minted from Settings -> API & MCP.
claude mcp add formpaste --transport http https://api.formpaste.com/mcp \
--header "Authorization: Bearer fpat_YOUR_TOKEN"
# ~/.codex/config.toml
[mcp_servers.formpaste]
command = "npx"
args = ["mcp-remote", "https://api.formpaste.com/mcp", "--header", "Authorization: Bearer fpat_YOUR_TOKEN"]
// .cursor/mcp.json
{
"mcpServers": {
"formpaste": { "command": "npx", "args": ["mcp-remote", "https://api.formpaste.com/mcp", "--header", "Authorization: Bearer fpat_YOUR_TOKEN"] }
}
}
// claude_desktop_config.json
{
"mcpServers": {
"formpaste": { "command": "npx", "args": ["mcp-remote", "https://api.formpaste.com/mcp", "--header", "Authorization: Bearer fpat_YOUR_TOKEN"] }
}
}
// .vscode/mcp.json
{
"servers": {
"formpaste": { "command": "npx", "args": ["mcp-remote", "https://api.formpaste.com/mcp", "--header", "Authorization: Bearer fpat_YOUR_TOKEN"] }
}
}
FORMPASTE_TOKEN=fpat_YOUR_TOKEN npx formpaste-mcp
formpaste-mcp reads FORMPASTE_TOKEN from the environment (or a --token flag) and starts mcp-remote against the hosted endpoint for you.
| Tool | Purpose | Scope |
|---|---|---|
create_form | Create a form, return its access key and a wired snippet | setup |
get_snippet | Return a copy-paste snippet for html/react/nextjs/astro/vue/svelte | setup |
list_forms | List all forms with ids, names, access keys, inbox/spam counts | setup |
get_form | Read one form's config to verify it is wired correctly | setup |
send_test_submission | Store a test submission to prove a form is live | setup |
list_submissions | List submissions, optionally including message bodies | full |
Formpaste API tokens have two scopes:
full can do everything, including reading submission content via list_submissions.setup can do everything except list_submissions, so it never reads third-party submission content.Use a setup-scoped token for agent use. It covers form creation, snippets, and verifying that a form is wired correctly, without granting access to the data your forms collect.
See examples/wire-a-form.md for a full walkthrough: create a form, get a snippet, paste it into a page, send a test submission, and confirm the form is wired correctly.
FAQs
Create and wire up contact forms from your coding agent. Six tools for forms, snippets, and submissions.
We found that formpaste-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.