
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
mcp-google-forms
Advanced tools
MCP server for the Google Forms API — create forms, manage questions, publish, read responses and watch for new submissions. For Claude, Cursor, Codex and other AI clients.
English | Русский
A1 Google Forms MCP lets an AI app build and manage Google Forms in plain language. Create a survey, choose its questions, publish it when ready, read answers and use notifications for new submissions.
It uses the Google Forms API with your Google account. It distinguishes a draft form from a published form and makes the limits of the Forms API explicit instead of implying that every form task is possible.
forms.body and forms.responses.readonly, without broad Drive access.Start with a read-only question:
Show me yesterday’s responses to the customer feedback form and summarize the free-text answers.
Connect the server · Explore use cases · Open technical documentation
You: Show me the questions and response settings of the customer feedback form.
Assistant: Shows the form, its items, whether it is published and whether it accepts responses. Nothing changes.
You: Prepare a required 1–5 rating question called “How was your experience?” after the first question.
Assistant: Shows the target form, position and proposed question, then asks for confirmation before adding it.
You: Confirm.
Assistant: Adds the question to the form. It does not publish or close the form unless you ask separately.
You need Node.js 20+, a Google account and OAuth credentials from a Google Cloud project with the Google Forms API enabled.
In the app: open Settings → Plugins → MCP servers, select Add server, then add npx -y mcp-google-forms@latest with GOOGLE_FORMS_CLIENT_ID, GOOGLE_FORMS_CLIENT_SECRET and GOOGLE_FORMS_REFRESH_TOKEN.
From the command line:
codex mcp add google-forms \
--env GOOGLE_FORMS_CLIENT_ID=your_client_id \
--env GOOGLE_FORMS_CLIENT_SECRET=your_client_secret \
--env GOOGLE_FORMS_REFRESH_TOKEN=your_refresh_token \
-- npx -y mcp-google-forms@latest
codex mcp list
claude mcp add \
--env GOOGLE_FORMS_CLIENT_ID=your_client_id \
--env GOOGLE_FORMS_CLIENT_SECRET=your_client_secret \
--env GOOGLE_FORMS_REFRESH_TOKEN=your_refresh_token \
--transport stdio --scope user google-forms \
-- npx -y mcp-google-forms@latest
claude mcp list
Open Settings → Developer → Edit Config and add:
{
"mcpServers": {
"google-forms": {
"command": "npx",
"args": ["-y", "mcp-google-forms@latest"],
"env": {
"GOOGLE_FORMS_CLIENT_ID": "your_client_id",
"GOOGLE_FORMS_CLIENT_SECRET": "your_client_secret",
"GOOGLE_FORMS_REFRESH_TOKEN": "your_refresh_token"
}
}
}
}
If Edit Config is unavailable, edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows.
Add this to ~/.cursor/mcp.json on macOS/Linux or %USERPROFILE%\.cursor\mcp.json on Windows:
{
"mcpServers": {
"google-forms": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-google-forms@latest"],
"env": {
"GOOGLE_FORMS_CLIENT_ID": "your_client_id",
"GOOGLE_FORMS_CLIENT_SECRET": "your_client_secret",
"GOOGLE_FORMS_REFRESH_TOKEN": "your_refresh_token"
}
}
}
}
Run MCP: Open User Configuration and add:
{
"servers": {
"google-forms": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-google-forms@latest"],
"env": {
"GOOGLE_FORMS_CLIENT_ID": "${input:forms_client_id}",
"GOOGLE_FORMS_CLIENT_SECRET": "${input:forms_client_secret}",
"GOOGLE_FORMS_REFRESH_TOKEN": "${input:forms_refresh_token}"
}
}
},
"inputs": [
{ "type": "promptString", "id": "forms_client_id", "description": "Google OAuth client ID" },
{ "type": "promptString", "id": "forms_client_secret", "description": "Google OAuth client secret", "password": true },
{ "type": "promptString", "id": "forms_refresh_token", "description": "Google OAuth refresh token", "password": true }
]
}
Check it with MCP: List Servers.
create_form creates a form, which starts unpublished by default.File-upload questions cannot be created through the Forms API, although existing file-upload items can be read. Legacy forms created before Google’s publish model may not support publishing settings.
| Operation | What happens | Confirmation boundary |
|---|---|---|
| Read a form and its responses | Reads form structure and submissions | No change |
| Create a form | Adds an unpublished form | Changes Google Forms |
| Add or move a question | Changes form items | Changes a form |
| Update form info, settings or an item | Changes title, settings or a selected question | Changes a form |
| Publish, unpublish, open or close responses | Changes who can use the form | Changes a form’s public availability |
| Delete an item | Removes a selected question | Destructive |
| Manage a Pub/Sub watch | Creates, renews or deletes notification delivery | Potentially destructive |
| Raw API request | Can call API methods without a dedicated tool | Potentially destructive |
The AI client controls confirmation prompts. The server marks reads, writes and destructive tools so the client can distinguish an inspection from a live change.
Google Forms requires OAuth 2.0; an API key is not enough.
Create or select a Google Cloud project and enable Google Forms API.
Configure the OAuth consent screen and create a Desktop app OAuth client.
Authorize the Google account that owns or can edit the forms. The OAuth 2.0 Playground can obtain the refresh token when Use your own OAuth credentials is enabled.
Request both scopes:
https://www.googleapis.com/auth/forms.body
https://www.googleapis.com/auth/forms.responses.readonly
Testing-mode OAuth refresh tokens can expire after seven days. Publish the OAuth app, or use an Internal app in a Workspace domain, when you need long-lived access. Treat the client secret and refresh token as passwords.
| Variable | Required | Description |
|---|---|---|
GOOGLE_FORMS_CLIENT_ID | Yes* | OAuth client ID. |
GOOGLE_FORMS_CLIENT_SECRET | Yes* | OAuth client secret. |
GOOGLE_FORMS_REFRESH_TOKEN | Yes* | OAuth refresh token. |
GOOGLE_FORMS_ACCESS_TOKEN | Yes* | Short-lived alternative to the OAuth trio. |
GOOGLE_FORMS_API_BASE | No | Google Forms API base URL override. |
GOOGLE_FORMS_TIMEOUT_MS | No | Per-request timeout; default 60000 ms. |
GOOGLE_FORMS_MAX_RETRIES | No | Temporary-error retries; default 3. |
* Provide either the OAuth trio or an access token.
ASKADS_TELEMETRY=0 to opt out.list_responses calls and 375 writes. On 429, the server uses backoff; reads also retry after network and 5xx errors, while writes are not replayed after an uncertain failure.Found a bug or need a scenario? Create an issue or write in Telegram.
You made it to the end!
FAQs
MCP server for the Google Forms API — create forms, manage questions, publish, read responses and watch for new submissions. For Claude, Cursor, Codex and other AI clients.
We found that mcp-google-forms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.