
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
mcp-google-forms
Advanced tools
MCP server for the Google Forms API — create forms, manage questions, publish, read responses and watch for new submissions. For Claude, Cursor, Codex and other AI clients.
English | Русский
A1 Google Forms MCP lets an AI app build and manage Google Forms in plain language. Create a survey, choose its questions, publish it when ready, read answers and use notifications for new submissions.
It uses the Google Forms API with your Google account. It distinguishes a draft form from a published form and makes the limits of the Forms API explicit instead of implying that every form task is possible.
127.0.0.1 with PKCE and keeps the tokens itself — no config files, no restart.forms.body and forms.responses.readonly, without broad Drive access.Start with a read-only question:
Show me yesterday’s responses to the customer feedback form and summarize the free-text answers.
Connect the server · Explore use cases · Open technical documentation
You: Show me the questions and response settings of the customer feedback form.
Assistant: Shows the form, its items, whether it is published and whether it accepts responses. Nothing changes.
You: Prepare a required 1–5 rating question called “How was your experience?” after the first question.
Assistant: Shows the target form, position and proposed question, then asks for confirmation before adding it.
You: Confirm.
Assistant: Adds the question to the form. It does not publish or close the form unless you ask separately.
You need Node.js 20+ and a Google account. Credentials are not required at install time — the server connects from the conversation.
In the app: open Settings → MCP servers, select Add server, choose STDIO, enter the command npx -y mcp-google-forms@latest and environment variables GOOGLE_FORMS_CLIENT_ID, GOOGLE_FORMS_CLIENT_SECRET, GOOGLE_FORMS_REFRESH_TOKEN, then select Save and Restart.
From the command line:
codex mcp add google-forms \
-- npx -y mcp-google-forms@latest
codex mcp list
claude mcp add \
--transport stdio --scope user google-forms \
-- npx -y mcp-google-forms@latest
claude mcp list
The current official path is Settings → Extensions. For a custom desktop extension, open Advanced settings → Extension Developer → Install Extension…, select a .mcpb file and follow the prompts.
This repository currently publishes an npm stdio package and does not contain a .mcpb bundle. For Claude Desktop builds that still support local configuration, use the following JSON stdio configuration as a fallback:
{
"mcpServers": {
"google-forms": {
"command": "npx",
"args": ["-y", "mcp-google-forms@latest"]
}
}
}
In those builds, save it to ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows.
Add this to ~/.cursor/mcp.json on macOS/Linux or %USERPROFILE%\.cursor\mcp.json on Windows:
{
"mcpServers": {
"google-forms": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-google-forms@latest"]
}
}
}
Run MCP: Open User Configuration and add:
{
"servers": {
"google-forms": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-google-forms@latest"]
}
}
}
Check it with MCP: List Servers.
create_form creates a form, which starts unpublished by default.File-upload questions cannot be created through the Forms API, although existing file-upload items can be read. Legacy forms created before Google’s publish model may not support publishing settings.
| Operation | What happens | Confirmation boundary |
|---|---|---|
| Read a form and its responses | Reads form structure and submissions | No change |
| Create a form | Adds an unpublished form | Changes Google Forms |
| Add or move a question | Changes form items | Changes a form |
| Update form info, settings or an item | Changes title, settings or a selected question | Changes a form |
| Publish, unpublish, open or close responses | Changes who can use the form | Changes a form’s public availability |
| Delete an item | Removes a selected question | Destructive |
| Manage a Pub/Sub watch | Creates, renews or deletes notification delivery | Potentially destructive |
| Raw API request | Can call API methods without a dedicated tool | Potentially destructive |
The AI client controls confirmation prompts. The server marks reads, writes and destructive tools so the client can distinguish an inspection from a live change.
Google Forms requires OAuth 2.0; an API key is not enough. There are two ways in, and the first one needs no configuration files.
Say "connect Google Forms" and the assistant runs the flow with you:
setup_instructions prints the checklist: create or select a Google Cloud project, enable Google Forms API, configure the consent screen and create a Desktop app OAuth client.set_client stores it owner-only. The secret never goes through the conversation.start_login returns a Google consent link. Open it on this machine and approve; the code comes back to a one-shot listener on 127.0.0.1 (PKCE), never through the chat.finish_login exchanges the code and saves the tokens to ~/.config/mcp-google-forms/credentials.json (mode 0600).The tokens are re-read on every call, so the connection works immediately — no restart of the AI app. auth_status shows what is connected, logout revokes and deletes it.
Create or select a Google Cloud project and enable Google Forms API.
Configure the OAuth consent screen and create a Desktop app OAuth client.
Authorize the Google account that owns or can edit the forms. The OAuth 2.0 Playground can obtain the refresh token when Use your own OAuth credentials is enabled.
Request both scopes:
https://www.googleapis.com/auth/forms.body
https://www.googleapis.com/auth/forms.responses.readonly
Testing-mode OAuth refresh tokens can expire after seven days. Publish the OAuth app, or use an Internal app in a Workspace domain, when you need long-lived access. Treat the client secret and refresh token as passwords.
Every variable is optional — with none of them the server connects from the chat.
| Variable | Required | Description |
|---|---|---|
GOOGLE_FORMS_CLIENT_ID | No* | OAuth client ID. |
GOOGLE_FORMS_CLIENT_SECRET | No* | OAuth client secret. |
GOOGLE_FORMS_REFRESH_TOKEN | No* | OAuth refresh token. |
GOOGLE_FORMS_ACCESS_TOKEN | No* | Short-lived alternative to the OAuth trio. |
GOOGLE_FORMS_OAUTH_PORT | No | Fixed loopback port for the in-chat login; useful over SSH port forwarding. |
GOOGLE_FORMS_API_BASE | No | Google Forms API base URL override. |
GOOGLE_FORMS_TIMEOUT_MS | No | Per-request timeout; default 60000 ms. |
GOOGLE_FORMS_MAX_RETRIES | No | Temporary-error retries; default 3. |
* Provide either the OAuth trio or an access token.
ASKADS_TELEMETRY=0 to opt out.list_responses calls and 375 writes. On 429, the server uses backoff; reads also retry after network and 5xx errors, while writes are not replayed after an uncertain failure.Found a bug or need a scenario? Create an issue or write in Telegram.
You made it to the end!
FAQs
MCP server for the Google Forms API — create forms, manage questions, publish, read responses and watch for new submissions. For Claude, Cursor, Codex and other AI clients.
The npm package mcp-google-forms receives a total of 211 weekly downloads. As such, mcp-google-forms popularity was classified as not popular.
We found that mcp-google-forms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.