Skip to main content
Free - like the rest of the MCP server, list_submissions is not plan-gated.
Lets an agent check a form’s inbox or quarantine without opening the dashboard — useful for a prompt like “did anyone submit the contact form today?” By default this returns metadata only; the visitor’s message body and any submitted email address are withheld unless you explicitly ask for them.

Input schema

Example call

Returned shape (default - metadata only)

Metadata-only by default: the PII posture

Form submissions routinely contain a visitor’s name, email address, and free-text message - that’s third-party personal data, not the form owner’s own. list_submissions treats that as sensitive by default: unless you pass includeContent: true, the data field is omitted entirely from every submission in the response, and only id / created_at / folder / status come back. Set includeContent: true to get the submitted fields:
Only opt into includeContent when the task actually needs the message text or visitor’s email - e.g. summarizing recent feedback. For a presence/count check (“has anyone submitted today?”), the default metadata-only response is enough and keeps visitor content out of the agent’s context.

Errors

A formId that doesn’t exist, or isn’t owned by the account behind the token, returns:
An invalid or revoked token returns the same auth error as every MCP tool - see MCP server.

Quarantine

What lands in the spam folder, and why.

create_form

Where the formId you’d pass here comes from.