Jotform Apps
by Jotform Apps
Build and edit Jotform Apps — published multi-page portals that collect real submissions — from your AI agent. Six tools including an undocumented REST dispatcher, OAuth with a readOnly/full scope pair, and no permissions label in Anthropic's directory.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Jotform Apps via MCP
https://mcp.jotform.com/mcp-jotform-apps-v1Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Jotform Apps Tools & Capabilities (6)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- No permissions label to read. Anthropic's directory record for this connector carries no
permissionsfield at all, while listing two write tools and a REST dispatcher. The usual Read / Read and write signal is simply not there. - The dispatcher makes the tool count misleading.
mcp_app_requestreaches Jotform's documented REST endpoints across five HTTP verbs. Any risk assessment based on "six tools" is sized wrong. mcp_app_requestis documented only for a sibling server. Jotform describes it, and its private marking, on the Sign tab. Whether the Apps server applies the same marking is not stated anywhere we could find.- Write access is all-or-nothing.
readOnlyandfullare the only scopes advertised. There is no app-only write scope, so granting edit rights grants account-wide rights. - We could not read the live tool surface. The endpoint returns 401 to an anonymous handshake, so no schemas, safety annotations, prompts or resources were readable to us. Tool names come from Anthropic's directory; behaviour comes from Jotform's documentation.
- Tool names disagree between sources. Jotform's table uses hyphens where the directory uses underscores for three of the six.
- Bearer tokens are not supported. Jotform requires OAuth for all connections, which rules out headless agents that cannot complete an interactive consent.
- A UI-rendering client is required. This server ships interactive components; a text-only MCP client is not the intended target, and Jotform lists that capability as a requirement rather than a nice-to-have.
- No documented undo for MCP edits. Nothing in Jotform's MCP pages describes version history, a confirmation gate, or a rollback for changes an agent makes to a published app.
- Compliance guidance is absent, despite health-life-sciences and education categories. See above.
Frequently asked questions
Is Jotform Apps the same connector as the Jotform MCP server?
No. Jotform runs four separate MCP endpoints and this is one of them. Jotform's developer page documents a standard server at mcp.jotform.com for forms and submissions, plus three interactive variants: Jotform for forms, Jotform Apps for portals, and Jotform Sign for signable documents. Each has its own URL and its own tool set, so connecting one gives you none of the others.
Can the Jotform Apps connector edit an app that is already live?
Yes. Jotform documents edit_app as editing an existing app from instructions, with a visual editor for pages and elements, and nothing in the documentation restricts it to drafts. Jotform Apps are published portals shared by link or QR code that bundle forms, payments and donations, so an edit reaches whatever your users see next.
What does the mcp_app_request tool actually do?
It is a general-purpose dispatcher over Jotform's REST API. Jotform's own table describes it as a fallback for documented REST endpoints across GET, POST, PUT, PATCH and DELETE when no dedicated tool covers the action, limited to your account and granted scopes. That single entry makes the real write surface the whole API, not the five named tools beside it.
Does Anthropic's directory say whether Jotform Apps can write?
No — the record carries no permissions field at all. Most catalogue entries show a Read or Read and write label; this one shows nothing, while listing create_app, edit_app and a REST dispatcher among its six tools. Read the tool list rather than the missing label, and treat this connector as write-capable by default.
Can I use the Jotform Apps MCP server with HIPAA or FERPA data?
Jotform's MCP documentation does not say. It is silent on HIPAA-enabled accounts, on FERPA, and on whether MCP access is gated for either, even though Anthropic lists this connector under health-life-sciences and education. Jotform sells HIPAA-enabled forms with a Business Associate Agreement separately, but never connects that programme to MCP. Ask Jotform before connecting a regulated account.
Which OAuth scopes does the Jotform Apps MCP server request?
Two, and only one of them is narrow. The server's own RFC 9728 descriptor advertises readOnly and full, verified live on 2026-08-19. There is no separate app-write or forms-only scope, so an agent that needs to create or edit anything must be granted full — which covers every Jotform resource your account can reach, not just apps.
Do I need a paid Jotform plan for the Jotform Apps connector?
Jotform does not state a plan requirement for this connector. Its requirements list names three things: a Jotform account with access to Jotform Apps, a client that can render interactive UI, and one-time OAuth approval. Jotform's separate note on the standard MCP server adds that only workspace admins can install the underlying Jotform MCP app.
Sources
- Jotform MCP Server documentation, MCP App tab — https://www.jotform.com/developers/mcp/?tab=mcp-app (fetched 2026-08-19; the page is client-rendered and serves an "Unsupported Browser" stub to a default curl user agent, so a current browser UA is required) · retrieved 2026-08-19
- Jotform MCP Server documentation, standard MCP tab — https://www.jotform.com/developers/mcp/?tab=mcp (fetched 2026-08-19; source of the OAuth, revocation and bearer-token statements) · retrieved 2026-08-19
- Jotform Apps product page — https://www.jotform.com/products/apps/ (fetched 2026-08-19) · retrieved 2026-08-19
- Jotform HIPAA-enabled forms — https://www.jotform.com/hipaa/ (fetched 2026-08-19; contains no reference to MCP) · retrieved 2026-08-19
- Live anonymous probe — 2026-08-19:
POSTto the endpoint returns HTTP 401 with body{"message":"NO_AUTH_HEADER"};GETreturns 401 · retrieved 2026-08-19 - Live RFC 9728 protected-resource descriptor — https://mcp.jotform.com/.well-known/oauth-protected-resource and the
/mcp-jotform-apps-v1path-insert form (both 200, fetched 2026-08-19); the path-append form returns 401 · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://mcp.jotform.com/.well-known/oauth-authorization-server (fetched 2026-08-19; issuer
https://oauth2.jotform.com) · retrieved 2026-08-19 www.jotform.com/robots.txtallows/developers/and/products/, names a sitemap, and carries noContent-Signaldirectives;/llms.txtreturns 404 (fetched 2026-08-19) · retrieved 2026-08-19- Anthropic connector directory — https://claude.ai/directory/47f4bce8-bac1-4872-be7e-b296a1e6f707 (snapshot 2026-08-16) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Productivity
- Developer
- Jotform Apps
- Tools
- 6
- Domain
- mcp.jotform.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.