Formy MCP server: endpoint, OAuth, scopes and tools

• https://formy.co.il/mcp takes JSON-RPC over HTTP POST. GET, HEAD and DELETE answer 405 with Allow: POST.
• Send Content-Type: application/json and an Accept that allows both application/json and text/event-stream: a result comes back as JSON or as a stream scoped to that one request.
• The server keeps no session. It issues no session ID and ignores session headers.
• Protocol revisions: 2025-11-25 and 2025-06-18 start with initialize and then send the revision in an MCP-Protocol-Version header; 2026-07-28 needs no initialisation, and each request carries its revision and client details in params._meta.
• Supported methods: tools/list, tools/call and ping (and initialize for the older revisions). The server offers tools only: no resources, prompts, sampling or subscriptions.
• A browser-based client must send an Origin Formy has listed (https://claude.ai and https://chatgpt.com); any other Origin gets 403. Clients on your own machine send none.
• A request body may be up to 256 KB.

curl -i -X POST https://formy.co.il/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}}'

HTTP/2 401
www-authenticate: Bearer resource_metadata="https://formy.co.il/.well-known/oauth-protected-resource/mcp", error="invalid_token"
x-ratelimit-limit: 1000

{"error":"invalid_token"}

A client starts from the 401 above. The protected-resource metadata (RFC 9728) at https://formy.co.il/.well-known/oauth-protected-resource/mcp names the authorization server, and its metadata (RFC 8414) is at https://formy.co.il/.well-known/oauth-authorization-server. Both are public:

{
  "resource": "https://formy.co.il/mcp",
  "authorization_servers": ["https://formy.co.il"],
  "bearer_methods_supported": ["header"],
  "scopes_supported": ["mcp:use", "context.read", "workspaces.read", "…"]
}

{
  "issuer": "https://formy.co.il",
  "authorization_endpoint": "https://formy.co.il/mcp/oauth/authorize",
  "token_endpoint": "https://formy.co.il/mcp/oauth/token",
  "revocation_endpoint": "https://formy.co.il/mcp/oauth/revoke",
  "registration_endpoint": "https://formy.co.il/mcp/oauth/register",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_methods_supported": ["none", "client_secret_basic", "client_secret_post"],
  "revocation_endpoint_auth_methods_supported": ["none", "client_secret_basic", "client_secret_post"],
  "code_challenge_methods_supported": ["S256"],
  "scopes_supported": ["mcp:use", "context.read", "workspaces.read", "…"],
  "authorization_response_iss_parameter_supported": true,
  "client_id_metadata_document_supported": true
}

• The flow is the authorization code grant with PKCE, and S256 is the only challenge method. The authorization response carries iss (RFC 9207).
• Refresh tokens are issued, and the revocation endpoint takes access and refresh tokens.
• The bare /.well-known/oauth-protected-resource, without /mcp, answers 404. Use the path-specific document.

Formy does not accept arbitrary clients. A client is admitted in one of two ways, and both lead to a client profile Formy has reviewed:

• Dynamic client registration (RFC 7591) at /mcp/oauth/register. A registration is accepted only when its application type, authentication method and every redirect URI match exactly one reviewed profile: today Claude on the web, ChatGPT, VS Code and Cursor. Any other registration is refused with invalid_redirect_uri.
• A client ID metadata document: the client uses the URL of a metadata document its vendor publishes as its client_id. Claude Code signs in this way, and Claude and ChatGPT can too.

So you cannot connect a client you built yourself today, and assistants Formy has not reviewed, such as Gemini, Microsoft Copilot or Perplexity, are refused when they try to sign in. For your own code, use the REST API with a personal access token. The MCP server does not accept those tokens, and the REST API does not accept MCP tokens.

The authorization server advertises 17 scopes. The consent screen shows each as a permission the person ticks, per workspace, and can narrow a connection to chosen forms and fields:

Granting a scope is not enough on its own: the person's role in the workspace still applies, and reading an integration's list needs a member who may manage integrations.

tools/list returns only the tools the connection's scopes allow, so two connections can see different lists. With every scope granted, formy.co.il offers these read tools:

Exports are approval-gated. With data.export, formy_prepare_submission_export asks to export selected completed responses as CSV, JSON or XLSX, up to 500 rows. Nothing happens until the person approves the request in Formy, with their password and a two-factor code if they use one, within 15 minutes. The file is kept for 60 minutes and only the connection that asked can fetch it, with artifacts.read, from /mcp/artifacts/{artifact}/content. With operations.read and operations.cancel, formy_get_operation, formy_get_operation_result and formy_cancel_operation follow or stop it.

Built, but switched off on formy.co.il

Creating and editing drafts, publishing and unpublishing, moving forms to the trash, response summaries, folders and version history have tools in the code, and their scopes appear in the metadata, but formy.co.il does not offer those tools yet. An assistant that asks for one gets an error. This page will say when that changes.

• Only the workspaces, forms and fields the person selected. Up to 25 workspaces per connection, and up to 100 chosen forms per workspace and 200 chosen fields per form, or all of them.
• Answer values need both submissions.read and data.sensitive.read, and only for the selected fields.
• Masked (secret) fields are never returned. Uploaded files and signatures come back marked as redacted, not as their content.
• Form and field text is returned as data. The server tells assistants to treat it as untrusted, never as instructions.

Each person can have up to 25 active connections. In Formy, חיבורי AI ‏(MCP) in the account settings lists them; there the person can narrow a connection, which then needs approving again, or disconnect it, which stops all future requests through it.

A tool that runs but cannot do what was asked answers 200 with isError: true and a structured error, not an HTTP error.