Backforms MCP Server (backforms-mcp)

Official Model Context Protocol (MCP) server for Backforms. Connect serverless forms, anti-spam shields, and lead telemetry directly to Cursor, Windsurf, Claude Code, and Claude Desktop.

⚡ The Zero-Click Advantage

Instead of leaving your IDE, opening a browser, manually provisioning forms, and copying IDs:

Your AI coding agent executes the complete lifecycle in a single chat prompt:

"Create a Contact Us form in Next.js with honeypot spam protection and connect it to Backforms"

The agent automatically calls create_form, receives the live action URL (https://app.backforms.com/f/[uuid]), and injects ready-to-run HTML or Next.js code directly into your project.

Related MCP server: @lex-tools/codebase-context-dumper

🚀 Quick Setup

1. Get Your API Key

1. Sign in to your dashboard: Backforms Dashboard → API Keys & MCP.

2. Click Create API Key and copy your secret personal access token (bf_live_sec_...).

2. Configure Your IDE

Cursor (.cursor/mcp.json or Settings → Features → MCP)

Add to your project's .cursor/mcp.json:

{
  "mcpServers": {
    "backforms": {
      "command": "npx",
      "args": ["-y", "backforms-mcp"],
      "env": {
        "BACKFORMS_API_KEY": "bf_live_sec_your_token_here"
      }
    }
  }
}

Windsurf (~/.codeium/windsurf/mcp_config.json)

{
  "mcpServers": {
    "backforms": {
      "command": "npx",
      "args": ["-y", "backforms-mcp"],
      "env": {
        "BACKFORMS_API_KEY": "bf_live_sec_your_token_here"
      }
    }
  }
}

Claude Desktop (claude_desktop_config.json)

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "backforms": {
      "command": "npx",
      "args": ["-y", "backforms-mcp"],
      "env": {
        "BACKFORMS_API_KEY": "bf_live_sec_your_token_here"
      }
    }
  }
}

Claude Code (CLI)

claude mcp add backforms --env BACKFORMS_API_KEY=bf_live_sec_your_token_here -- npx -y backforms-mcp

🛠️ Complete Tool Catalog

🔒 Security & Privacy Architecture

• Stateless & Serverless: Runs locally via standard I/O (stdio). Zero long-lived streaming overhead.

• SHA-256 Authentication: Personal Access Tokens are verified with secure hash comparisons.

• No Sensitive Credential Storage: Tokens and database credentials are never logged or stored in plain text.

• Strict CORS & Domain Origin Locks: Perimeter origin restrictions protect against unauthorized cross-site form posting.

📦 Links & Community

• SaaS Platform: https://backforms.com

• Web App Console: https://app.backforms.com

• NPM Package: https://www.npmjs.com/package/backforms-mcp

• Issues & Contributions: https://github.com/Arneld18/backforms-mcp/issues

License

MIT © AC Softworks, LLC (contact: info@acsoftworks.com)