Forms

Versioned forms with email notifications, webhooks, spam protection, and file uploads. Managed via the list_forms / create_form / update_form MCP tools.

Creating a Form

create_form takes a fields array plus notification_email (setting or changing it triggers a verification email — notifications activate once the owner clicks the link).

Field types: text, email, textarea, select, checkbox, radio, number, url, tel, search, range, color, date, datetime-local, time, month, week, hidden, file.

File Fields

file fields accept visitor uploads:

multiple: true — allow several files
accept — allowed extensions, e.g. ["pdf", "png", "jpg"]
max_size_mb — per-file cap, 1–25 MB
max_files — per-field cap, 1–10 (needs multiple)

Platform ceilings (identical on free and Pro): 25 MB per file, 10 files per field, 100 MB per request. Field settings may tighten, never exceed, these ceilings.

Allowed types: images (jpg, jpeg, png, gif, webp, avif), documents (pdf, doc, docx, xls, xlsx, ppt, pptx, txt, csv, rtf). ZIP archives and SVG are deliberately rejected — uploads are judged by sniffed content, not by extension, so a renamed file gets no free pass.

Submission Flow

Public forms POST multipart to the form's submit_url (/f/<id>). Any plain input name works — the renderer rewrites file inputs to bracketed names at serve time and multiple files accumulate. Requests over 100 MB are rejected with 413 before parsing.

Every submission passes spam protection (honeypot + ALTCHA proof-of-work, three escalating tiers — see Security). Discarded spam never persists files; quarantined submissions keep theirs for owner review.

Delivery

Email — the notification carries download links, never attachments. Links are permanent capability URLs (unguessable, no expiry) and stop working when the submission is deleted. A submission with files from more than one file field groups them under field-name headings.
Webhook — form.submission.created payloads include a files array with field, filename, size (bytes), content_type, checksum_md5 (hex), and url per file. Every dispatch also carries a spam block (verdict, score, signals). Test deliveries mirror the real schema, including a files sample.
Dashboard — the form's inbox lists submissions with inline download links; the spam tab holds quarantined submissions with their files.