# get_form

Read one of your forms to verify it is wired correctly: returns its access_key, destination_email, destination_verified (whether submissions will be emailed yet), allowed_domains, and notification/autoresponder/webhook config. Never returns the webhook signing secret. Errors with: unauthorized, not_found.

Agent View of the PolicyLayer registry record for `get_form`. HTML page: https://policylayer.com/tools/com-formpaste-formpaste/get-form

## Facts

- Tool: `get_form`
- Server: Formpaste (`formpaste-mcp`) — https://policylayer.com/tools/com-formpaste-formpaste.md
- Install: `npx -y formpaste-mcp`
- Homepage: https://github.com/webrating/formpaste-mcp
- Risk category: Read (Low risk)
- Registry record: grade C, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 1 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `formId` | string | yes | A form id from create_form or list_forms, e.g. frm_... |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_form",
    "arguments": {
      "formId": "<formId>"
    }
  }
}
```

## Why get_form is rated Low

This tool retrieves and queries form configuration metadata without side effects. It does not create, modify, delete, or execute operations. The explicit exclusion of the webhook signing secret further demonstrates a read-only posture.

From the tool's own definition: "Tool description states 'Read one of your forms' and 'returns' configuration details (access_key, destination_email, allowed_domains, webhook config)."

## Use case

AI agents call get_form to retrieve information from Formpaste without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Formpaste:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_form": {}
  }
}
```

## Other tools on Formpaste (5)

- `get_snippet` — Read — https://policylayer.com/tools/com-formpaste-formpaste/get-snippet.md
- `list_forms` — Read — https://policylayer.com/tools/com-formpaste-formpaste/list-forms.md
- `list_submissions` — Read — https://policylayer.com/tools/com-formpaste-formpaste/list-submissions.md
- `create_form` — Write — https://policylayer.com/tools/com-formpaste-formpaste/create-form.md
- `send_test_submission` — Write — https://policylayer.com/tools/com-formpaste-formpaste/send-test-submission.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-formpaste-formpaste · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-formpaste-formpaste