# get_snippet

Return a copy-paste form snippet for a framework (html, react, nextjs, astro, vue, svelte). Pass formId to fill in a real access key; otherwise a placeholder is used. Errors with: unauthorized, invalid_framework.

Agent View of the PolicyLayer registry record for `get_snippet`. HTML page: https://policylayer.com/tools/com-formpaste-formpaste/get-snippet

## Facts

- Tool: `get_snippet`
- Server: Formpaste (`formpaste-mcp`) — https://policylayer.com/tools/com-formpaste-formpaste.md
- Install: `npx -y formpaste-mcp`
- Homepage: https://github.com/webrating/formpaste-mcp
- Risk category: Read (Low risk)
- Registry record: grade C, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 2 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `formId` | string | no | An owned form id to fill in the real access key; omit for a placeholder. |
| `framework` | string | yes | Target framework for the snippet. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_snippet",
    "arguments": {
      "framework": "<framework>"
    }
  }
}
```

## Why get_snippet is rated Low

This is a retrieval operation that queries and returns existing form snippets. It has no side effects on data—it does not create, modify, delete, or execute any operations. The worst case of misuse would be an agent retrieving snippets for frameworks it shouldn't access, but the blast radius is limited to information disclosure of template code that is likely not sensitive.

From the tool's own definition: "Tool returns a form snippet for copy-paste use. Description states 'Return a copy-paste form snippet' with no mention of creating, modifying, executing, or deleting data. The tool retrieves pre-formatted code based on parameters (formId, framework)."

## Use case

AI agents call get_snippet to retrieve information from Formpaste without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Formpaste:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_snippet": {}
  }
}
```

## Other tools on Formpaste (5)

- `get_form` — Read — https://policylayer.com/tools/com-formpaste-formpaste/get-form.md
- `list_forms` — Read — https://policylayer.com/tools/com-formpaste-formpaste/list-forms.md
- `list_submissions` — Read — https://policylayer.com/tools/com-formpaste-formpaste/list-submissions.md
- `create_form` — Write — https://policylayer.com/tools/com-formpaste-formpaste/create-form.md
- `send_test_submission` — Write — https://policylayer.com/tools/com-formpaste-formpaste/send-test-submission.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-formpaste-formpaste · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-formpaste-formpaste