Connect your AI agent to RizzForms

Connect a Client

Claude (claude.ai)

Go to Settings → Connectors → Add custom connector. Name it Rizzness Forms, set the URL to https://www.rizzness.com/mcp, and complete the sign-in when prompted. Works on web and desktop.

Claude Code

claude mcp add --transport http rizzness https://www.rizzness.com/mcp

Then run /mcp inside Claude Code to authenticate. A browser window opens for the OAuth flow; the CLI picks up the token automatically.

Cursor

{ "mcpServers": { "rizzness": { "url": "https://www.rizzness.com/mcp" } } }

Add that to your mcp.json. Cursor handles OAuth in the browser on first use.

Any other MCP client

The server implements OAuth 2.1 with dynamic client registration and PKCE (S256), so any spec-compliant client can register itself — no pre-shared client ID. Discovery metadata lives at /.well-known/oauth-authorization-server. To poke at it manually, MCP Inspector works out of the box: npx @modelcontextprotocol/inspector, transport HTTP, URL above.

Developing locally against the server? Mint short-lived tokens at /mcp/test_tokens instead of running the full OAuth dance.

No Account Yet? That’s Fine

Most integrations assume you already signed up somewhere. This one doesn’t. The authorize page has inline signup, so the connect flow is the signup flow:

1. Your agent (or you) opens the connect flow. A browser window shows the RizzForms authorize page.
2. No account? Enter your email address. That’s the entire form — no password, no plan picker, no onboarding wizard.
3. Review what the agent is asking for — read submissions, create forms — and approve.
4. You’re back in your chat. The agent continues where it left off.

Behind the scenes we create the account with a generated password you never see. The confirmation email is your claim link: click it, set a real password whenever you want, and the account is fully yours. Unconfirmed accounts keep working for 36 hours, so nothing blocks the agent mid-task — just confirm before then to keep access.

As far as we know, no other form backend lets an agent onboard someone who has never heard of it. That’s the point.

Tool Reference

Five tools. Two scopes.

Everything create_form returns is designed to be pasted directly into a project — the embed_html includes the honeypot field, and the curl examples are runnable as-is.

Example: Ship a Form From Chat

Here’s the whole loop, as one conversation with Claude:

1. “Add a contact form to my portfolio site.” — The agent calls create_form, gets back embed_html, and writes it into your page. Honeypot included.
2. Verify before you deploy. — The agent POSTs a test submission with ?test=true and reads back the deliveries array in the response — email, webhook, whatever’s configured, each with a status. One call, synchronous, no waiting on inboxes.

   curl -X POST "https://forms.rizzness.com/json/YOUR_TOKEN?test=true" \ -H "Content-Type: application/json" \ -d '{"email": "[email protected]", "message": "Hello from agent"}'

3. “Did anything come in?” — The agent calls list_submissions with spam: "exclude" and summarizes real entries.
4. “Show me the one from Sarah.” — The agent calls list_submissions with q: "sarah", then get_submission for the payload.

No tab-switching, no copying tokens between windows. The agent holds the credentials; you hold the conversation.

Verify Delivery in One Call

Append ?test=true to any JSON submission and plugin delivery runs synchronously. The response tells you exactly what happened:

{"ok": true, "id": 12345, "test": true, "deliveries": [ {"plugin": "webhook", "status": "success", "response_code": 200} ]}

Details in the API Reference.

Scopes and Security

• Scoped access. Two scopes, shown plainly on the consent screen: mcp.read (list and read forms and submissions) and mcp.write (create forms). An agent gets exactly what you approved.
• OAuth 2.1 with PKCE. Authorization code flow with S256 PKCE, required — no implicit flow, no long-lived secrets in your client config. Clients register themselves via dynamic client registration.
• Short-lived tokens. Access tokens expire after one hour and are rotated on refresh. Removing the connector from your client ends its access at the next expiry.
• Your account stays yours. MCP access never exposes your password (with inline signup there isn’t one until you set it). API keys and MCP tokens are separate credentials — revoking one doesn’t touch the other.

Troubleshooting

• Browser window never opens (Claude Code): run /mcp and select rizzness; check that nothing is intercepting localhost callback URLs.
• 401 after connecting: the access token expired and your client didn’t refresh. Reconnect the connector; tokens rotate automatically on refresh when the client behaves.
• Consent screen loops back to login: cookies blocked in the OAuth popup — allow cookies for www.rizzness.com and retry.
• Agent can read forms but can’t create one: the connection was approved with mcp.read only. Reconnect and approve mcp.write.
• Signed up during connect but never confirmed: unconfirmed accounts pause after 36 hours. Find the confirmation email (it’s also your account claim link) or use password reset with the same address.

REST API and Further Reading

• Agent Integration — the REST + API-key path, for agents that can’t speak MCP or for CI environments.
• API Reference — every endpoint the MCP tools sit on top of.
• agents.md — this documentation as plain markdown, for pasting into a context window.