From 01d5b87203f5c6e954af9fbbc3ea5e3eaff11e37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9CPol?= <“pol.borrellas@typeform.com”> Date: Mon, 14 Sep 2026 17:09:35 +0200 Subject: [PATCH 1/5] docs(typeform): correct EU hosts, scopes, and the capability table Three factual corrections to the Typeform plugin README, from the Typeform side. Verified against the live MCP server rather than inferred. - The two EU hosts were presented as interchangeable alternatives. They are not: api.eu.typeform.com is an EU resource authorized by api.typeform.com, while api.typeform.eu is a separate stack with its own issuer. Tokens do not move between them, and choosing wrong fails mid-OAuth rather than at install. - The capability table omitted Themes and Automations entirely, and the Forms row didn't mention editing or publishing. - The scope list named 7 scopes; the server's 401 challenge advertises 14. README only, so the plugin manifest and mcp.json are untouched. Co-Authored-By: Claude Opus 5 --- third_party/typeform/README.md | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/third_party/typeform/README.md b/third_party/typeform/README.md index 6e3d84b49..8a76c8295 100644 --- a/third_party/typeform/README.md +++ b/third_party/typeform/README.md @@ -29,13 +29,25 @@ Auth is OAuth. Cursor prompts for Typeform sign-in when the plugin connects. Per ## Before you connect -This plugin points at Typeform's default data center. If your account is hosted in the EU, change the server URL to `https://api.eu.typeform.com/mcp` or `https://api.typeform.eu/mcp` depending on where your account lives. +This plugin points at `https://api.typeform.com/mcp`, which serves Typeform's default data center. EU-hosted accounts use a different URL, and the two EU hosts are **not** interchangeable: + +| Account | Server URL | Authorization server | +| --- | --- | --- | +| Default data center | `https://api.typeform.com/mcp` | `https://api.typeform.com` | +| EU data center | `https://api.eu.typeform.com/mcp` | `https://api.typeform.com` | +| `typeform.eu` | `https://api.typeform.eu/mcp` | `https://api.typeform.eu` | + +`api.typeform.eu` is a separate stack with its own issuer, token endpoint, and JWKS, so tokens are not portable between it and `api.typeform.com`. Picking the wrong host fails during the OAuth exchange rather than at install time, which makes it awkward to diagnose. + +If you're not sure which applies, the standard discovery chain settles it: an unauthenticated call to the server returns `401` with a `WWW-Authenticate: Bearer resource_metadata="..."` header, and that metadata document names the authorization server to use. ## What agents can do | Category | Capabilities | | --- | --- | -| Forms | List, read, and create forms, and check form capabilities | +| Forms | List, read, create, and edit forms, publish drafts, and check form capabilities | +| Themes | List the themes available to the user and apply one to a form | +| Automations | Read and build automations that react to form submissions | | Insights | Discover and analyze response data | | Contacts | List contacts and import form responses by mapping | | Workspaces & accounts | List workspaces and accounts | @@ -44,7 +56,7 @@ The hosted runtime is the source of truth for tool names and schemas. Call `acco ## Notes -- Tool calls run as the Typeform user who authorizes the connection. Scopes requested include `accounts:read`, `forms:read`, `forms:write`, `contacts:read`, `contacts:write`, `insights:read`, and `workspaces:read`. +- Tool calls run as the Typeform user who authorizes the connection. The server's authorization challenge advertises `accounts:read`, `automations:read`, `automations:write`, `contacts:read`, `contacts:write`, `forms:read`, `forms:write`, `insights:read`, `responses:read`, `responses:write`, `webhooks:read`, `webhooks:write`, `workspaces:read`, and `workspaces:write`. - Typeform describes this as a generally available beta with limited capabilities, so the tool catalog can change. - Streamable HTTP is the only supported transport — there is no SSE endpoint. - If the connection shows no tools right after authorizing, refresh the tool list; Typeform documents this as a known issue. From 361216218b75f673574000ea852677fcaf2ed09b Mon Sep 17 00:00:00 2001 From: Pol Borrellas Date: Mon, 14 Sep 2026 18:28:26 +0200 Subject: [PATCH 2/5] Update README.md Polishing. --- third_party/typeform/README.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/third_party/typeform/README.md b/third_party/typeform/README.md index 8a76c8295..3d58139c4 100644 --- a/third_party/typeform/README.md +++ b/third_party/typeform/README.md @@ -34,23 +34,23 @@ This plugin points at `https://api.typeform.com/mcp`, which serves Typeform's de | Account | Server URL | Authorization server | | --- | --- | --- | | Default data center | `https://api.typeform.com/mcp` | `https://api.typeform.com` | -| EU data center | `https://api.eu.typeform.com/mcp` | `https://api.typeform.com` | -| `typeform.eu` | `https://api.typeform.eu/mcp` | `https://api.typeform.eu` | +| EU data center 1 | `https://api.eu.typeform.com/mcp` | `https://api.typeform.com` | +| EU data center 2 | `https://api.typeform.eu/mcp` | `https://api.typeform.eu` | `api.typeform.eu` is a separate stack with its own issuer, token endpoint, and JWKS, so tokens are not portable between it and `api.typeform.com`. Picking the wrong host fails during the OAuth exchange rather than at install time, which makes it awkward to diagnose. -If you're not sure which applies, the standard discovery chain settles it: an unauthenticated call to the server returns `401` with a `WWW-Authenticate: Bearer resource_metadata="..."` header, and that metadata document names the authorization server to use. +EU-hosted accounts are only available on Typeform Enterprise plans. If you're not sure which applies, contact your Typeform Success Manager. ## What agents can do | Category | Capabilities | | --- | --- | -| Forms | List, read, create, and edit forms, publish drafts, and check form capabilities | +| Forms | List, read, create, and edit forms, and publish drafts | | Themes | List the themes available to the user and apply one to a form | -| Automations | Read and build automations that react to form submissions | +| Automations | Build and publish automations with email, webhook, delay, and integration steps | | Insights | Discover and analyze response data | -| Contacts | List contacts and import form responses by mapping | -| Workspaces & accounts | List workspaces and accounts | +| Contacts | Manage contacts and lists, including bulk upsert and form field mapping | +| Workspaces & accounts | List accounts and workspaces | The hosted runtime is the source of truth for tool names and schemas. Call `accounts-list_accounts` as a read-only smoke test after connecting. @@ -63,8 +63,8 @@ The hosted runtime is the source of truth for tool names and schemas. Call `acco ## Docs -- Typeform MCP server: https://developers.typeform.com/developers/get-started/mcp/ -- Connect Typeform to your AI: https://help.typeform.com/hc/en-us/articles/50533862636308-Connect-Typeform-to-your-AI-with-the-Typeform-MCP-server +- Typeform MCP server: https://developers.typeform.com/developers/mcp/ +- Connect Typeform to your AI: https://help.typeform.com/hc/en-us/articles/50533862636308 - Server URL: https://api.typeform.com/mcp Logo is Typeform's official mark, from the `Typeform` GitHub organization. From 706b2630d05771a83f5a27b71ca50ac34af35b2c Mon Sep 17 00:00:00 2001 From: Pol Borrellas Date: Tue, 15 Sep 2026 08:34:58 +0200 Subject: [PATCH 3/5] Update README.md --- third_party/typeform/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/third_party/typeform/README.md b/third_party/typeform/README.md index 3d58139c4..d91efb0b4 100644 --- a/third_party/typeform/README.md +++ b/third_party/typeform/README.md @@ -45,7 +45,7 @@ EU-hosted accounts are only available on Typeform Enterprise plans. If you're no | Category | Capabilities | | --- | --- | -| Forms | List, read, create, and edit forms, and publish drafts | +| Forms | List, read, create, edit, and publish forms | | Themes | List the themes available to the user and apply one to a form | | Automations | Build and publish automations with email, webhook, delay, and integration steps | | Insights | Discover and analyze response data | From e51f5577b62ee592d895fda2ec94a883c9246fe9 Mon Sep 17 00:00:00 2001 From: Pol Borrellas Date: Tue, 15 Sep 2026 08:37:20 +0200 Subject: [PATCH 4/5] Update README.md --- third_party/typeform/README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/third_party/typeform/README.md b/third_party/typeform/README.md index d91efb0b4..c51827301 100644 --- a/third_party/typeform/README.md +++ b/third_party/typeform/README.md @@ -57,9 +57,8 @@ The hosted runtime is the source of truth for tool names and schemas. Call `acco ## Notes - Tool calls run as the Typeform user who authorizes the connection. The server's authorization challenge advertises `accounts:read`, `automations:read`, `automations:write`, `contacts:read`, `contacts:write`, `forms:read`, `forms:write`, `insights:read`, `responses:read`, `responses:write`, `webhooks:read`, `webhooks:write`, `workspaces:read`, and `workspaces:write`. -- Typeform describes this as a generally available beta with limited capabilities, so the tool catalog can change. +- Typeform is actively expanding and improving the capabilities in this MCP server. - Streamable HTTP is the only supported transport — there is no SSE endpoint. -- If the connection shows no tools right after authorizing, refresh the tool list; Typeform documents this as a known issue. ## Docs From 7f48ddb2eb4fa61c933438aed1d27129d4cb07cc Mon Sep 17 00:00:00 2001 From: Pol Borrellas Date: Tue, 15 Sep 2026 09:02:48 +0200 Subject: [PATCH 5/5] Update README.md --- third_party/typeform/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/third_party/typeform/README.md b/third_party/typeform/README.md index c51827301..61a778ee5 100644 --- a/third_party/typeform/README.md +++ b/third_party/typeform/README.md @@ -37,7 +37,7 @@ This plugin points at `https://api.typeform.com/mcp`, which serves Typeform's de | EU data center 1 | `https://api.eu.typeform.com/mcp` | `https://api.typeform.com` | | EU data center 2 | `https://api.typeform.eu/mcp` | `https://api.typeform.eu` | -`api.typeform.eu` is a separate stack with its own issuer, token endpoint, and JWKS, so tokens are not portable between it and `api.typeform.com`. Picking the wrong host fails during the OAuth exchange rather than at install time, which makes it awkward to diagnose. +`api.typeform.eu` is a separate stack with its own issuer, token endpoint, and JWKS, so tokens are not portable between it and `api.typeform.com`. Picking the wrong host fails during the OAuth exchange rather than at install time. EU-hosted accounts are only available on Typeform Enterprise plans. If you're not sure which applies, contact your Typeform Success Manager.