MCP ServerReference
Security & limits
How the MCP server protects your data, and the rate limits that apply.
Your data
- Submission contents are returned as untrusted data. Assistants are told never to follow instructions found inside submissions, which protects against prompt injection from form spam.
- Long values are shortened, and password- and card-like fields are redacted.
- Nothing from submissions or tool arguments is written to logs.
- Webhook and redirect URLs must point to public internet addresses.
Rate limits
| Limit | Value |
|---|---|
| Requests | 60 per minute, per user and app |
| Write tool calls | 20 per minute, per user and app |
Good practice
- Grant read-only access unless the assistant needs to create or change forms.
- Review write tool calls before approving them in your client.
- Revoke apps you no longer use in Settings → API & MCP.
Still need help? Contact support or email support@formclick.io.