# SubmitraX

> Form backend for static sites: create forms, manage submissions, webhooks and exports.

- name: com.submitrax/mcp
- version: 1.0.0
- connection class: R1 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 66/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.submitrax%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.submitrax%2Fmcp/tools

**An agent can connect on its own if it already holds `SUBMITRAX_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "submitrax": {
      "type": "http",
      "url": "https://mcp.submitrax.com/mcp",
      "headers": {
        "Authorization": "Bearer ${SUBMITRAX_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${SUBMITRAX_TOKEN}`.

## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-21d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 66/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- warn `tools.descriptions`: 1 of 57 tools have a description under 20 characters
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 57 of 57 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 40 of 57 tools declare all four hints; missing: list_templates (destructiveHint, idempotentHint); list_all_templates_admin (destructiveHint, idempotentHint); get_auth_status (destructiveHint, idempotentHint); …
- pass `tools.token_cost`: about 6,319 tokens to load every tool
- warn `tools.api_dump`: 57 tools, 65% named like REST operations: looks like an API mapped one endpoint per tool

### stability: 25 (weight 15)

- warn `stability.changes`: 57 tool changes in 30 days
- fail `stability.rug_pull`: 10 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 57, about 6,319 tokens to load them all
- tool set hash: 1e7dc8b9aa0afb0a2635dfb0a7c33af3
- tools last changed: 2026-09-29T09:22:02.630Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.submitrax/mcp.svg)](https://protogrid.dev/servers/com.submitrax/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-09-29 `health_check` changed (outputSchema, annotations)
- 2026-09-29 `download_export` changed (outputSchema, annotations)
- 2026-09-29 `list_form_exports` changed (description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: _empty_
  - after: List the export files previously created for a form.
- 2026-09-29 `create_export` changed (inputSchema, outputSchema, annotations)
- 2026-09-29 `generate_ai_content` changed (outputSchema, annotations)
- 2026-09-29 `bulk_delete_users_admin` changed (inputSchema, outputSchema, annotations)
- 2026-09-29 `delete_user_admin` changed (inputSchema, outputSchema, annotations)
- 2026-09-29 `update_user_quota_admin` changed (inputSchema, outputSchema, annotations)
- 2026-09-29 `update_user_plan_admin` changed (inputSchema, outputSchema, annotations)
- 2026-09-29 `update_user_role_admin` changed (inputSchema, outputSchema, annotations)

Full history: https://api.protogrid.dev/v1/servers/com.submitrax%2Fmcp/changes

## Remotes

- https://mcp.submitrax.com/mcp (streamable-http, auth api_key ${SUBMITRAX_TOKEN}, reachable true, uptime30d 1)

## Packages

_none_

## Tools (57)

- `accept_invite`: Accept a pending workspace invitation using its invitation token, linking it to the authenticated user.
- `add_form_webhook`: Add a notification webhook URL to a form.
- `bulk_archive_submissions`: Archive several submissions at once.
- `bulk_delete_submissions`: Permanently delete several submissions at once.
- `bulk_delete_users_admin`: Delete multiple user accounts at once. Requires super-admin.
- `create_checkout_session`: Start a Stripe subscription checkout for a plan ('free', 'essentials', 'pro'). Downgrades immediately if planType is 'free'.
- `create_export`: Create a CSV or JSON export of a form's submissions, optionally filtered by date range (YYYY-MM-DD).
- `create_form`: Create a new form in a workspace.
- `create_template_admin`: Create a new template. Requires super-admin.
- `create_workspace`: Create a new workspace owned by the authenticated user.
- `delete_all_form_submissions`: Delete every submission belonging to a form.
- `delete_form`: Delete a form.
- `delete_form_webhook`: Remove a notification webhook URL from a form.
- `delete_submission`: Permanently delete a single submission.
- `delete_template_admin`: Delete a template. Requires super-admin.
- `delete_user_admin`: Delete a single user account. Requires super-admin.
- `delete_workspace`: Delete a workspace along with all its forms and submissions. Only the owner may do this.
- `download_export`: Download the contents of a previously created export file (CSV or JSON text).
- `generate_ai_content`: Proxy a request to the configured n8n AI generation webhook (e.g. for AI-assisted form/HTML generation). Requires the server to have AI generation configured.
- `generate_workspace_api_token`: Generate (or reset) a long-lived API token (sk_...) scoped to a single workspace, for use with public API integrations.
- `get_auth_status`: Check whether an auth token is currently configured for this session.
- `get_current_user`: Get the profile of the currently authenticated user.
- `get_form`: Get a single form by id or form key.
- `get_public_form_html`: Fetch the rendered public HTML (custom or default template) for a form by its form key. No authentication required.
- `get_workspace`: Get a single workspace's details and settings.
- `health_check`: Check whether the SubmitraX API is reachable and running.
- `invite_workspace_member`: Invite a new member to a workspace by email. Requires admin access to the workspace.
- `list_admin_users`: Paginated list of all users with plan stats. Requires super-admin.
- `list_all_templates_admin`: Paginated list of every template. Requires super-admin.
- `list_form_exports`: List the export files previously created for a form.
- `list_forms`: List forms across the user's workspaces, or within one workspace if workspace_id is given.
- `list_form_submissions`: List all submissions for a specific form.
- `list_form_webhooks`: List the notification webhook URLs (Slack, Discord, generic) configured on a form.
- `list_submissions`: List submissions across the user's workspaces, or within one workspace if workspace_id is given.
- `list_templates`: List default templates available to all users, optionally filtered by type ('form' or 'email').
- `list_workspace_members`: List members and pending invitations of a workspace, including its owner.
- `list_workspaces`: List workspaces owned by or shared with the authenticated user.
- `login`: Log in with email and password. Stores the returned token for subsequent authenticated tool calls.
- `login_with_google`: Log in or register using a Google Sign-In ID token credential. Stores the returned token for subsequent authenticated tool calls.
- `mark_submission_read`: Mark a submission as read so it no longer shows as new.
- `redeem_voucher`: Redeem a voucher code to add submission quota to a workspace's owner.
- `register`: Register a new SubmitraX user account. Stores the returned token for subsequent authenticated tool calls.
- `remove_workspace_member`: Remove a member (or cancel a pending invitation) from a workspace. Requires admin access to the workspace.
- `resend_submission_email`: Resend the email notification for a submission.
- `set_auth_token`: Set the bearer token (JWT from login/register, or a workspace API token starting with sk_) used to authenticate subsequent tool calls.
- `submit_demo`: Trigger a demo submission email for marketing/demo purposes. No authentication required, rate-limited.
- `submit_form`: Submit data to a public form endpoint, as an end user would. No authentication required.
- `toggle_submission_archived`: Flip a submission's archived state.
- `toggle_submission_spam`: Flip a submission's spam state.
- `update_form`: Update a form's settings (name, notification email, Slack webhook, redirect URL, custom HTML, active state, or arbitrary settings).
- `update_member_role`: Change a workspace member's role. Requires admin access to the workspace.
- `update_template_admin`: Update a template. Requires super-admin.
- `update_user_plan_admin`: Set a user's plan ('free' or 'pro') and its associated quota. Requires super-admin.
- `update_user_quota_admin`: Set a user's submission quota directly. Requires super-admin.
- `update_user_role_admin`: Grant or revoke super-admin status for a user. Requires super-admin.
- `update_workspace`: Rename a workspace or change its settings.
- `upgrade_user_plan`: Change the authenticated user's plan (defaults to 'pro' if not specified).