# Doorman

> Spam, pitch and fraud screening for website forms. Sign up, wire forms, test and review.

- name: com.withdoorman/doorman
- version: 0.1.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 66/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.withdoorman%2Fdoorman
- tools: https://api.protogrid.dev/v1/servers/com.withdoorman%2Fdoorman/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "doorman": {
      "type": "http",
      "url": "https://withdoorman.com/mcp",
      "headers": {
        "Authorization": "Bearer ${DOORMAN_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${DOORMAN_TOKEN}`.

## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-20d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 66/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- warn `tools.annotations`: only 5 of 12 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: doorman_label_submission (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); doorman_whoami (destructiveHint, idempotentHint, openWorldHint); doorman_get_install_snippet (destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 1,977 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 46 tool changes in 30 days
- fail `stability.rug_pull`: 6 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 12, about 1,977 tokens to load them all
- tool set hash: 3c479e9a58d6540553899d6d04ca1356
- tools last changed: 2026-10-16T02:41:34.484Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.withdoorman/doorman.svg)](https://protogrid.dev/servers/com.withdoorman/doorman)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-16 `doorman_update_form` changed (inputSchema)
- 2026-10-16 `doorman_signup` changed (inputSchema)
- 2026-10-15 `doorman_delete_hook` removed
  - Delete a hook subscription by id (hk_...). A Zap that used it receives nothing until it is turned off and on again.
- 2026-10-15 `doorman_list_hooks` removed
  - The account's hook subscriptions (made with doorman_create_hook, the API or the Doorman Zapier app): url, event, form, failures and whether each is paused.
- 2026-10-15 `doorman_alerts` removed
  - Open problems on the user's forms: deliveries failing, a flood, a form gone quiet (probably broken). Call it when the user asks why leads stopped arriving or a webhook isn't receiving.
- 2026-10-15 `doorman_client_report` removed
  - A client workspace's monthly report: what reached them, what was kept out, the worst catches (redacted), per form. Returns the numbers and the shareable url (a page the client can open or print to PDF).
- 2026-10-15 `doorman_create_workspace` removed
  - Create a client workspace: one per client site an agency manages. Its email_to/slack_url/webhook_url are the defaults for every form in it whose own field is blank. Pro includes one, Business 50.
- 2026-10-15 `doorman_inbound_setup` removed
  - For a form that stays on Tally, Typeform, Jotform, Netlify Forms, Webflow or Framer: the form's inbound webhook URL, its signing secret and the exact clicks in that tool. Tell the user the steps; the tool keeps every submission and Doorman forwards the real ones with a verdict. Use this instead of changing the form's action when the form lives on one of those tools.
- 2026-10-15 `doorman_hubspot_status` removed
  - For a demo form that is a HubSpot form: whether Doorman's HubSpot app is enabled, which HubSpot accounts are connected, which HubSpot forms Doorman screens (and into which Doorman form), whether archiving is on, and the HubSpot forms available to map. Connecting is a browser step: give the user connect_url.
- 2026-10-15 `doorman_update_workspace` removed
  - Change a client workspace: its name, site, default destinations, and its monthly report (report_monthly emails report_to on the 1st; addresses confirm once).

Full history: https://api.protogrid.dev/v1/servers/com.withdoorman%2Fdoorman/changes

## Remotes

- https://withdoorman.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (12)

- `doorman_contact_support`: Stuck, or something isn't working? Send the problem straight to Doorman's founder, with the error you hit. Your account context (plan, forms, recent errors, never keys) is attached, and the reply goes to the account email. Use it instead of guessing at a fix.
- `doorman_create_form`: Create another form endpoint (one per distinct form on the site: contact, demo request, checkout, comments).
- `doorman_docs`: Read how Doorman works and how to integrate it (the same text as /llms.txt). Call this first if you haven't used Doorman before.
- `doorman_get_install_snippet`: Get ready-to-paste integration code for a form on a given platform. Use 'html' for static sites, 'react' for SPA client components, and 'fetch' (plain fetch with timeout and fallback: Workers, Node, Next, Deno), 'nextjs', 'express', 'python', 'ruby' or 'elixir' when the form already posts to the project's own backend.
- `doorman_label_submission`: Mark a submission real (delivers it if it was held or dropped) or spam.
- `doorman_list_forms`: List the account's forms with their action URLs and settings.
- `doorman_list_submissions`: Recent submissions with their verdicts. Use review=true for held ones waiting for a human.
- `doorman_send_test_delivery`: Send a sample delivery to the form's email/Slack/webhook destinations and report whether each one worked.
- `doorman_signup`: Create a Doorman account for the user with a first form and an API key. Ask the user for their email first. They'll get an email to set a dashboard password. Creates the account's first form too and returns its id and action URL, plus the api_key (store it as DOORMAN_KEY in the project's local secrets file, never commit it). Only for new users: if they already have an account, ask for a key instead. Until the user clicks the confirmation link in that email, nothing is emailed to them (100 checks; Slack and webhooks work).
- `doorman_test_submission`: Judge a sample message against a form's settings. Free, not forwarded, not counted. Use it to show the user Doorman working after setup (try one genuine enquiry and one sales pitch).
- `doorman_update_form`: Change a form's settings: context, destinations, thresholds, watch mode, allow/block lists.
- `doorman_whoami`: Account, plan and this month's usage.