GoBuildWP CloudConnect your sites through one workspace.Explore Cloud →
GoBuildWP
Download freeDownload

FormsFree + Pro

Gravity Forms MCP with entry privacy built in

A Gravity Forms MCP connection reaches the part of the plugin that matters most for privacy: the entries every install can store. GoBuildWP Free lists forms and pages through a form's entries by status and date, with email and phone answers, card data, uploads, signatures and the IP withheld. GoBuildWP Pro adds CSV export, read and star flags, and edits to forms, fields, notifications and confirmations. Every write to Gravity Forms' own tables is logged, but none of it can be rolled back automatically.

By GoBuildWPContent updated How we check claims

Get GoBuildWP free See Pro pricing
AI clientyour-site.comVerify site policy

Export every job application from September as CSV, but leave out the uploaded CVs and anything marked spam.

  1. wppilot/gravityforms-check-setupRead

    Confirms the plugin is active and which Gravity Forms capabilities the connected user holds, export included.

  2. wppilot/gravityforms-list-formsRead

    Finds the Job Application form and its entry count.

  3. wppilot/gravityforms-list-entriesRead

    Filters to status active and September's dates and returns the total, so the size of the export is known before any values are pulled.

  4. wppilot/gravityforms-export-entriesRead

    Returns one CSV string headed by field labels; the upload column reads [REDACTED], and cells starting with = or + are prefixed so a spreadsheet shows them as text. A large month can come back in more than one call: the agent repeats it with next_cursor until that is null, then checks the row count against the total from the listing before calling the export complete.

  5. wppilot/gravityforms-mark-entryWrite

    Optionally flags the exported entries as read, reporting each entry's previous and new value.

Proposed sequence from source declarations; not a recorded task or proof of client compatibility. Inspect saved state and browser or provider results separately.
Edition
Free 2 + Pro 27
Abilities
29
Requires
WordPress 6.9+, PHP 8.0+, Gravity Forms 2.7+

Limits

Entry privacy and what cannot be undone

  • include_sensitive and confirm, where supported, are API prerequisites subject to capability and installed policy, not proof of human consent. Obtain approval for the specific data purpose separately. Permitted fields and exports go to the client/provider; key or pattern masking does not cover arbitrary names or free text. Skill instructions do not enforce a human act.
  • Free's gravityforms-list-entries has no way to reveal a withheld answer. Pro's entry reads and exports mask password, credit-card, file-upload and signature values and the IP, and revealing them takes include_sensitive plus confirm in the same call; an unconfirmed request is refused before any entry loads, and search does not look inside those fields either.
  • Every Gravity Forms write, whether to a form, field, notification, confirmation or entry, lands in gf_ tables, so the change log marks it irreversible. Read the record first and keep its previous values.
  • Deleting an entry or a form trashes it by default, restorable from the Gravity Forms admin. force deletes for good, and on a form it takes every entry with it.
  • edit-form and edit-entry accept expected_date_updated: if someone changed the record since the agent read it, the call stops with a concurrent-modification error instead of overwriting.
  • Needs Gravity Forms 2.7 or later. Export checks gravityforms_export_entries, the same capability as Gravity Forms' own Export screen.

Data model

Gravity Forms tables, as GoBuildWP sees them

Gravity Forms keeps nothing in wp_posts. Forms are rows in gf_form, with display settings, confirmations and notifications in gf_form_meta. Each submission is a gf_entry row (dates, IP, payment details, status) and its answers are gf_entry_meta rows keyed by field or sub-input id, such as 1.3 for the first-name part of a name field. Notes, drafts and add-on feeds have tables of their own.

There is no Lite edition, so every active install can store entries, and each one is personal data a visitor typed. GoBuildWP reads them through GFAPI rather than SQL, which is why exported name, address and checkbox answers are joined exactly as Gravity Forms' own CSV export joins them.

Field ids are permanent. Deleting a field leaves a gap instead of renumbering, because old entries reference ids directly; reordering changes only positions in the array.

Abilities

Gravity Forms abilities by effect

Inspect11

Create and change11

Destructive7

Reference: /docs/reference/gravityforms

Documented source abilities; live registration can be narrower. Edition and effect labels describe the source catalogue. The installed schema, dependency versions, licence, WordPress capability, safety profile and per-ability policy determine availability; labels alone do not prove confirmation or recovery.

Gravity Forms's own AI tools

The official Gravity Forms MCP server

Gravity Forms now ships its own MCP server, switched on under Forms, Settings, MCP. It can take a dedicated Gravity Forms endpoint, which the docs recommend, or join the shared site connection other plugins use, and desktop clients reach it through Automattic's mcp-wordpress-remote bridge with an application password. The assistant acts as that WordPress user, so Gravity Forms advises a dedicated account with the task's narrow capabilities rather than your own administrator account, and regular backups.

The scope is wide. Read tools cover forms, entries, feeds, notifications, field types and site information, including form logic analysis and submission validation; write and destructive tools create, update and delete forms and entries, submit forms, and manage feeds and notifications. Each tool is switched on or off separately on the settings screen, a precise control for anyone who wants chat access to feeds or test submissions.

Privacy is where the two differ. The official docs warn that the tools can reach form-collected data and settings including API keys, and they describe no masking of entry values. GoBuildWP's entry reads, searches and exports withhold password, card, upload and signature answers and the submitter IP; Pro returns them only when the call adds include_sensitive with confirm, and Free never does, and every Gravity Forms write it makes is recorded in its change log.

Worked example

Export last month's applications for the hiring manager

Expected outcome to verify on the installed stack; this sequence has not been recorded as a runtime test.

The CSV is prepared for review and download, with the CV column withheld and spam left out; delivery to the hiring manager requires a separate authorized action. Counting them works on GoBuildWP Free; the CSV and the read flags need Pro. Fetching the CVs themselves would be a separate request with explicit confirmation, and marking entries read cannot be reversed from the log.

Prepare the filtered CSV for review and download. Check masking in the returned fields; a dated comparison of documented native fields does not prove every undocumented feature is absent.

  1. gravityforms-check-setup

    Confirms the plugin is active and which Gravity Forms capabilities the connected user holds, export included.

  2. gravityforms-list-forms

    Finds the Job Application form and its entry count.

  3. gravityforms-list-entries

    Filters to status active and September's dates and returns the total, so the size of the export is known before any values are pulled.

  4. gravityforms-export-entries

    Returns one CSV string headed by field labels; the upload column reads [REDACTED], and cells starting with = or + are prefixed so a spreadsheet shows them as text. A large month can come back in more than one call: the agent repeats it with next_cursor until that is null, then checks the row count against the total from the listing before calling the export complete.

  5. gravityforms-mark-entry

    Optionally flags the exported entries as read, reporting each entry's previous and new value.

Questions

Gravity Forms questions

Where does Gravity Forms store entries, and does the agent query them directly?

In gf_entry and gf_entry_meta. GoBuildWP reads them through GFAPI, so status filters and multi-input fields behave as they do in the Gravity Forms admin. Raw SQL is possible through execute-php but is not the route the integration uses.

Can an AI edit a submitted Gravity Forms entry?

Yes, gravityforms-edit-entry changes values by input id. Gravity Forms keeps no history of the old values and GoBuildWP cannot restore them, so the agent skill has the agent show you the change and wait for approval first.

Does duplicating a form copy its entries?

No. The copy takes fields, settings, notifications and confirmations, starts inactive so it cannot quietly accept submissions, and holds no entries.

Is there a Gravity Forms Lite with fewer features?

No. It is a single paid plugin, so every form, entry, notification and confirmation surface is available whenever it is active.

Gravity Forms offers an MCP integration. GoBuildWP supplies a separate set of form-specific abilities within its broader WordPress connection. Form saving and successful email or payment delivery still require separate checks. Gravity Forms MCP documentation

Where these facts come from

GoBuildWP behaviour is taken from the plugin source and the ability reference; third-party details from the vendor documentation below, checked by the GoBuildWP team.

Gravity Forms is a separate product; no partnership or endorsement is implied.

Try it on Gravity Forms in Read Only first

Get GoBuildWP free See Pro pricing