GoBuildWP CloudConnect your sites through one workspace.Explore Cloud →
GoBuildWP
Download freeDownload

FormsFree + Pro

WPForms MCP: forms from a prompt, entries under guard

This WPForms MCP integration lets an AI client work on the definition WPForms keeps inside each form post, one field, notification or confirmation at a time, and on the entries WPForms Pro saves in its own tables. GoBuildWP Free lists forms and reads stored entries with contact answers withheld; building, starring, exporting and unmasking entries require GoBuildWP Pro. WPForms Lite's supported entry API exposes no local entries; email delivery and optional Lite Connect cloud backups are separate from that API.

By GoBuildWPContent updated How we check claims

Get GoBuildWP free See Pro pricing
AI clientyour-site.comVerify site policy

Find the Request a Quote form, show me the entries from the last seven days that mention a budget, and once I have confirmed which ones, prepare a CSV of exactly those entries for the sales team.

  1. wppilot/wpforms-check-setupRead

    Confirms WPForms Pro is active and supports_entries is true. On Lite the task stops here, because the supported entry API has no local entries to read.

  2. wppilot/wpforms-list-formsRead

    Locates the form by title and returns its id with a live entry count.

  3. wppilot/wpforms-list-entriesRead

    Lists compact rows for that form with date_after, date_before and search set to the budget wording, and returns the total, so the agent knows how many entries match before opening any.

  4. wppilot/wpforms-get-entryRead

    Reads each candidate's values, capped per field; email, phone, password, card, upload, camera and signature values and the IP arrive as [REDACTED]. The agent lists the entry IDs it judged relevant, and a person confirms that list.

  5. wppilot/wpforms-export-entriesRead

    Exports with the same date range and search filter, plus a fields list limited to the columns sales needs. The CSV always carries an Entry ID column; the agent checks the reported total and every Entry ID against the confirmed list and removes any row that is not on it.

Proposed sequence from source declarations; not a recorded task or proof of client compatibility. Inspect saved state and browser or provider results separately.
Edition
Free 2 + Pro 27
Abilities
29
Requires
WordPress 6.9+, PHP 8.0+, WPForms 1.8.0+

Data model

Where WPForms keeps a form, and where entries go

Each form is a post of type wpforms, and the whole definition (fields keyed by numeric id, settings, notifications, confirmations, payment configuration) sits as one JSON blob in its post_content. GoBuildWP decodes and re-encodes that blob with WPForms' own helpers, so an agent adjusts one field or one notification without handling raw JSON. The form's field id counter only ever climbs: a deleted field's id is never given to a new one.

Entries are a paid-edition feature. WPForms Pro writes them to wp_wpforms_entries, with per-field values in wp_wpforms_entry_fields and extra data in wp_wpforms_entry_meta. WPForms Lite sends submissions by email and keeps no database copy; its optional Lite Connect backup holds them off-site, where GoBuildWP cannot reach. On Lite the entry abilities report that plainly instead of returning an empty list.

The split decides undo. A change to the form post can be rolled back from a snapshot of that post, while anything that touches the entry tables is recorded as irreversible.

Abilities

WPForms abilities by effect

Inspect11

Create and change12

Destructive6

Reference: /docs/reference/wpforms

Documented source abilities; live registration can be narrower. Edition and effect labels describe the source catalogue. The installed schema, dependency versions, licence, WordPress capability, safety profile and per-ability policy determine availability; labels alone do not prove confirmation or recovery.

Worked example

Prepare a reviewed CSV of this week's quote requests

Expected outcome to verify on the installed stack; this sequence has not been recorded as a runtime test.

You get a CSV, prepared for review, that holds only the entry IDs you confirmed, with sensitive columns still masked. GoBuildWP does not send it anywhere: passing it to sales is a separate step you take. No entry is starred or changed along the way. Filtering on the starred flag instead would also pick up any entry someone starred earlier for another reason, and starring writes the entry table with no undo, so this recipe avoids it. GoBuildWP Free can find the form and list the week's entries; opening and exporting them are Pro steps. On WPForms Lite the supported entry API exposes no local entries for this workflow, regardless of notification delivery or Lite Connect backups.

Inspect the actual returned fields for masking before sharing the export. Prepare the CSV for user review and download; sending it to sales is a separate authorized action.

  1. wpforms-check-setup

    Confirms WPForms Pro is active and supports_entries is true. On Lite the task stops here, because the supported entry API has no local entries to read.

  2. wpforms-list-forms

    Locates the form by title and returns its id with a live entry count.

  3. wpforms-list-entries

    Lists compact rows for that form with date_after, date_before and search set to the budget wording, and returns the total, so the agent knows how many entries match before opening any.

  4. wpforms-get-entry

    Reads each candidate's values, capped per field; email, phone, password, card, upload, camera and signature values and the IP arrive as [REDACTED]. The agent lists the entry IDs it judged relevant, and a person confirms that list.

  5. wpforms-export-entries

    Exports with the same date range and search filter, plus a fields list limited to the columns sales needs. The CSV always carries an Entry ID column; the agent checks the reported total and every Entry ID against the confirmed list and removes any row that is not on it.

Limits

What stays out of reach on WPForms

  • include_sensitive and confirm, where supported, are API prerequisites subject to capability and installed policy, not proof of human consent. Obtain approval for the specific data purpose separately. Permitted fields and exports go to the client/provider; key or pattern masking does not cover arbitrary names or free text. Skill instructions do not enforce a human act.
  • Entry work needs WPForms Pro, the form plugin's paid edition, whichever GoBuildWP edition reads it. Lite forms can be built and edited, but the entry abilities have nothing to act on, and Free's wpforms-list-entries answers wpforms_pro_required.
  • GoBuildWP Free stops at wpforms-list-forms and a redacted wpforms-list-entries, with email and phone answers always withheld. Form and field edits, notifications, starring, CSV export and include_sensitive come with GoBuildWP Pro.
  • Deleting an entry is immediate: WPForms entries have no trash, and their field and meta rows go too. Editing an entry, starring it or marking it read is logged but cannot be rolled back.
  • A form keeps at least one notification and one confirmation; the delete abilities refuse to remove the last of either, so repurpose it with an edit instead.
  • edit-entry changes only the field types WPForms itself lists as editable, and a field's type cannot be switched in place: remove it and add a new one.
  • Deleting a form trashes it by default. With force the post is removed for good, and the change log cannot restore it.

Notifications that reach people, spam settings and leaving WPForms

A WPForms notification that replies to the person who filled in the form

Most WPForms MCP requests about email come down to smart tags. wpforms-create-notification and wpforms-edit-notification accept them verbatim, and WPForms fills them in when someone submits. Setting replyto to {field_id="2"}, where field 2 is the email field, lets staff answer an enquiry straight from their inbox; {all_fields} in the message sends every answer; {admin_email} and {site_name} pull from WordPress settings. The agent should read the form with wpforms-get-form first so it uses the real field id, since ids are never reused and rarely match the order fields appear in.

A notification saved correctly can still land in spam. Keep sender_address on the site's own domain and put the visitor's address in replyto rather than in the sender, then send a test submission from a staging copy and check the received message's headers. That test is the part an agent cannot do for you.

Tightening spam protection with wpforms-edit-form-settings

When a contact form starts collecting junk, wpforms-edit-form-settings changes the common switches on one form without touching its fields: the anti-spam protection, the honeypot, whether spam entries are stored, AJAX submission, the submit button text and the form's CSS class. Storing spam entries lets the agent count them afterwards with wpforms-list-entries and status spam, which is how you tell whether a change worked. These are form-post changes, so rollback-change can put the previous settings back.

Moving a WPForms form to another form plugin

wpforms-get-form-canonical returns a form in GoBuildWP's plugin-neutral form model, the same vocabulary the form-model-migration skill uses for other form plugins. Composite fields such as name and address become a group with sub-fields, layout-only fields such as dividers and HTML blocks are left out, and types with no neutral equivalent come back as warnings for the migration plan rather than vanishing. It is a read, so it is safe on any profile, and it gives a clear list of what a rebuild elsewhere has to recreate by hand: the primary notification is mapped to mail_config and additional notifications to notifications, with warnings and truncation flags to inspect. Confirmations and settings may be echoed in source metadata, but that does not establish equivalent behavior in the destination. Payment behavior and stored entries require separate migration work.

  • "Set the quote form's notification to reply to the customer's email field and include all fields. Show me the stored notification."
  • "Turn on the honeypot and store spam entries on the contact form, then tell me next week how many were caught."
  • "Read only: map the event registration form to the neutral form model and list anything that would not carry over."

Questions

WPForms questions

Can an AI read WPForms Lite submissions?

GoBuildWP cannot read Lite submissions through the supported local entry API. Lite Connect can retain eligible submissions on WPForms' servers and restore them after a paid upgrade; GoBuildWP can read them only once they are available as local entries in a supported WPForms edition. Notification emails and remote backups are not read by these abilities.

Will the agent see card numbers or uploaded files from my entries?

Not by default. Email, phone, password, card, file-upload, camera and signature values and the entry IP are replaced with [REDACTED]. On GoBuildWP Free there is no way round that, and email and phone answers are withheld as well. With Pro they appear only when a call passes include_sensitive together with confirm, under the installed policy. Request that data for a specific approved purpose; the skill guides the agent and does not authenticate human consent.

Does rewriting a form through MCP break old entries?

Removing a field leaves its stored answers in the entry tables, and new fields never reuse its id, so old entries still point at the right data. Replacing the whole fields map through edit-form is the risky path, which the field-level abilities avoid.

Can I undo a WPForms change the agent made?

Form-level changes (fields, notifications, confirmations, settings) are snapshots of the wpforms post, so rollback-change restores them. Entry edits, stars and deletions stay as they are.

WPForms documents its own AI-assistant and Abilities API workflow. Compare the exact fields, notifications and entry operations with GoBuildWP's reference; do not assume both interfaces expose the same actions. WPForms AI assistant documentation

Where these facts come from

GoBuildWP behaviour is taken from the plugin source and the ability reference; third-party details from the vendor documentation below, checked by the GoBuildWP team.

WPForms is a separate product; no partnership or endorsement is implied.

Try it on WPForms in Read Only first

Get GoBuildWP free See Pro pricing