Forms · 8 modules
WordPress Form Plugin MCP that keeps notifications in step with fields.
A WordPress form plugin MCP has to treat a form as three things: its fields, the confirmation a visitor sees and the notification the team receives. Each module edits them through the form plugin's own storage, and several return entries with personal data redacted unless a call says it needs it.
What goes wrong without a plugin-aware module
- Fields edited without confirmation and notification review
- A successful form save mistaken for real email delivery
- Live entries exposed when representative test data would be enough
Worked example
Add a phone field to a Fluent Forms enquiry form and keep the team's notification email showing everything a visitor typed.
Fluent Forms, because its fields and its notifications are separate records, which is exactly the gap a form change falls into.
wppilot/fluentforms-get-formProFetches the form with include set to fields and notifications, so the agent sees the current field names and what the email is built from.
wppilot/fluentforms-add-fieldProAppends the phone field, or inserts it at a position. The field name is assigned without colliding with existing ones, and a Pro-only field type on a free install is refused.
wppilot/fluentforms-list-notificationsProLists each notification with its subject, whether it is enabled and a summary of who receives it.
wppilot/fluentforms-get-notificationProReads the full message body of the team notification, to see whether it lists fields one by one or uses a tag that includes them all.
wppilot/fluentforms-edit-notificationProIf the message lists fields individually, patches only the message so the new field is included; every other key of the notification is left alone.
What to check yourself. Submit the form yourself with a test phone number. The entry should be stored, the confirmation should show, and the notification should arrive with the number in it. Only that last step proves the email side, and it depends on the site's mail setup as much as on the form.
Why it matters
What plugin-aware changes for forms
A form is three systems wearing one name: the field definition, the confirmation shown to the visitor, and the notification sent to the team. An agent can update the fields perfectly and leave the notification pointing at a field that no longer exists, so the form works and the enquiries stop arriving.
A first safe workflow
Build the form, then be the visitor. Submit it with plausible data, watch the confirmation, and wait for the notification to arrive. Only after that loop passes end to end is the form finished, because every step before it can succeed while the last one silently fails. Use test data, never a real customer's, and delete the test entries afterwards.
How to tell it worked
Submit the form yourself after any change. Confirm the entry is stored, the confirmation renders, and the notification arrives with the merge tags resolved. Deliverability depends on the site's mail transport, which no MCP call can prove for you.
Modules
8 modules compared
Each module loads only when its plugin is active. The Edition column shows how much of each one GoBuildWP Free covers; the rest needs Pro. Open a module for its full ability list, requirements and safety notes.
| Module | Edition | Abilities | Inspect / change / destructive | Covers |
|---|---|---|---|---|
 WPForms | Free 2 + Pro 27 | 29 | 11 / 12 / 6 | forms, canonical form structure, fields and field schemas, confirmations |
 Gravity Forms | Free 2 + Pro 27 | 29 | 11 / 11 / 7 | forms, canonical form structure, fields and field schemas, confirmations |
 Fluent Forms | Pro | 37 | 21 / 5 / 11 | forms and fields, field schemas, form settings, confirmations |
 Formidable Forms | Pro | 40 | 19 / 7 / 14 | forms and fields, field schemas, styles, entries and statuses |
 Contact Form 7 | Free 2 + Pro 9 | 11 | 7 / 3 / 1 | form list, canonical form structure, tag schemas, create and duplicate |
 Ninja Forms | Pro | 22 | 11 / 7 / 4 | forms, canonical form structure, fields and schemas, notifications |
| Forminator | Free 2 + Pro 2 | 4 | 3 / 1 / 0 | forms with field and entry counts, fields in order with ids and options, submission settings, notifications counted, never addressed |
| WS Form | Pro | 4 | 3 / 1 / 0 | forms with an unpublished-changes flag, fields in order with numeric ids, settings and submit actions, email actions counted, never addressed |
Comparing form plugins for agent work
Which form plugins an agent can build with, and which it can only read
Eight form plugins have modules here, but they are not equally open to an agent. Six can be built and edited field by field: WPForms, Gravity Forms, Fluent Forms, Formidable Forms, Ninja Forms and Contact Form 7. The other two are mostly for inspection. Forminator and WS Form list forms, fields in order, settings and completed submissions, and on Pro allow one small edit per form: the title, the submit button text and each field's label, placeholder or required flag. Fields cannot be added, removed, moved or retyped, and notifications are counted rather than addressed.
If you are choosing a plugin for a site an agent will help run, that line matters more than feature lists. A request such as add a phone field and route it to sales is a few calls on the first six and a job for a person in the builder on the last two.
Where submissions are stored decides what an agent can find
An empty entry list is often correct, and the reason differs by plugin. Before asking an agent to summarise enquiries, know where yours actually go:
- WPForms Lite keeps no database copy of submissions, only the emails, so entry work needs WPForms Pro whichever GoBuildWP edition reads it.
- Contact Form 7 stores nothing itself. Submissions are read from Flamingo, and anything sent before Flamingo was installed survives only in inboxes.
- Gravity Forms has no lite edition, so every install stores entries, each one personal data a visitor typed.
- Fluent Forms compliance settings, Formidable's do-not-store option, Forminator's retention rules and WS Form's per-form save setting can each leave nothing to read by design.
Undo differs more between form plugins than anywhere else
Plugins that keep forms as WordPress posts get snapshots from the change ledger; plugins with their own tables mostly do not. Contact Form 7 forms are posts, so create, duplicate, edit and a trashing delete can all be rolled back. A WPForms form edit can be restored from a snapshot of its post. Every Gravity Forms write lands in its own tables and is marked irreversible, as are form, field and action changes in Ninja Forms and Formidable, although a Formidable notification is a post the ledger can snapshot.
WS Form is a case of its own: visitors see a copy taken at the last publish, so an edit changes nothing on the page until someone publishes, and GoBuildWP publishes only when no other unfinished edits would go live with it. Forminator's undo restores the whole settings array, which also reverts changes made later in Forminator's builder. Where a write is irreversible, the result carries the previous values so a person can write them back.
Moving a form from one plugin to another
Agencies inherit sites with three form plugins doing one job. Six modules can read a form into a shared, plugin-neutral model: wpforms-get-form-canonical, gravityforms-get-form-canonical, fluentforms-get-form-canonical, formidable-get-form-canonical, ninja-forms-get-form-canonical and cf7-get-form-canonical. An agent reads the old form that way and rebuilds it with the target plugin's own create and add-field abilities.
Two things never travel. Submissions are not part of any migration, so the old plugin's entries stay where they are until you export or erase them. And composite fields such as names and addresses fold into a group in the shared model, so check the rebuilt form field by field, then point the notification at the new field names before switching the embed on the live page.
Form plugins that ship their own AI access
Gravity Forms now includes an MCP server of its own, switched on in its settings, and Ninja Forms registers abilities through the WordPress Abilities API for clients connected through the MCP Adapter. Both act as the WordPress user that connects, which is why Gravity Forms advises a dedicated account with minimal permissions rather than an administrator. They can run beside GoBuildWP. What GoBuildWP adds is masking on its own entry reads, with rules that differ by plugin (each entry ability's reference row says what it withholds), and the change ledger on writes; check which server a client used when you review its work.
Form entries, AI and privacy: deletion is the part people forget
Reading entries is guarded; removing them is where data protection obligations actually bite. WPForms and Fluent Forms submissions have no trash, so a delete is final. Deleting a Fluent form with cascade, or any Ninja Forms form, takes every submission with it. Removing a Contact Form 7 form does the opposite and leaves its Flamingo messages behind, so an erasure request needs a separate clean-up there.
Payment forms add one more trap. Formidable's cancel-subscription changes only its local record and never contacts Stripe, PayPal or Square, so cancel at the gateway first. Keep entry and payment abilities off any token that only builds forms, and give the ones that read submissions to the fewest people. Safety profiles set the ceiling for each connection.
FAQ
Forms and AI, answered
Can an agent read form submissions?
Entry reads are available where the form plugin exposes them, and they are the abilities most worth restricting. Submissions usually contain personal data supplied by a visitor, so read them only when the workflow needs them and prefer representative test data. Entry exports for WPForms, Gravity Forms, Formidable, Ninja Forms and Contact Form 7 through Flamingo return passwords, card numbers, uploads, signatures and IP addresses as [REDACTED] unless the call confirms it needs them. GoBuildWP Free's entry reads for WPForms, Contact Form 7, Gravity Forms and Forminator also withhold email and phone answers, and nothing reveals them.
If a form change returns success, has the notification been tested?
No. A successful save proves the configuration was written, not that mail leaves the server. Deliverability depends on the site's mail transport and DNS, so submit the form and confirm the message arrives.
Can an agent build a whole form from a description?
Yes, and it is one of the clearer wins here. Review the field types, required flags, confirmation text and notification routing before the form reaches a real visitor.
Start in Read Only, then add what the site runs
Connect your AI client to the free MCP foundation and check what it can see. The free plugin already covers the basics for WPForms, Gravity Forms, Contact Form 7 and Forminator; add Pro when a job needs more.