MCP, MCP server
com.furrowforms/furrow-forms
Form backend an agent runs end to end: provision forms, snippets, spam, signed webhooks.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit a1658d8d729c, unchanged since the check below.
NETWORK_NO_FIXED_HOST SECRETS_ENV_READ
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
release.sh, line 41
[[ -f icon.png ]] || curl -fsSL -o icon.png https://api.furrowforms.com/brand/icon.png - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
mcpb/server/index.js, line 18
const token = process.env.FURROW_TOKEN?.trim();
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
release.sh, line 41
[[ -f icon.png ]] || curl -fsSL -o icon.png https://api.furrowforms.com/brand/icon.png
examples/contentful/components/ContactForm.tsx, line 6
await fetch('https://api.furrowforms.com/s/fp_k7m2', {
examples/nextjs/components/contact-form.tsx, line 9
const res = await fetch('https://api.furrowforms.com/s/fp_k7m2', {
Show more
examples/payload/components/ContactForm.tsx, line 6
const res = await fetch('https://api.furrowforms.com/s/fp_k7m2', {
examples/sanity/components/ContactForm.tsx, line 6
await fetch('https://api.furrowforms.com/s/fp_k7m2', {
examples/vercel/components/contact-form.tsx, line 6
const res = await fetch('https://api.furrowforms.com/s/fp_k7m2', {
skills/furrow-forms/README.md, line 17
curl -fsSL https://furrowforms.com/skill.md -o ~/.claude/skills/furrow-forms/SKILL.md
examples/astro/README.md, line 40
`fetch()` → `{ "ok": true, "id": "<submission_id>" }`.
examples/astro/README.md, line 89
Yes - submit with fetch() from a small client-side script or framework island, and Furrow returns { "ok": true, "id": "sub_…" } as JSON. The redirect behavior is only for classic H
examples/bolt/README.md, line 34
`fetch()` → `{ "ok": true, "id": "<submission_id>" }`.
examples/claude-code/README.md, line 37
`fetch()` → `{ "ok": true, "id": "<submission_id>" }`.
examples/cloudflare-pages/README.md, line 38
`fetch()` → `{ "ok": true, "id": "<submission_id>" }`.
examples/contentful/README.md, line 23
await fetch('https://api.furrowforms.com/s/fp_k7m2', {
examples/contentful/README.md, line 49
`fetch()` → `{ "ok": true, "id": "<submission_id>" }`.
examples/craft-cms/README.md, line 37
`fetch()` → `{ "ok": true, "id": "<submission_id>" }`.
examples/craft-cms/README.md, line 72
4. For headless builds: submit via fetch() and read the JSON response for inline success states.
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
mcpb/server/index.js, line 18
const token = process.env.FURROW_TOKEN?.trim();
packages/mcp/bin/furrow-forms-mcp.js, line 18
const token = process.env.FURROW_TOKEN?.trim();
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a1658d8d729c. can reach a host that is not written as a fixed address. reads an environment variable.
Date and source
Date checked:
github.com
Commit graded: a1658d8d729cf6048818a31bd5416cb6914070ec
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.