What you need to know
- Server address:
https://trulyform.com/mcp. Keep the/mcpat the end. - Transport: remote MCP over streamable HTTP.
- Sign-in: OAuth with automatic client registration. The person signs in to trulyform in a browser and approves the connection. There is no API key, client secret or request header to configure.
- Plans: every trulyform plan can connect an assistant, Free included. The account needs a verified email address.
- Access: a connected assistant can read the forms and responses of the person's organization, create and edit drafts, and publish forms. There is no read-only or per-form permission.
Set up an assistant
Step-by-step guides for people, one per assistant:
- Claude: Any Claude plan, including Free
- ChatGPT: Plus, Pro, Business, Enterprise or Edu, on the web
- Claude Code: Claude Code installed and signed in
- Cursor: Cursor with remote MCP and OAuth support
- Codex: Codex CLI, IDE extension or desktop app
- VS Code: VS Code with GitHub Copilot, any plan
- Mistral Vibe: Any Vibe plan, including Free
Any other client works if it supports remote MCP servers over HTTP with OAuth and dynamic client registration.
How sign-in works
- The client finds trulyform's OAuth server from the MCP server's metadata and registers itself. trulyform issues public clients, so leave any client ID or client secret field empty.
- The person is sent to trulyform to sign in, or to create an account. A new account confirms its email address first.
- trulyform shows an approval screen with the client's return address, the signed-in email address and the organization. The person approves.
- The client receives tokens. Access tokens last one hour and the client refreshes them on its own. After 30 days without use, the person signs in again.
Clients that offer a "published identity" or client ID metadata document option cannot use it with trulyform. Choose automatic registration instead.
Revoke access
The person can see and revoke every connection in trulyform under Settings → AI connections. Revoking stops future requests at once. Anything the assistant already read stays wherever the assistant keeps it.
When a connection fails
| What happens | Why | What to do |
|---|---|---|
HTTP 401 with a WWW-Authenticate: Bearer header |
Not signed in, or the token expired or was revoked | Let the client run the sign-in again. |
| HTTP 403 | The account's email address is not verified, or the account has no organization | Verify the email address in trulyform, then reconnect. |
| HTTP 429 | Too many requests | Wait a moment. The limit is 120 requests per minute per person. |
Tools return unauthenticated or organization_required |
The same causes, reported by a tool | Reconnect, or join an organization in trulyform. |