LoginSign Up
← Back to all sparks
F

Formidable Forms

MKT AUTO
Velocity6.3

Advanced WordPress form builder with calculations, views, and data-driven applications

formidableforms.com ↗

Formidable widens MCP compatibility and locks down signature files

wordpressformsmcpagent-accesssecurity
◆Current state
Forms API v2.0.1 makes the Formidable MCP server tolerate the older MCP adapter versions bundled in other plugins such as WooCommerce and Rank Math, instead of refusing with an incompatibility message. Digital Signature Forms v3.2 adds form-level protection for signature files, a role requirement to access them, and permanent deletion of old signatures when an entry is deleted.
◆Where it's heading
Two threads are running in parallel across the add-on family. One is agent access, opened by the Forms API v2.0 MCP adapter and the WordPress Abilities API, now being made to coexist with the other plugins already shipping MCP adapters on the same site. The other is a sustained security pass, visible in signature file handling, tokenized CSV downloads, and the Stripe and core-plugin hardening earlier in the window.
◆Prediction
Adapter-version collisions between plugins are likely to recur as more WordPress plugins ship MCP servers, so expect further compatibility patches rather than new API surface in the near term.

◆Recent moves

  1. 2d ago

    Formidable MCP server works alongside older adapters from other plugins

    A compatibility patch on the MCP work that Forms API v2.0 opened: the server now runs against the older MCP adapter versions bundled in WooCommerce and Rank Math rather than refusing to load. Small in scope, but it is what makes the agent-access story survive a real multi-plugin site.

    View source ↗
  2. 2d ago

    Signature files gain form-level protection and role-gated access

    Signature forms get access controls: protect all signature files per form, require a role to read them, and permanently delete old signatures when the entry goes. Continues the security pass running through the add-on family.

    View source ↗
  3. 7d ago

    Entry search reaches repeater and embedded form data

    Entry search reaching repeater and embedded form data — a core-plugin capability fix in the same window as the API and signature work.

    View source ↗
  4. 8d ago

    Forms API v2.0

    ⚡ SPARK

    The release that opened the agent-access thread this window extends: an MCP adapter plus WordPress Abilities API support, letting an AI client read and update form data without a custom integration.

    View source ↗
  5. 15d ago

    Signature deletion validation tightened after a Wordfence report

    Validation added so only signature files, and only those on the active entry, can be deleted — credited to Wordfence. The precursor to v3.2's broader access controls.

    View source ↗
  6. 27d ago

    Export shortcode works when the view export link is disabled

    A single shortcode fix in the Export View add-on with no wider effect.

    View source ↗