# nintact-mcp MCP server for NINTACT — create contact forms, read what came in, approve AI-written replies. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 0.5.1 - **Author:** com.nintact - **License:** MIT - **npm:** nintact-mcp - **Source:** https://github.com/homareyoshizaki/nintact-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-19T17:58:50.664Z - **Version scanned:** 0.5.1 - **CVEs:** none found by OSV at scan time ## Tools 32 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `check_deliverability` — Resolve a domain's live SPF, DKIM, DMARC and MX and say whether mail sent as that domain reaches Gmail today. NO API KEY NEEDED. Use this whenever a user is bui - `design_form` — Turn a plain-language description into form fields, purpose, a success screen and a visual theme. NOTHING IS SAVED — this returns a proposal to show the user. S - `create_form` — Create a form and get paste-ready snippets. The one-line script tag renders the whole form; the form id is public and safe in client-side code. Submissions are - `list_forms` — Every form in this organization, with its endpoint URL. - `get_form` — A form with its fields, success screen and paste-ready snippets. Accepts the uuid or the public id. - `update_form` — Change any part of a form: name, purpose, fields, notification targets, allowed origins, success screen, visual theme and CSS, or turn it off. Passing `fields` - `duplicate_form` — Copy a form's fields, theme, success screen and logo into a new form with its own id. Messages received by the original are NOT copied. Useful for per-branch or - `set_form_logo` — Fetches a public https image and shows it above the form. PNG, JPEG, WebP or GIF under 2MB. SVG is refused on purpose — it can carry scripts, and this image is - `remove_form_logo` — Deletes the stored image and clears it from the form. - `delete_form` — Permanently deletes the form AND every message, draft and reply received through it. Confirm with the user first. To stop receiving without losing data, use upd - `list_messages` — Messages received through forms or forwarded email, newest first. Each carries a category (estimate_request, question, complaint, sales, spam, other) and a one- - `get_message` — A message, the current draft awaiting approval, every earlier draft, replies already sent, and any attachments (with short-lived signed URLs). Photos attached t - `update_message_status` — Move a message out of the way, or put a wrongly-filed one back. Sending a reply is done with approve_draft, not by setting a status. - `regenerate_draft` — Produce a new draft for a message. Earlier drafts are kept as previous versions. Optionally say how to change it, e.g. "shorter, and do not mention price". - `update_draft` — Save an edited subject or body. The model's original text is preserved separately — the difference is what teaches nintact this company's voice. - `approve_draft` — Sends a real email to the person who wrote in. CONFIRM WITH THE USER FIRST. Pass `body` to replace the text before sending; the original draft is kept. Pass `to - `list_knowledge` — What the AI is allowed to use as fact when writing replies. - `add_knowledge` — Facts the AI may state in replies. Anything not written here is left as a [placeholder] for a human instead of being guessed. Adding entries is the highest-leve - `update_knowledge` — Change the text, or set is_active:false to stop using it without deleting it. - `delete_knowledge` — Removes it permanently. - `get_organization` — Company name, industry, signature and extra instructions — all of it feeds every reply draft. - `update_organization` — `ai_instructions` is appended to every draft prompt — use it for house rules (e.g. "always say prices exclude tax", "never promise a delivery date"). `reply_to_ - `list_inbound_addresses` — Addresses that accept forwarded mail. Forward an existing info@ here to run it through nintact. - `create_inbound_address` — Issues an address to forward existing mail to. Mail sent there is classified and drafted exactly like a form submission. Omit `address` to have one generated. - `transfer_workspace` — Moves the whole workspace to another person: they become the owner and billing switches to them. Use this at the end of a build — you set the form up, then hand - `scan_site_for_knowledge` — Reads the organisation's own website (top page plus pricing / about / FAQ pages) and proposes facts that replies can be grounded on: service area, pricing, lead - `get_sending_domain` — By default replies go out from nintact's shared, authenticated domain and the customer needs no DNS. This shows whether the workspace has switched to its own do - `set_sending_domain` — Business plan and above. Registers a domain the organisation owns and returns the DNS records to add. Replies keep going out from the shared domain until verifi - `verify_sending_domain` — Asks the mail provider to re-check the DNS. Returns pending while records have not propagated yet. - `remove_sending_domain` — Goes back to sending from the shared nintact domain. Receiving and history are untouched. - `delete_inbound_address` — Stops accepting mail at that address. Messages already received are kept. - `get_usage` — Draft count against the plan limit. Reaching the limit never stops form submissions — messages keep arriving and are stored; only draft generation pauses. ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"nintact\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"nintact-mcp\"\n ],\n \"env\": {\n \"NINTACT_API_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `NINTACT_API_KEY` — Nintact API Key (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 56, ceiling 56 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/nintact-mcp - Install plan: https://forgeregistry.com/api/v1/packages/nintact-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/nintact-mcp - HTML page: https://forgeregistry.com/registry/nintact-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.