Doorman

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Spam, pitch and fraud screening for website forms. Sign up, wire forms, test and review.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Doorman": {
      "url": "https://withdoorman.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (12)

• doorman_docs read-only

  Read how Doorman works and how to integrate it (the same text as /llms.txt). Call this first if you haven't used Doorman before.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• doorman_signup

  Create a Doorman account for the user with a first form and an API key. Ask the user for their email first. They'll get an email to set a dashboard password. Creates the account's first form too and returns its id and action URL, plus the api_key (store it as DOORMAN_KEY in the project's local secrets file, never commit it). Only for new users: if they already have an account, ask for a key instead. Until the user clicks the confirmation link in that email, nothing is emailed to them (100 checks; Slack and webhooks work).

  Parameters:

  • email (required) — string — The user's email. Real submissions are forwarded here by default.
  • site_url (required) — string — The website the form is on, e.g. acme.com
  • site_context (required) — string — One or two sentences: what the business sells and to whom. Doorman compares every submission against this. Read the project's README/landing copy to write it.
  • mode — string — watch delivers would-be drops, tagged; holds still follow forward_holds. Recommended for a new lead form: switch to enforce after a week or two of verdicts look right. Default enforce.
  • form_name — string — Optional name, e.g. 'Contact form' or 'Demo request'

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• doorman_whoami read-only

  Account, plan and this month's usage.

  Parameters:

  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• doorman_list_forms read-only

  List the account's forms with their action URLs and settings.

  Parameters:

  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• doorman_create_form

  Create another form endpoint (one per distinct form on the site: contact, demo request, checkout, comments).

  Parameters:

  • name (required) — string — Form name
  • kind — string — lead = contact/demo/quote/sales form (default)
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.
  • email_to — string — Comma-separated emails to forward real submissions to
  • slack_url — string — Slack incoming webhook URL
  • webhook_url — string — HTTPS URL that receives a signed JSON POST per real submission
  • redirect_url — string — Where to send the visitor after submitting (default: a Doorman thank-you page)
  • site_context — string — What the business sells and to whom

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• doorman_update_form

  Change a form's settings: context, destinations, thresholds, watch mode, allow/block lists.

  Parameters:

  • form_id (required) — string — f_...
  • kind — string
  • mode — string — watch = deliver would-be drops, tagged (a safe way to start)
  • name — string — Form name
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.
  • email_to — string — Comma-separated emails
  • slack_url — string — Slack incoming webhook URL
  • allow_list — array — Emails or domains always delivered without judging
  • block_list — array — Emails or domains always dropped
  • deliver_at — number — Deliver when P(real) >= this (default 0.8)
  • drop_below — number — Drop when P(real) < this (default 0.2)
  • webhook_url — string — HTTPS webhook URL
  • redirect_url — string — Redirect after submit
  • site_context — string — What the business sells and to whom
  • forward_holds — boolean — Forward held submissions, flagged (default true)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• doorman_get_install_snippet read-only

  Get ready-to-paste integration code for a form on a given platform. Use 'html' for static sites, 'react' for SPA client components, and 'fetch' (plain fetch with timeout and fallback: Workers, Node, Next, Deno), 'nextjs', 'express', 'python', 'ruby' or 'elixir' when the form already posts to the project's own backend.

  Parameters:

  • form_id (required) — string — f_...
  • platform (required) — string
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• doorman_test_submission

  Judge a sample message against a form's settings. Free, not forwarded, not counted. Use it to show the user Doorman working after setup (try one genuine enquiry and one sales pitch).

  Parameters:

  • form_id (required) — string — f_...
  • message (required) — string — The message text
  • email — string — Optional sender email
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• doorman_send_test_delivery

  Send a sample delivery to the form's email/Slack/webhook destinations and report whether each one worked.

  Parameters:

  • form_id (required) — string — f_...
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• doorman_list_submissions read-only

  Recent submissions with their verdicts. Use review=true for held ones waiting for a human.

  Parameters:

  • limit — number
  • route — string
  • review — boolean
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.
  • form_id — string — Optional f_...

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• doorman_label_submission

  Mark a submission real (delivers it if it was held or dropped) or spam.

  Parameters:

  • submission_id (required) — string — sub_...
  • label (required) — string
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• doorman_contact_support

  Stuck, or something isn't working? Send the problem straight to Doorman's founder, with the error you hit. Your account context (plan, forms, recent errors, never keys) is attached, and the reply goes to the account email. Use it instead of guessing at a fix.

  Parameters:

  • message (required) — string — What you were trying to do and what happened
  • error — string — The exact error text, if any
  • api_key — string — Doorman API key (dm_live_...). Only needed if the MCP connection has no Authorization header.
  • category — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.