MCP server.
Mailan speaks the Model Context Protocol. Connect an AI assistant such as Claude or Cursor with a personal token, and it can set up a contact form for a website on its own: create the form, configure spam protection and notifications, add integrations and hand you the HTML to paste.
Create a token
In the dashboard under Settings → General → „MCP for AI assistants", give the token a name and create it. The plaintext (it starts with mln_mcp_) is shown once; after that only its hash exists. MCP is part of every plan; an account can hold up to ten active tokens and revoke each one at any time.
Connect your assistant
The server uses the Streamable HTTP transport. Every client that can reach a remote MCP server with a custom header works; the token goes into the Authorization header as a bearer token.
Claude Desktop starts local servers only, so the small mcp-remote bridge forwards to Mailan. Node.js has to be installed for npx.
Tools
Ten tools, all acting on the account the token belongs to. They follow the same rules as the dashboard: plan limits, validation and the allowed redirect domains apply unchanged.
| Tool | What it does |
|---|---|
list_forms |
All forms of the account with settings and submit URL. |
get_form |
One form with all its settings. |
create_form |
Creates a form. Only the name is required; without recipients, submissions go to your account email. |
update_form |
Changes settings: recipients, subject, redirect, allowed domains, captcha, spam filter, autoresponder, sender. |
get_embed_code |
Ready-to-paste HTML with the client script, the honeypot and the fields you choose. |
list_integration_types |
The available integrations and the config fields each one needs. |
list_integrations |
The integrations of a form. Secrets only appear as „set" or „not set". |
create_integration |
Adds an active integration, e.g. a webhook or a Google Sheet. |
update_integration |
Activates or deactivates an integration, or replaces its config. |
test_integration |
Checks an integration's stored config without delivering a submission. |
What a token cannot do
The tool list is deliberately narrow, so handing a token to an assistant stays a small risk.
| Only your data | Every tool is bound to the token owner. A form of another account answers „Form not found" — indistinguishable from one that does not exist. |
| Nothing is deleted | There is no tool to delete forms or integrations, rotate an access key or block a form. Integrations can only be switched off. |
| No account access | Profile, password, plan, linked emails and tokens are out of reach. Submissions are not readable through MCP either. |
| Separate credential | An MCP token is not accepted by the REST API, and an API key is not accepted by the MCP server. |
| Rate limit | 120 requests per minute per token, like API keys. |
Example
Ask in plain language — the assistant picks the tools itself:
„Create a contact form for example.com with name, email, phone and message. Only accept submissions from example.com, turn on the ALTCHA captcha, send every submission to my webhook https://example.com/hook and give me the HTML."
The assistant calls create_form, update_form, create_integration and get_embed_code and answers with the form ready to paste.
Protocol details
JSON-RPC 2.0 over POST, answered with plain JSON — no session, no server-sent events. Supported protocol versions: 2025-06-18, 2025-03-26 and 2024-11-05. Errors a model can act on (validation, plan limits, not found) come back as tool results with isError, so the assistant reads the message and corrects itself.