bootstrap_site · one call provisions a site's whole form backend
From no account to verified webhooks — registration, provisioning, snippets, spam, email — over MCP and REST. One workspace runs every site you ship. Everyone else still needs a human in the loop.
paste this into your agent
Fetch furrowforms.com/ai and set up forms for this site.› Set up forms for the Acme Astro site. Domain acmeroofing.com, these Turnstile keys, webhook to our CRM. Contact form and quote form.
⚙ bootstrap_site · client ✓ project ✓ forms (contact, quote) ✓
✎ edit src/pages/contact.astro
+ <form action="https://api.furrowforms.com/s/fp_k7m2" method="POST">
+ <div class="cf-turnstile" data-sitekey="0x4AAA…"></div>⚙ test_webhook ·200 OK · signature verified
Done — both forms live, webhook verified.✓
How it works
Your agent registers over the API — you read it one 6-digit code from your email — then sets security once on the project: Turnstile keys, allowed domains, notify emails, webhook, rate limits, file uploads.
Contact, quote, careers, newsletter — one idempotent bootstrap_site call. Each form gets a POST URL and inherits the site’s configuration automatically. Overrides only where you said so.
Generated frontend code for HTML, Astro, or Next.js — honeypot and Turnstile included — pasted into your repo. Then a signed test delivery: 200 OK, signature verified, before it says “done.”
[ or ] prefer hands-on? The dashboard does all three with clicks — same API underneath. Open the dashboard →
Settings inheritance
Other form backends make you repeat configuration on every single form. In Furrow, security and routing live on the project — one website — and every form under it inherits automatically. Overrides exist, but they're opt-in.
project/acmeroofing.com
Agent control plane
MCP and REST share the exact same domain logic — there is no drift between what agents and humans can do. The dashboard is a thin viewer over the same API. 26 tools cover the entire product, every create is idempotent by slug, and built-in MCP resources let agents self-orient.
An llms.txt tells agents what the product is. Most form backends stop here.
An agent assembles a setup link — then hands off to a human to click, sign in, and paste an endpoint back.
An agent registers the account, creates the client, configures the site, spins up every form, pulls the snippet, and verifies the webhook. Zero clicks — starting from no account.
[ you are here ]{
"client": { "name": "Acme Roofing" },
"project": {
"domain": "acmeroofing.com",
"turnstile": { "site_key": "0x4AAA…", "secret": "•••" },
"notify": ["leads@acmeroofing.com"],
"webhook": { "url": "https://crm.example.com/hooks/furrow" }
},
"forms": [
{ "slug": "contact", "fields": ["name", "email", "message"] },
{ "slug": "quote", "fields": ["name", "email", "sqft", "zip"] }
]
}Streamable HTTP at /mcp or local stdio, authenticated with a bearer token your agent can mint itself — cold-start registration lives at /api/register. Retries never duplicate; creates are idempotent by slug.
Spam stack
[ zero config required ]
A hidden field bots can’t resist. Trips are silently dropped — no fake "clean" submission is ever stored.
Privacy-friendly challenge, on by default. Keys live on the project — rotate once, every form follows.
Submissions are only accepted from origins you list per project. Everything else bounces.
Per-IP, per-form. 10 requests per 60 seconds by default, configurable when you need it.
Delivery
Notifications go to the project's list — forms can override. Subjects and intros take template tokens with fallbacks, and your field contract keeps every email human-readable.
subject: New lead from {{project.name}} — {{name | "someone"}}
intro: Submission #{{count}} on {{form.name}}
fields: your form's fields, human-readable
meta: page URL · origin · UTM · submission IDRecipients are set per project — change the list once, every form follows.
Every delivery is HMAC-SHA256 signed with timestamp, event, and delivery-ID headers — verify authenticity, reject replays. Automatic retries with backoff, up to 8 attempts over ~24 hours, with a full delivery log per project.
X-Furrow-Signature: sha256=9f2b41…
X-Furrow-Timestamp: 1755712803
X-Furrow-Event: submission.created
X-Furrow-Delivery: dlv_2mq8…One call to test_webhook verifies the wiring before you go live.
File uploads follow the same rule. Enable them once per site and visitors attach files on the form; you — or your agent — open them in a private per-site inbox. The email and the webhook link to that inbox, never to a public download URL.
Your form, your markup
Classic HTML POSTs redirect to your thank-you page; fetch calls get JSON back. Snippets are generated from your form's field contract — honeypot and Turnstile included — for HTML, Astro, and Next.js.
<form action="https://api.furrowforms.com/s/fp_k7m2" method="POST">
<input type="text" name="_gotcha" style="display:none" tabindex="-1" />
<input name="name" type="text" required />
<input name="email" type="email" required />
<textarea name="message" required></textarea>
<div class="cf-turnstile" data-sitekey="0x4AAA…"></div>
<button>Send</button>
</form>---
const endpoint = 'https://api.furrowforms.com/s/fp_k7m2';
---
<form action={endpoint} method="POST">
<input type="text" name="_gotcha" style="display:none" tabindex="-1" />
<input name="name" type="text" required />
<input name="email" type="email" required />
<textarea name="message" required></textarea>
<div class="cf-turnstile" data-sitekey="0x4AAA…"></div>
<button>Send</button>
</form>'use client';
export function ContactForm() {
async function submit(formData: FormData) {
const res = await fetch('https://api.furrowforms.com/s/fp_k7m2', {
method: 'POST',
body: formData,
});
const { ok, id } = await res.json(); // { ok: true, id: "sub_…" }
}
return (
<form action={submit}>
<input name="email" type="email" required />
<button>Send</button>
</form>
);
}Built responsibly
[ typescript end to end ]
Only HMAC hashes — rate limiting works without keeping visitor IPs.
Turnstile and webhook secrets under AES-256-GCM; API responses never leak them.
API tokens are stored as hashes. Mint, copy, done — nothing to exfiltrate later.
Thank-you redirect targets are validated against your allowed domains.
Pricing
[ free ]
$0forever
The whole product — full MCP + REST, signed webhooks, the cascade. 100 submissions a month.
[ pro ]
$199per year, per workspace
10,000 submissions a month. Unlimited clients, projects, and forms. Nothing gated.
Outgrow 10,000 submissions? Stack packs on Pro — no tier jumps, no overage math.
$99per year, per pack
No feature gates, no per-form fees, no "contact sales."
[ POST /s/fp_xxxx ]
Other form backends make you configure every form. Furrow configures the website — and your agent can do it for you.
paste this into your agent
Fetch furrowforms.com/ai and set up forms for this site.