MCP overview
What Pollaris MCP can do, how it authenticates, and its safety boundaries.
Pollaris exposes a remote Model Context Protocol server for form authoring. Connect it to a compatible AI client, then ask the assistant to inspect, generate, or update Pollaris drafts in natural language.
Connection details
| Setting | Value |
|---|---|
| Transport | Streamable HTTP |
| Endpoint | https://mcp.pollaris.cc/mcp (the full URL shown by Pollaris, ending in /mcp) |
| Authentication | OAuth agent grant or Authorization: Bearer <MCP_API_KEY> |
| Legacy key prefix | plr_mcp_v1_ |
| Minimum required scope | pollaris.forms.read |
Use the complete endpoint. Do not remove /mcp, change the transport to SSE, put the key in the URL, or send it as a tool argument.
What the assistant can do
Depending on the connection's scopes and your live workspace role, an assistant can:
- List the workspaces granted to the key.
- List forms and inspect their current editable drafts.
- Compile Pollaris form DSL into a canonical form definition.
- Validate a form definition without saving it.
- Generate an AI-authored preview without saving it.
- Create a new draft or replace an existing draft.
- With an OAuth publish grant, start a durable create-and-publish job and return its public URL.
See MCP tools for parameters, permissions, and example requests.
Safety boundaries
Pollaris MCP is deliberately limited to authoring:
- API-key connections remain draft-only. OAuth connections publish only when you grant
pollaris.forms.publish. - It does not expose responses, answers, contacts, or respondent personal information.
- It cannot delete forms.
- A generated preview is not saved until the assistant calls a write tool.
- Draft replacement uses a revision check, so an assistant cannot silently overwrite a newer edit.
- Write operations require an idempotency key, which prevents an accidental retry from creating the same change twice.
MCP tool annotations help clients decide when to ask for confirmation, but the client remains responsible for showing approvals. Review proposed write calls before approving them.
Authentication model
Pollaris accepts scoped OAuth agent grants when the deployment enables agent access. Existing Pollaris-issued MCP API keys remain supported and are separate from:
- The token used by the Pollaris web app.
- Any OpenAI, Anthropic, or other model-provider key.
- A public form slug used by embeds.
The CLI can create a local MCP bridge without copying a key; see Agent and MCP connections. Direct remote clients can use Pollaris OAuth when the deployment has enabled the feature. Otherwise use the API-key setup below for draft access.
First connection checklist
- Create an MCP API key with only the workspaces and scopes you need.
- Add the full MCP URL and Bearer token to your client.
- Restart or reload the client if required.
- Confirm that
list_workspacessucceeds. - Ask the assistant to inspect a draft before allowing write access.
Continue with MCP API keys, then choose your client from the documentation index.