![\".\"](\"https:\/\/www.2manydots.nl\/wp-content\/uploads\/2026\/08\/gravity-forms-example-1-1024x384.png\")
What exactly is Gravity Forms MCP?<\/h2>\n
The Abilities API was introduced in WordPress 6.9. It\u2019s a standardized way for WordPress, plugins, and themes to document what they can do. Each ability is a single, clearly defined action, with its own input, output, and permission checks. <\/p>\n
MCP stands for Model Context Protocol. It is the open standard that connects AI assistants to the programs they need to work with. Gravity Forms builds on top of that and provides your assistant with a toolkit: one tool for each task that Gravity Forms can perform. <\/p>\n
Think of the Abilities API as a menu and MCP as the waiter. WordPress lists what\u2019s available to order, the assistant passes on your order, and the kitchen still decides what goes out the door. Because every action goes through the same WordPress permissions that protect your site today. <\/p>\n
Two things have been taken care of:<\/p>\n
- \n
- The clutch is turned off by default.<\/strong> There is no button to turn everything on at once. You have to turn on each tool separately. Viewing tools only allow you to view content. Writing and deletion tools must be turned on separately, and the assistant will first ask for confirmation before performing any deletion actions. <\/li>\n
- The assistant logs in as a user.<\/strong> The connection uses an application password from a WordPress account. If that user can’t do something, the assistant can’t do it either. <\/li>\n<\/ul>\n
You need WordPress 6.9 or later on a self-hosted site. WordPress.com is not currently supported. This feature is included in Gravity Forms 3.1 and is available with every license, from Basic to Developer. <\/p>\n
How it’s useful in practice<\/h2>\n
These are the applications we get the most out of ourselves:<\/p>\n
- \n
- Building a form from a description:<\/strong> You describe in plain language which fields you want, in what layout, and with what confirmation and notification options. The assistant sets it up for you. A detailed registration form that would normally take you half an afternoon is ready in just a few minutes. <\/li>\n
- One change that affects many forms:<\/strong> Adding a consent checkbox to all forms on a site is usually way too much work. Now it\u2019s just one task. <\/li>\n
- Unraveling Conditional Logic:<\/strong> The assistant can precisely map out which field triggers which other field, including the logic behind notifications and confirmations. Ideal for forms where you\u2019re not sure how or what to do. <\/li>\n
- Document what happens after a submission:<\/strong> what confirmation the user receives, what notifications are sent out, and which feeds send data to Mailchimp, Klaviyo, or any other tool. This is helpful for a handover or an audit. <\/li>\n
- Creating test submissions:<\/strong> The assistant can generate realistic test submissions for new pages or forms. These submissions go through the entire Gravity Forms pipeline, so validation, notifications, and integrations work exactly as they normally do. This allows you to test the entire process, not just the form. <\/li>\n
- Manage feeds and notifications:<\/strong> create and update links, resend a notification for an existing submission, or add a note to a submission so your colleague can see what happened.<\/li>\n<\/ul>\n
What stands out to you about this nice list? Almost everything is about the structure of your forms, not about the people who fill them out. As far as we\u2019re concerned, that\u2019s exactly where the line is drawn. <\/p>\n
Be careful with the submissions<\/h2>\n
\n
What do your entries actually say?<\/p>\n<\/blockquote>\n
With Gravity Forms, it\u2019s rarely just a list with a name and an email address. We see job applications that include resumes, requests for quotes with revenue figures, complaints, student registrations, and intake forms with questions about health. That\u2019s personal data\u2014and sometimes even sensitive personal data. <\/p>\n
Our advice on this is simple: don\u2019t run those submissions through an AI assistant. Not because the technology isn\u2019t reliable, but because you\u2019re passing someone else\u2019s data on to a third party without that person\u2019s consent. Under the GDPR, you\u2019re responsible for that. You need a legal basis\u2014a data processing agreement with the assistant\u2019s provider\u2014and the processing must be documented in your records. <\/p>\n
And keep in mind: an assistant doesn’t have to export an entire database to cause a problem. A seemingly harmless request like “Please summarize this month’s complaints” sends the full text of all those complaints out. <\/p>\n
![\".\"](\"https:\/\/www.2manydots.nl\/wp-content\/uploads\/2026\/08\/beslisboom-inzendingen-ai-2md.svg\")
<\/figure>\nAre you going to do it anyway? Then do it this way <\/h3>\n
Sometimes there’s a good reason to work with real data. If so, stick to these seven points. <\/p>\n
- \n
- Work in an isolated environment.<\/strong> A separate staging copy without actual data, or with anonymized data. Not on the production environment, and not in the same environment where you normally do your work. <\/li>\n
- Turn off training on your data.<\/strong> This is the most important point. With free and consumer accounts, your input is often used by default to train models. This is usually not the case with business subscriptions, but don\u2019t assume that\u2019s always true. Check the settings for each account and review what the terms and conditions state. <\/li>\n
- Create a separate WordPress user.<\/strong> Only with the permissions that the link actually needs. Never use your own administrator account. <\/li>\n
- Enable only the tools you need.<\/strong> Start with the reading tools. Leave the submission tools turned off until you have a specific reason to turn them on, and then turn them off again. <\/li>\n
- Treat the application password as a key.<\/strong> You’ll only see it once. Save it in your password vault and enter it as soon as the job is done. <\/li>\n
- Write down what you do.<\/strong> Which site, which user, which tools, which assistant, and since when. We operate under ISO 27001 certification, so for us, this isn\u2019t extra work\u2014it\u2019s simply part of the process. <\/li>\n
- Or keep everything in-house: run a local model.<\/strong> Do you have a recent MacBook with enough memory, or a Windows PC with a powerful graphics card? If so, you can simply run an open-source model like Qwen, Gemma, or Llama on your own machine. With LM Studio, you can set it up in just a few minutes\u2014including the MCP integration. Your prompts and submissions never leave your laptop, so there\u2019s nothing to train with, and you don\u2019t need a data processing agreement for it. You\u2019ll need a Mac with 32 GB of RAM or more, or a graphics card with 16 GB of video memory or more. A local model is, however, less powerful than a large cloud model. It works great for overviews and one-off tasks, but you\u2019ll run into limitations with long chains of steps. If you have any questions about this, we\u2019re happy to help! <\/li>\n<\/ol>\n
How We Use It for Our Customers<\/h2>\n
We use Gravity Forms as our standard for virtually all of our clients. That makes maintenance, security, and releases like this one much easier to manage: one plugin we know inside and out, and the same approach on every site. <\/p>\n
For MCP, we follow a set procedure. First in a test environment, and only then in production. One separate user account per site, with minimal permissions. By default, only read-only tools are enabled. Write tools are used only when there is a specific task to be done, and always after creating a fresh backup. <\/p>\n
Here\u2019s another tip: Gravity Forms comes with a skill file that you load into your assistant. It explains how Gravity Forms works, from the available field types to how conditional logic works. It works without that file, too, but with it, your assistant makes noticeably fewer mistakes. It takes two minutes, so go ahead and do it. <\/p>\n
Because one thing remains true: an AI assistant makes mistakes. An assistant that misinterprets a field and confidently generates a form that looks fine but is incorrect is more annoying than an assistant that does nothing at all. Check every change before you rely on it. <\/p>\n
![\".\"](\"https:\/\/www.2manydots.nl\/wp-content\/uploads\/2026\/08\/gravity-forms-skills-1024x208.png\")
Source: Gravity Forms<\/figcaption><\/figure>\n All in all…<\/h2>\n
Gravity Forms MCP takes the drudgery out of form management. Building, customizing, troubleshooting, and documenting forms are much faster, and the security is well thought out: disabled by default, enableable on a per-tool basis, and tied to a WordPress user\u2019s permissions. For anyone who works with forms, this is a release you should seriously consider. <\/p>\n
But draw the line at the submissions. They don\u2019t belong to you\u2014they belong to the people who filled out your form. Use MCP for the structure of your forms and keep the data where it belongs. If you do need to work with actual submissions, do so in an isolated environment and disable training on your data. Always. <\/p>\n
Do you want to use Gravity Forms MCP on your site, but aren’t sure if it’s GDPR-compliant? Or do you just want someone to take a look before you connect an AI assistant to your WordPress site? We’re happy to help you find a solution.<\/a><\/p>\n","protected":false},"author":3,"featured_media":7372,"template":"","tags":[300,301,184],"type_news_pt":[193],"theme_news_pt":[252],"class_list":["post-7375","news_pt","type-news_pt","status-publish","has-post-thumbnail","hentry","tag-ai","tag-gravity-forms","tag-wordpress-en","type_news_pt-blogs-en","theme_news_pt-wordpress-links"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/news_pt\/7375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/news_pt"}],"about":[{"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/types\/news_pt"}],"author":[{"embeddable":true,"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/media\/7372"}],"wp:attachment":[{"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/media?parent=7375"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/tags?post=7375"},{"taxonomy":"type_news_pt","embeddable":true,"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/type_news_pt?post=7375"},{"taxonomy":"theme_news_pt","embeddable":true,"href":"https:\/\/www.2manydots.nl\/en\/wp-json\/wp\/v2\/theme_news_pt?post=7375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Turn off training on your data.<\/strong> This is the most important point. With free and consumer accounts, your input is often used by default to train models. This is usually not the case with business subscriptions, but don\u2019t assume that\u2019s always true. Check the settings for each account and review what the terms and conditions state. <\/li>\n
- One change that affects many forms:<\/strong> Adding a consent checkbox to all forms on a site is usually way too much work. Now it\u2019s just one task. <\/li>\n
- The assistant logs in as a user.<\/strong> The connection uses an application password from a WordPress account. If that user can’t do something, the assistant can’t do it either. <\/li>\n<\/ul>\n