How Royal MCP protects personal data in form entries
Form entries are some of the most personal data on a WordPress site: names, email addresses, phone numbers, home addresses and sometimes payment details. From Royal MCP 1.5.15, AI clients such as Claude and ChatGPT can read entries from Contact Form 7 (through Flamingo), Ninja Forms and Fluent Forms, so they can summarise enquiries, spot trends and count submissions. Personal data is masked by default, only administrators can read entries at all, and a site that needs more can opt in field by field. This guide explains exactly what the AI sees and how to change it.
The form entry tools
The tools appear when the form plugin is active. All of them only read: nothing exports, changes or deletes an entry.
| Form plugin | Tools | Where entries come from |
|---|---|---|
| Contact Form 7 | cf7_list_forms, cf7_get_form, cf7_list_submissions | Contact Form 7 does not store submissions on its own. Entries are read from Flamingo, its companion plugin by the same author, or a compatible storage plugin. |
| Ninja Forms | ninjaforms_list_forms, ninjaforms_get_form, ninjaforms_count_entries, ninjaforms_list_entries, ninjaforms_get_entry | Ninja Forms’ own submissions. |
| Fluent Forms | fluentform_list_forms, fluentform_get_form, fluentform_count_entries, fluentform_list_entries, fluentform_get_entry | Fluent Forms’ own entries. |
The count tools return totals by status and the time of the latest entry, with no field values at all. When a question can be answered with numbers, such as “how many enquiries came in this week?”, the AI client can use those and never touch entry contents.
Who can read entries
Only administrators. Every form tool requires permission to manage the site’s options, whatever the “who can connect” settings allow, so an AI client connected by an editor or author cannot read form entries. The form plugin’s own rules apply on top: Ninja Forms’ permission for viewing submissions, and Fluent Forms’ per-form access rules where the site uses them.
Read-only mode, Drafts only and per-connection access levels do not block these tools, because they only read. To stop an AI client from reading entries, connect it from an account that is not an administrator, or switch the form tools off for it in your client.
What is masked by default
Royal MCP looks at each field’s type, its name, its label and its placeholder text, in several languages, to decide whether it holds personal data. A field is masked when it holds or looks like:
- email addresses, phone numbers and names;
- postal addresses, cities, postcodes and countries;
- IP addresses and details of the visitor’s browser, device and location;
- uploaded files and signatures;
- payment and card details;
- hidden fields, passwords, and repeating groups or grids that can contain any of the above;
- anything else the form plugin marks as personal data.
A masked field still appears in the reply with its name, label and type, so the AI client knows the field exists, but its value is empty and it is flagged as masked. For Contact Form 7, the sender’s name and email address are masked too, values from masked fields are blanked out of the message subject, and every field of a message whose form has since been deleted, or that the form no longer has, is masked, because its type can no longer be checked.
Email addresses and phone numbers typed into other fields, such as a message box, are replaced with [email hidden] and [phone hidden]. That includes addresses written out as “name at example dot com”, and the same applies to the choices of a dropdown, checkbox or radio field when the AI client reads a form’s fields; for Contact Form 7 it also covers field labels and the form template. In submitted values, any run of seven or more digits counts as a phone number, so a long order or reference number is hidden too; in a form’s choices and labels, only numbers written like phone numbers are hidden. Dates, prices and shorter numbers are left alone.
Details about who submitted the entry are not shared either. The IP address, browser, device and location are left out, and the ID of the WordPress user account that sent the entry comes back empty. For Fluent Forms, payment details on the entry are left out too, and the page the form was sent from is shown without its query string.
If Royal MCP cannot tell whether a field is personal, it masks it. You may find a harmless field masked because its name or label contains a word like “name”, “contact”, “card” or “account”, such as “Company name” or “Gift card message”. That is deliberate; you can let it through with the filter below.
What is never returned
Some form settings are never returned, even to administrators, because they can expose addresses or keys that are not the AI client’s business:
- Contact Form 7: the mail settings, including recipient addresses.
- Ninja Forms: action settings such as email recipients and add-on keys. The AI client sees which actions a form has and whether they are active, but not how they are configured.
- Fluent Forms: notification, confirmation and integration settings.
The filter below does not change this. It only applies to entry fields and submitter details.
Let more data through with a filter
Some workflows need a real value, for example an AI client that drafts replies to enquiries and needs the sender’s email address. A developer can allow that with the royal_mcp_form_entry_fields filter. The filter runs only after the tool’s permission check has passed, so it never widens who can read entries.
The filter receives the list of names to let through (empty by default), the form plugin (contact-form-7, ninja-forms or fluentform), the form ID, and whether the request is a list of entries (list) or a single entry (single). Return a list containing any of:
- field keys, exactly as your form plugin names the field (a field whose key is one of the submitter-detail names below, such as
cityorcountry, can only be let through with*); - field types:
email,phone,name,addressandfilematch every form plugin’s own spelling (sophonealso covers Contact Form 7’stel, andemailcovers Fluent Forms’input_email); any other type is matched exactly as your form plugin names it; emailandphone, which also stop email addresses and phone numbers being hidden inside other values;- submitter details:
ip,browser,device,city,country,user_id, orsubmitterfor all of them. Each form plugin stores a different set: Fluent Forms keeps all of them, Ninja Forms only the user ID, and Contact Form 7 entries return none of them; - for Contact Form 7,
from,from_nameandfrom_email; - for Fluent Forms,
paymentfor the entry’s payment details; *to let everything through. Use this with great care.
This example lets the AI client see email addresses, and only when it opens a single entry of one Fluent Forms form:
<?php
/**
* Plugin Name: Royal MCP form entry fields
* Description: Lets AI clients read the email field of single entries of form 3.
*/
defined( 'ABSPATH' ) || exit;
add_filter( 'royal_mcp_form_entry_fields', function ( $reveal, $plugin, $form_id, $context ) {
if ( 'fluentform' === $plugin && 3 === $form_id && 'single' === $context ) {
$reveal[] = 'email';
}
return $reveal;
}, 10, 4 );Save it as a file in wp-content/mu-plugins/ so it loads on every request and cannot be switched off by accident. Delete the file to go back to the default masking. For Contact Form 7, the form ID is 0 when the AI client lists submissions without naming a form, so name the form in your request or allow by field key instead.
Whatever the filter lets through is sent to the AI provider you connected, such as Anthropic or OpenAI. Let through only what a task needs, prefer single entries over lists, and make sure your privacy policy covers sharing form data with an AI service.
What you can safely ask
With the default masking, an AI client can still do useful work with your entries:
- “How many contact form entries did we get each week this month, and how many were spam?”
- “Summarise the topics people asked about in the last 50 enquiries.”
- “Which of our forms has had no entries since the redesign?”
- “List the fields on the quote form and tell me which ones are required.”
Troubleshooting
Contact Form 7 submissions come back as unavailable
The reply says a storage add-on is required. Contact Form 7 does not keep submissions; install and activate Flamingo, and new submissions will be stored from then on. Submissions sent before Flamingo was active cannot be recovered.
“You do not have permission to use” the form tools
Form entries are for administrators only. Connect the AI client from an administrator account.
A field I need is masked
Royal MCP masks fields whose name, label or placeholder suggests personal data, even when the field is harmless. Ask the AI client for the entry and note the field’s name, then add that name to the filter. A field you let through by name or type comes back exactly as it was submitted.
Email addresses inside a message show as [email hidden]
That is the default for free text. Let the email type through with the filter if the task needs them, and the same applies to phone.
An order or reference number shows as [phone hidden]
Any run of seven or more digits is treated as a possible phone number. If the task needs those numbers, let phone through with the filter, ideally only for that form and for single entries.
Frequently asked questions
Can the AI client delete or export form entries?
No. The form tools only read. Nothing exports, changes or deletes an entry.
Can an editor’s AI client read form entries?
No. Form entries are for administrators only, whatever the connection settings allow.
Does masking change what is stored in my form plugin?
No. Masking only applies to what Royal MCP returns to the AI client. Your entries stay exactly as they are in the form plugin.
Will the AI ever see the recipients of my form notifications?
No. Contact Form 7 mail settings, Ninja Forms action settings and Fluent Forms notification, confirmation and integration settings are never returned, and the filter does not change that.
Which version do I need?
Royal MCP 1.5.15 or later. Contact Form 7 entries also need Flamingo or a compatible storage plugin.