MCP & AI assistants
- Build forms directly from ChatGPT, Codex, Claude Code, Cursor, and other MCP-compatible assistants, with guest-first creation that does not require signing in before the first preview.
- Preview guest drafts safely before saving them. Previews are now read-only, remain stable for the lifetime of the draft, and offer a clearer Open in OpnForm handoff when you are ready to continue in the editor.
- Get more predictable integrations through structured output schemas across every OpnForm MCP tool.
- Create better forms with clearer AI authoring guidance and non-blocking quality suggestions for labels, placeholders, long-answer fields, submit actions, and completion messages.
- Use computed variables and recursive display logic more reliably through improved MCP schemas, field catalogs, plugin guidance, and documentation.
- Access MCP setup guidance directly from Cloud settings. On self-hosted instances, MCP activation remains restricted to instance administrators.
- Install the finalized official OpenAI plugin package, including the verified domain, published widget origin, tool annotations, and hardened ChatGPT widget contract.
Other improvements
- PDF templates can now use computed variables in mapped zones. Computed values are available in the PDF editor and are evaluated when a submission PDF is generated.
- Form definitions are normalized consistently across the editor, API, duplication, and MCP. Safely repairable issues are cleaned automatically, while actionable errors now point to the affected field or computed variable.
- The Docker setup command now accepts
--public-url, updates the required backend and frontend URL variables, preserves existing secrets, and warns when a production installation still points to localhost.
Fixed
- Block settings now stay on the rendered page when forms contain leading, consecutive, hidden, or trailing page breaks.
- Strikethrough formatting in field help text is preserved after publishing and reopening a form.
- PDF downloads, submission files, and local temporary files now remain valid when a self-hosted instance uses a reverse proxy or an internal hostname different from its public URL.
Security
- Changing an account email now requires current-password confirmation and throttles failed attempts. Unsupported changes are blocked for passwordless OAuth and OIDC-managed accounts.
- Password-reset responses no longer reveal whether an account exists, and reset delivery is deferred and rate-limited by IP and email address.
- Guest MCP previews are read-only; editor handoffs are created only after an explicit Open in OpnForm action.
Upgrade
This release does not include database migrations. Follow the standard OpnForm upgrade process, update both Docker images to v2.5.0 (or pull latest), and restart the instance.
For Docker-based self-hosted installations, you can rerun setup with your canonical public URL without rotating existing application keys or shared secrets:
./scripts/docker-setup.sh --public-url https://forms.example.comEnsure APP_URL and FRONT_URL resolve to the public origin used by browsers, email links, and integrations.
Full changelog
- Compare
v2.4.0...v2.5.0— all 24 commits, including nine MCP preview and widget hardening follow-ups. - #1233 Computed variables in generated PDFs
- #1265 MCP setup guidance for Cloud and self-hosted users
- #1266 Official OpenAI plugin distribution package
- #1267 Guest-first MCP form creation
- #1268 OpenAI plugin domain verification
- #1269 Block settings navigation with empty page breaks
- #1270 Guest-first ChatGPT form creation
- #1271 MCP output schemas
- #1272 Preserved strikethrough in form help text
- #1273 Better AI-generated form quality
- #1274 Read-only and resilient guest previews
- #1282 Hardened form-definition validation
- #1283 Hardened account email flows
- #1285 Improved Docker public URL setup
- #1284 Self-hosted signed file URL validation