How to Connect Typeform to VS Code Copilot With Aident Loadout

To connect Typeform to VS Code Copilot with Aident Loadout, add the Aident MCP server to VS Code, complete Aident OAuth, connect the intended Typeform account through Aident Vault, and verify the connection with one bounded form-list request. The first proof should return only a form count and pagination status. It should not read responses, download uploads, create a webhook, or change a form.

This guide is for operators and developers who want GitHub Copilot in VS Code to work with Typeform without placing a Typeform token in a repository, prompt, or MCP configuration. A successful check proves that Copilot can reach limited Typeform metadata through the reviewed Aident connection. It does not authorize access to submissions or any provider write.

The Safe First Boundary

Typeform separates form metadata, response data, and webhook behavior. Its documented OAuth scopes include distinct read permissions for forms, responses, and webhooks. Keep those boundaries separate in the agent workflow too.

Prerequisites

You need:

• VS Code with GitHub Copilot signed in and Agent mode available;

• permission to add an MCP server at the chosen workspace or user scope;

• access to the intended Aident account;

• authority to connect the intended Typeform account; and

• a trusted session where private form metadata can be reviewed without being copied into source control.

If the workspace is shared, decide whether the server configuration belongs in the repository before you create it. The Aident server URL is not a secret, but changing workspace MCP configuration changes which tools collaborators may be asked to trust.

1. Add Aident Loadout to VS Code

Create .vscode/mcp.json in the workspace:

{
  "servers": {
    "aident": {
      "type": "http",
      "url": "https://loadout.aident.ai/mcp"
    }
  }
}

VS Code supports workspace and user MCP configuration and provides controls to start, stop, and inspect configured servers. Review the file before starting the server. Do not add a Typeform token or Aident token to this JSON.

If you use a remote Agent Host or need configuration that is portable across Copilot tools, follow VS Code's current MCP configuration reference. The current documentation distinguishes the ordinary workspace .vscode/mcp.json path from portable .mcp.json and user-level Copilot configuration.

2. Start the Server and Review Trust

Open .vscode/mcp.json, start the aident server from the editor control, and review the server URL when VS Code asks whether you trust it. Complete the Aident OAuth window.

Then open Copilot Chat in Agent mode and inspect the available tools. A safe verification prompt is:

Use Aident to list my available capabilities. Do not execute a provider Action

Expected result: Copilot can see the focused Aident tools and can search the capability catalog. Stop if the server URL, signed-in Aident account, or requested permission is not the one you intended.

3. Connect Typeform Through Aident Vault

Open the Aident dashboard and go to the Apps area:

https://loadout.aident.ai/dashboard/apps

Choose Typeform, start the connection, and review the provider consent. Use a dedicated account or the narrowest available grant for the job. Do not expand access merely to make the first test pass.

After consent, ask Copilot to check Aident account and Vault status for Typeform without running a Typeform Action. Confirm the account alias and connection owner. If Typeform is already connected, inspect that connection before replacing or disconnecting it.

4. Discover the Current Form-List Action

Ask Copilot to search by job instead of guessing an internal identifier:

Search Aident Loadout for the current Typeform Action that lists forms without
reading responses. Return the Action's purpose and public schema summary. Do
not execute it

The reviewed September 11, 2026 catalog exposed a Typeform form-list contract with these optional inputs:

• page, starting at 1;

• page_size, from 1 to 200;

• search;

• sort_by, using creation or last-update time;

• order_by, ascending or descending; and

• workspace_id.

The same catalog also exposed response reads, webhook reads and writes, form changes, uploads, and deletions. Their presence does not grant permission to use them.

5. Inspect the Exact Contract

Have Copilot inspect the discovered Action before preflight. Confirm:

1. It lists forms, not submissions.

2. No default expands into response data, file uploads, fields, or webhook deliveries.

3. The connected Typeform account is the intended one.

4. The page limit is explicit and small.

5. Operation type, risk metadata, and pricing are acceptable.

6. The output may contain private titles, IDs, URLs, workspace details, and timestamps.

In the reviewed Aident wrapper, this read-oriented Action carried a conservative write operation classification and risk level 2. Treat that metadata as a gate to inspect, not proof that listing forms changes Typeform. The provider consequence and the wrapper risk boundary answer different questions.

6. Preflight a Five-Form Check

Use this exact bounded input with the discovered Action:

{
  "page": 1,
  "page_size": 5,
  "sort_by": "last_updated_at",
  "order_by": "desc"
}

Ask Copilot to preflight it and show only input validity, the estimate, and any acknowledgement requirement. On September 11, 2026, this input passed Aident validation with an exact free quote.

That preflight did not execute Typeform. The reviewed Aident account had no connected Typeform account, so this article does not claim a live form-list result. A valid schema and a free quote do not prove provider access, correct account scope, or safe handling of returned metadata.

7. Run One Metadata-Only Proof

After Typeform is connected and the account boundary is approved, execute only the preflighted form-list request. Review the raw response locally, then retain only:

• the number of forms returned, from zero to five;

• whether another page exists;

• the selected page size; and

• confirmation that no response, file, webhook, or mutation Action ran.

Do not copy form titles, form IDs, workspace IDs, links, timestamps, or the raw provider payload into a reusable prompt, issue, repository, or analytics note. Even metadata can reveal customer names, research projects, hiring plans, incident intake, or internal operations.

Success means the count is plausible, pagination is understood, and the audit shows exactly one intended Typeform Action. Stop after that proof.

8. Start a Fresh Boundary Before Reading Responses

Typeform's Responses API can return submission times, answers, hidden fields, calculated values, response tokens, and file references. Its current documentation says very recent responses may take up to 30 minutes to appear, recommends webhooks for real-time delivery, and allows up to 1,000 responses per request.

Before any response read, define:

1. one reviewed form ID;

2. one explicit since and until window;

3. completed, partial, or started responses;

4. only the required field IDs;

5. the smallest useful page size;

6. how personal data and file uploads will be excluded or handled; and

7. the output that may be retained.

Do not use a 1,000-row ceiling merely because the schema permits it. Begin with the smallest sample that can answer the question.

Typeform's MCP Server or Aident Loadout?

Typeform also documents an official MCP server with tools for forms, automations, contacts, and response analytics. Use that direct route when Typeform is the whole job and its supported client, scopes, and tool model match your policy.

Aident Loadout is useful when Typeform is one reviewed step in a broader workflow and the team wants the same Vault, discovery, schema inspection, preflight, execution, and Audit pattern across services. This guide owns that Aident-specific route. It does not claim that one route is universally safer.

Whichever route you use, keep the first proof metadata-only, review the exact connected identity, and make response access or provider changes a separate decision.

Reusable Copilot Prompt

Use the configured Aident Loadout MCP server. Confirm the signed-in Aident
account and Typeform Vault status without executing a provider Action. Search
the current catalog for the Typeform Action that lists forms without reading
responses, then inspect its exact input, output, connected account, defaults,
operation type, risk, and pricing. If Typeform is disconnected, point me to
the Aident Apps connection flow and stop.

After I confirm the connection, preflight exactly page 1, page_size 5,
sort_by last_updated_at, and order_by desc. Show only input validity, estimate,
and acknowledgement requirements. Execute only after I approve that identical
input. Return only the number of forms returned, whether another page exists,
the selected page size, and confirmation that no response, file, webhook, or
mutation Action ran. Do not return or persist form titles, form IDs, workspace
IDs, URLs, timestamps, answers, hidden fields, response tokens, file uploads,
webhook details, contact data, or raw provider output. Stop after the proof

Connect Typeform to VS Code Copilot and run a five-form metadata check

For the general credential boundary, read Give AI Agents API Access Without Exposing Keys. Before any Typeform write, use AI Agent Approval Workflow: Separate Risk From Spend. For the broader discovery and execution loop, continue with How to Use Aident Loadout.

Sources

• VS Code: Add and manage MCP servers, reviewed September 11, 2026.

• VS Code MCP configuration reference, reviewed September 11, 2026.

• Typeform Developer Platform, reviewed September 11, 2026.

• Typeform MCP Server, reviewed September 11, 2026.

• Typeform OAuth scopes, reviewed September 11, 2026.

• Typeform Responses API, reviewed September 11, 2026.

• Aident Loadout setup, reviewed September 11, 2026.

• Live Aident Loadout staging Typeform catalog and exact free preflight, inspected September 11, 2026.

Refresh this guide when VS Code changes MCP configuration or trust behavior, Typeform changes OAuth scopes, MCP tools, form-list fields, or response limits, or Aident changes its Typeform connection, Action contract, risk metadata, pricing, or Audit behavior.