{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/typeform.json", "name": "Typeform", "score": 58.4, "shared": [ "forms.create", "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "slug": "typeform" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/surveymonkey.json", "name": "SurveyMonkey", "score": 55.3, "shared": [ "forms.create", "forms.surveys", "forms.responses", "forms.webhooks", "forms.embed" ], "slug": "surveymonkey" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/jotform.json", "name": "Jotform", "score": 52.9, "shared": [ "forms.create", "forms.responses", "forms.webhooks", "forms.surveys" ], "slug": "jotform" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/fillout.json", "name": "Fillout", "score": 52.2, "shared": [ "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "slug": "fillout" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/monday.json", "name": "monday.com", "score": 76.4, "shared": [ "forms.create" ], "slug": "monday" } ], "tool": { "slug": "tally", "name": "Tally", "vendor": "Tally BV", "vendorUrl": "https://tally.so", "kind": "http-api", "category": "forms", "summary": "Tally is a form and survey builder from Tally BV in Ghent, Belgium. Agents create forms, read submissions and manage webhooks through a REST API at api.tally.so, or through a hosted MCP server that is in beta.", "url": "https://www.anchorterminal.com/tools/tally", "markdownUrl": "https://www.anchorterminal.com/tools/tally.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/tally.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/tally.json", "license": "Proprietary service under Tally's terms and conditions. The OpenAPI spec names MIT as its own licence", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.tally.so", "packages": [], "auth": "mixed", "authNotes": "Self-serve. The REST API takes a Bearer API key that a signed-in user creates at tally.so/settings/api-keys. A key is tied to that user, carries all of the user's access, has no scopes and stops working when the user leaves the organisation. The MCP server takes the same key or OAuth 2 (authorisation code grant with PKCE S256, refresh tokens and dynamic client registration), where a person signs in to Tally and approves the client. The server metadata lists the scopes user, forms, responses, webhooks and mcp. No app review, partner approval or sales step was found.", "pricing": "freemium", "pricingNotes": "Free plan with unlimited forms and submissions under a fair use policy, and the API and the MCP server are free on every plan, so an agent's owner can start without a contract. Pro and Business are shown at $24 and $74 a month, with a monthly and yearly toggle and two months off for yearly billing. We could not establish which billing period the displayed figures belong to. Workspace and folder endpoints need Pro. There is no sandbox or test mode in the reviewed documentation (checked 2026-10-08).", "priceSummary": "$24 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI spec or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developers.tally.so", "llmsTxt": "https://developers.tally.so/llms.txt", "openapi": "https://developers.tally.so/api-reference/openapi.json", "capabilities": [ "forms.create", "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "tags": [ "official", "hosted", "mcp", "oauth", "api-key", "openapi", "llms-txt", "webhooks", "free-tier", "closed-source", "eu-hosted", "status-page" ], "lastRelease": "2026-09-11", "graded": true, "anchor": { "graded": true, "score": 60.6, "grade": "C", "agentReady": false, "rank": 348, "ranked": true, "rankOf": 629, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 66, "payments": 30, "reliability": 75, "schema": 82, "security": 47, "transparency": 73 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Read with the hosted lines and scored on the REST API, which is the surface an agent would call. The MCP server is marked beta. status.tally.so on Better Stack lists three components (Tally Application, Tally API, Custom domains) with 90-day bars and an incident feed (20). All three show 100 per cent over 90 days, and the latest incident in the feed is the Cloudflare outage of 18 November 2025 (30). The limit is published as 100 requests a minute (15). 429 is listed as a response code, but no Retry-After header, backoff guidance or idempotency key was found. Webhook deliveries retry five times on a published schedule and can be retried through the API, which earns part of the line (3 of 15). No SLA was found, and the terms promise reasonable efforts (0). The REST API carries no beta label, though its changelog numbers are still below 1.0 at v0.10.0 (7 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "A public OpenAPI 3.0.1 spec with 38 operations and 140 schemas. The MCP tool definitions sit behind sign-in, so the API carries this line (25). llms.txt, llms-full.txt and a Markdown copy of each docs page (10). Descriptions are one sentence each. Some state consequences, such as deleted forms moving to the trash or an endpoint needing Pro, and the fact that PATCH replaces the whole blocks array is in a help page, not the reference (12 of 20). 119 enums, required fields marked, bounds on `limit`, and a typed payload per block type that the API has validated since 5 February 2026. `page` has no bounds (13 of 15). Eight worked guides with curl requests. Error responses are a status code and a short description with no body schema, and 429 is absent from the per-operation responses (7 of 15). Date-based versions through the `tally-version` header and a dated changelog with ten entries (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 50, "points": 8.13, "reason": "Lists take `limit` from 1 to 500, and submissions filter by status and date. There is no field selection, and each submissions page repeats the form's questions. The MCP server's tool count could not be read (15 of 25). `page`, `limit` and `hasMore`, plus `startDate`, `endDate`, `afterId` and `workspaceIds` filters (18 of 20). Standard HTTP codes in one table, with no documented error body or per-field messages (8 of 20). No idempotency keys, and the MCP annotations could not be read. Deleted forms and workspaces go to a trash and can be restored (4 of 20). Creating a form needs a `status` and a blocks array in which the caller generates every UUID, PATCH replaces the whole array, and no official SDK was found (5 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 47, "points": 8.23, "reason": "REST API keys are tied to one user, carry all of that user's access and have no scopes. The MCP server also takes OAuth 2 with PKCE S256, refresh tokens and dynamic client registration, and the server metadata lists five scopes. Credentials travel only in the `Authorization` header (24 of 30). No read-only key exists. The vendor says the MCP server can't delete forms or submissions and that new forms stay drafts until the user asks to publish (12 of 20). Submissions are text written by respondents, and no prompt-injection guidance was found. The help page says submissions are fetched only on request (3 of 15). A delivery log for webhook events, and no audit log of API calls found (3 of 15). No security.txt (404), disclosure policy, bug bounty, SOC 2 or ISO 27001 claim found. The DPA commits to an independent audit every two years, and Tally says data is encrypted in transit and at rest (5 of 20). Submission responses include `previewUrl` and `pdfUrl`, signed links with an access token and no expiry." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, with a free plan and Pro and Business shown at $24 and $74 a month. The API has no per-call price because it is free on every plan (10). The free plan has unlimited forms and submissions under a fair use policy, and no card requirement was found (20). A person signs up in a browser behind a Cloudflare Turnstile check and creates the API key in settings, or approves the OAuth client (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 66, "points": 5.78, "reason": "The product changelog's latest entry is 11 September 2026, covering the Claude connector and ChatGPT plugin built on the MCP server. The API changelog's latest entry is v0.10.0 on 4 August 2026 (30). Four dated product changelog entries since 10 July 2026 (14 July, 4 August, 27 August, 11 September), one of them an API release (20). Closed service with two public changelogs, a roadmap, a feature request board and a support form. Tally says support answers within four hours, which we didn't test (11 of 15). Not in the official MCP registry, and no official SDK found (0). No packages to assess. The OpenAPI spec includes the folder endpoints added on 23 June 2026, so the docs keep pace with the API (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "note": "editorial 67, provenance 79", "reason": "The service is closed under terms and conditions at version 2.0 of 9 September 2024, governed by Belgian law. The OpenAPI spec names MIT as its licence (15). The privacy notice gives retention periods (90 days, two years and seven years after account deletion by data category), the GDPR page says deleted form data leaves backups within 90 days and that form data is stored in Europe, and a DPA applies to professional users without signature. These agree with each other. No retention period for API or webhook logs was found (26 of 30). API versions are dated and a key stays on its version, and the docs say users will be informed of unavoidable breaking changes. There is no stated notice period, and two changes in 2026 are marked breaking in the changelog (8 of 20). A sub-processor list of 16 entries gives each one's country and whether it may process form submissions, and the DPA promises notice of new substantial sub-processors (18 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Lists take `limit` from 1 to 500, and submissions filter by status and date. There is no field selection, and each submissions page repeats the form's questions. The MCP server's tool count could not be read (15 of 25). `page`, `limit` and `hasMore`, plus `startDate`, `endDate`, `afterId` and `workspaceIds` filters (18 of 20). Standard HTTP codes in one table, with no documented error body or per-field messages (8 of 20). No idempotency keys, and the MCP annotations could not be read. Deleted forms and workspaces go to a trash and can be restored (4 of 20). Creating a form needs a `status` and a blocks array in which the caller generates every UUID, PATCH replaces the whole array, and no official SDK was found (5 of 15).", "maintenance": "The product changelog's latest entry is 11 September 2026, covering the Claude connector and ChatGPT plugin built on the MCP server. The API changelog's latest entry is v0.10.0 on 4 August 2026 (30). Four dated product changelog entries since 10 July 2026 (14 July, 4 August, 27 August, 11 September), one of them an API release (20). Closed service with two public changelogs, a roadmap, a feature request board and a support form. Tally says support answers within four hours, which we didn't test (11 of 15). Not in the official MCP registry, and no official SDK found (0). No packages to assess. The OpenAPI spec includes the folder endpoints added on 23 June 2026, so the docs keep pace with the API (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, with a free plan and Pro and Business shown at $24 and $74 a month. The API has no per-call price because it is free on every plan (10). The free plan has unlimited forms and submissions under a fair use policy, and no card requirement was found (20). A person signs up in a browser behind a Cloudflare Turnstile check and creates the API key in settings, or approves the OAuth client (0).", "reliability": "Read with the hosted lines and scored on the REST API, which is the surface an agent would call. The MCP server is marked beta. status.tally.so on Better Stack lists three components (Tally Application, Tally API, Custom domains) with 90-day bars and an incident feed (20). All three show 100 per cent over 90 days, and the latest incident in the feed is the Cloudflare outage of 18 November 2025 (30). The limit is published as 100 requests a minute (15). 429 is listed as a response code, but no Retry-After header, backoff guidance or idempotency key was found. Webhook deliveries retry five times on a published schedule and can be retried through the API, which earns part of the line (3 of 15). No SLA was found, and the terms promise reasonable efforts (0). The REST API carries no beta label, though its changelog numbers are still below 1.0 at v0.10.0 (7 of 10).", "schema": "A public OpenAPI 3.0.1 spec with 38 operations and 140 schemas. The MCP tool definitions sit behind sign-in, so the API carries this line (25). llms.txt, llms-full.txt and a Markdown copy of each docs page (10). Descriptions are one sentence each. Some state consequences, such as deleted forms moving to the trash or an endpoint needing Pro, and the fact that PATCH replaces the whole blocks array is in a help page, not the reference (12 of 20). 119 enums, required fields marked, bounds on `limit`, and a typed payload per block type that the API has validated since 5 February 2026. `page` has no bounds (13 of 15). Eight worked guides with curl requests. Error responses are a status code and a short description with no body schema, and 429 is absent from the per-operation responses (7 of 15). Date-based versions through the `tally-version` header and a dated changelog with ten entries (15).", "security": "REST API keys are tied to one user, carry all of that user's access and have no scopes. The MCP server also takes OAuth 2 with PKCE S256, refresh tokens and dynamic client registration, and the server metadata lists five scopes. Credentials travel only in the `Authorization` header (24 of 30). No read-only key exists. The vendor says the MCP server can't delete forms or submissions and that new forms stay drafts until the user asks to publish (12 of 20). Submissions are text written by respondents, and no prompt-injection guidance was found. The help page says submissions are fetched only on request (3 of 15). A delivery log for webhook events, and no audit log of API calls found (3 of 15). No security.txt (404), disclosure policy, bug bounty, SOC 2 or ISO 27001 claim found. The DPA commits to an independent audit every two years, and Tally says data is encrypted in transit and at rest (5 of 20). Submission responses include `previewUrl` and `pdfUrl`, signed links with an access token and no expiry.", "transparency": "The service is closed under terms and conditions at version 2.0 of 9 September 2024, governed by Belgian law. The OpenAPI spec names MIT as its licence (15). The privacy notice gives retention periods (90 days, two years and seven years after account deletion by data category), the GDPR page says deleted form data leaves backups within 90 days and that form data is stored in Europe, and a DPA applies to professional users without signature. These agree with each other. No retention period for API or webhook logs was found (26 of 30). API versions are dated and a key stays on its version, and the docs say users will be informed of unavoidable breaking changes. There is no stated notice period, and two changes in 2026 are marked breaking in the changelog (8 of 20). A sub-processor list of 16 entries gives each one's country and whether it may process form submissions, and the DPA promises notice of new substantial sub-processors (18 of 20)." }, "sources": [ { "what": "developer docs index (llms.txt)", "url": "https://developers.tally.so/llms.txt", "seen": "2026-10-08" }, { "what": "API introduction, response codes and rate limit", "url": "https://developers.tally.so/api-reference/introduction", "seen": "2026-10-08" }, { "what": "API keys", "url": "https://developers.tally.so/api-reference/api-keys", "seen": "2026-10-08" }, { "what": "versioning", "url": "https://developers.tally.so/api-reference/versioning", "seen": "2026-10-08" }, { "what": "API changelog", "url": "https://developers.tally.so/api-reference/changelog", "seen": "2026-10-08" }, { "what": "MCP server docs", "url": "https://developers.tally.so/api-reference/mcp", "seen": "2026-10-08" }, { "what": "OpenAPI spec", "url": "https://developers.tally.so/api-reference/openapi.json", "seen": "2026-10-08" }, { "what": "listing submissions reference", "url": "https://developers.tally.so/api-reference/endpoint/forms/submissions/list", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://api.tally.so/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "OAuth protected resource metadata for MCP", "url": "https://api.tally.so/.well-known/oauth-protected-resource/mcp", "seen": "2026-10-08" }, { "what": "MCP endpoint (401 without credentials)", "url": "https://api.tally.so/mcp", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://tally.so/pricing", "seen": "2026-10-08" }, { "what": "fair use policy", "url": "https://tally.so/help/fair-use-policy", "seen": "2026-10-08" }, { "what": "API help page", "url": "https://tally.so/help/api", "seen": "2026-10-08" }, { "what": "MCP help page", "url": "https://tally.so/help/mcp", "seen": "2026-10-08" }, { "what": "Claude connector help page", "url": "https://tally.so/help/claude-connector", "seen": "2026-10-08" }, { "what": "webhooks help page", "url": "https://tally.so/help/webhooks", "seen": "2026-10-08" }, { "what": "product changelog", "url": "https://tally.so/changelog", "seen": "2026-10-08" }, { "what": "AI info page", "url": "https://tally.so/ai-info", "seen": "2026-10-08" }, { "what": "status page", "url": "https://status.tally.so", "seen": "2026-10-08" }, { "what": "status incident feed", "url": "https://status.tally.so/feed.rss", "seen": "2026-10-08" }, { "what": "terms and conditions, version 2.0", "url": "https://tally.so/help/terms-conditions", "seen": "2026-10-08" }, { "what": "privacy notice", "url": "https://tally.so/help/privacy-policy", "seen": "2026-10-08" }, { "what": "data processing agreement", "url": "https://tally.so/help/data-processing-agreement", "seen": "2026-10-08" }, { "what": "GDPR page and sub-processors", "url": "https://tally.so/help/gdpr", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://tally.so/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=tally\u0026limit=50", "seen": "2026-10-08" }, { "what": "domain registration (RDAP)", "url": "https://rdap.nic.so/domain/tally.so", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the MCP server's tool list, input schemas and readOnlyHint or destructiveHint annotations, which need a signed-in Tally account.", "unchecked: whether $24 and $74 on the pricing page are the monthly or the yearly-billed figures. The toggle needs JavaScript.", "unchecked: whether signup asks for a card. The pricing page describes the plan as free and we did not create an account.", "unchecked: whether API keys can be revoked one by one and whether the dashboard shows their last use. The docs say only that a lost key can be replaced.", "unchecked: NVD and other advisory databases for Tally.", "The changelog marks two 2026 changes as breaking (5 February and 4 August). We could not establish whether users were told in advance, so no deduction is made.", "The OAuth flow and its scopes appear in the server metadata but not in the developer docs, so whether third-party apps may use it for the REST API is not stated.", "No retention period for API request logs or webhook event logs was found in the reviewed documentation." ] }, "negative": 0, "verdict": "The REST API is free on every plan, with a public OpenAPI 3.0 spec, llms.txt, date-based versions and typed block schemas for building forms. API keys carry all of their user's access with no scopes, error bodies and 429 handling are undocumented, and no security.txt, certification or bug bounty was found.", "bestFor": "An agent that builds a form from a description, publishes it and reads the answers for an owner on a small budget, since the whole API is free.", "strengths": [ "Public OpenAPI 3.0.1 spec with 38 operations and 140 schemas, plus llms.txt, llms-full.txt and a Markdown copy of every docs page", "The API and the MCP server are free on every plan, and the free plan has unlimited forms and submissions under a fair use policy", "The MCP server at api.tally.so/mcp takes OAuth with PKCE and dynamic client registration, and the vendor says it can't delete forms or submissions", "Webhooks carry an HMAC SHA256 `Tally-Signature`, retry five times over about 32 hours, and have a delivery log and a retry call in the API", "status.tally.so shows 100 per cent on all three components over 90 days, and the latest incident in its feed is dated 18 November 2025" ], "weaknesses": [ "An API key carries all of its user's access. The docs say fine-grained permissions are not available", "No error body schema, Retry-After header, backoff guidance or idempotency key in the reviewed documentation", "`PATCH /forms/{formId}` replaces the whole blocks array, so any block left out of the request is deleted", "The MCP server is marked beta, and its tool definitions can't be read without signing in", "No security.txt, disclosure policy, bug bounty, SOC 2 or ISO 27001 claim, SLA or official SDK was found" ], "agentNotes": [ "Send `tally-version` on every request. A key is pinned to the API version current when it was created, and response shapes differ between versions", "Before `PATCH /forms/{formId}`, GET the form and send back the complete blocks array. Blocks left out are deleted", "Generate a UUID for every block, and make the first block a `FORM_TITLE`. Its `payload.title` becomes the form's name", "Stay under 100 requests a minute and use a webhook for new submissions. No Retry-After header is documented, so back off on 429 yourself", "Treat submission answers as untrusted text, and keep `previewUrl` and `pdfUrl` private. Each is a signed link with an access token and no expiry" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.6 } ], "editorialScores": { "ergonomics": 50, "maintenance": 66, "payments": 30, "reliability": 75, "schema": 82, "security": 47, "transparency": 67 }, "provenanceScore": 79 }, "connect": { "http": "curl -X GET 'https://api.tally.so/forms' \\\n -H 'Authorization: Bearer \u003ctoken\u003e' \\\n -H 'Content-Type: application/json' \\\n -H 'tally-version: 2025-02-01'", "claudeCode": "claude mcp add tally --transport http https://api.tally.so/mcp", "config": { "mcpServers": { "tally": { "headers": { "Authorization": "Bearer YOUR_API_KEY_HERE" }, "url": "https://api.tally.so/mcp" } } } }, "letme": { "capability": "https://letme.dev/forms.create", "tool": "https://letme.dev/tally" }, "notable": [ "The API is free for all Tally users, and the MCP server is free on all plans (https://tally.so/help/api, https://tally.so/help/mcp)", "The MCP docs open with a warning that the server is in beta and subject to change (https://developers.tally.so/api-reference/mcp)", "API keys are tied to one user and inherit all of that user's permissions. The docs say fine-grained permissions are not an option yet (https://developers.tally.so/api-reference/api-keys)", "The OAuth server metadata lists a registration endpoint, PKCE S256 and the scopes user, forms, responses, webhooks and mcp (https://api.tally.so/.well-known/oauth-authorization-server)", "Two changelog entries in 2026 are marked breaking. Block payload validation on 5 February and rejection of `DELETED` as a form status on 4 August (https://developers.tally.so/api-reference/changelog)", "The product changelog of 11 September 2026 says Tally is a verified connector in Claude and an official plugin in ChatGPT (https://tally.so/changelog)" ], "area": "business", "details": [ { "label": "API", "value": "REST at https://api.tally.so, 38 operations in a public OpenAPI 3.0.1 spec (forms, blocks, questions, submissions, analytics, webhooks, workspaces, folders, organisation users and invites). Changelog numbers run to v0.10.0 (4 August 2026)" }, { "label": "MCP server", "value": "Hosted at https://api.tally.so/mcp, marked beta. Creates and edits forms, lists forms and fetches submissions. OAuth or an API key. The vendor's help page says it can't delete forms or submissions, and new forms stay drafts until published" }, { "label": "Credentials", "value": "API keys (`tly-` prefix) created at tally.so/settings/api-keys, tied to one user with all of that user's access and no scopes. OAuth 2 authorisation code grant with PKCE S256, refresh tokens and dynamic client registration, with scopes user, forms, responses, webhooks and mcp in the server metadata" }, { "label": "Rate limits", "value": "100 requests a minute. 429 on excess, with no Retry-After header documented" }, { "label": "Versioning", "value": "Date versions (2025-01-15, 2025-02-01) chosen with the `tally-version` header. A key defaults to the version current when it was created" }, { "label": "Pagination", "value": "`page` and `limit` (1 to 500, default 50 on submissions) with `hasMore`. Submissions filter by status, `startDate`, `endDate` and `afterId`" }, { "label": "Webhooks", "value": "One event type, FORM_RESPONSE. Optional signing secret (HMAC SHA256 in `Tally-Signature`), custom headers, a 10 second timeout, retries after 5 minutes, 30 minutes, 1 hour, 6 hours and 1 day, a delivery log and a retry endpoint" }, { "label": "Form blocks", "value": "40 block types in the spec, among them text, number, email, phone, date, file upload, rating, linear scale, matrix, ranking, payment, signature, hidden fields, conditional logic and calculated fields. Payloads are validated against the schema since v0.4.0 (5 February 2026)" }, { "label": "Plans", "value": "Free with unlimited forms and submissions under a fair use policy (examples of heavy use are 50,000 submissions a month and 100 GB of uploads a month). Pro and Business are shown at $24 and $74 a month. Workspace and folder endpoints need Pro" }, { "label": "Data", "value": "Tally says form data is stored in Europe on Google Cloud and encrypted in transit and at rest. Deleted form data leaves backups within 90 days. Business plans can set automatic deletion of submissions" }, { "label": "Sub-processors", "value": "16 entries with country and whether each may process form submissions. Google Cloud (Belgium) always, Cloudflare storage, SendGrid and Stripe only when file uploads, email notifications or payments are used" }, { "label": "Status", "value": "status.tally.so on Better Stack with three components (Tally Application, Tally API, Custom domains), 90-day bars and an incident feed" } ], "unitPrices": [ { "item": "Pro", "unit": "month", "usd": 24, "note": "as displayed on the pricing page, billing period not established. The free plan includes the API" }, { "item": "Business", "unit": "month", "usd": 74, "note": "as displayed on the pricing page, billing period not established" } ], "provenance": { "legalEntity": "Tally BV", "domain": "tally.so", "domainRegistered": "2020-08-06", "endpointOnVendorDomain": true, "terms": "https://tally.so/help/terms-conditions", "privacy": "https://tally.so/help/privacy-policy", "statusPage": "https://status.tally.so", "changelog": "https://developers.tally.so/api-reference/changelog", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms (version 2.0, 9 September 2024) name Tally BV, Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium, enterprise number 0776.979.007, under Belgian law with the courts of Ghent.", "The API and the MCP server answer at api.tally.so, and the developer docs at developers.tally.so.", "tally.so/.well-known/security.txt and tally.so/security.txt both return 404.", "RDAP at rdap.nic.so gives a registration date of 2020-08-06 for tally.so and NameCheap as registrar.", "A second changelog for the product as a whole is at tally.so/changelog." ], "score": 79, "checks": [ { "check": "Legal entity named", "value": "Tally BV", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "tally.so, registered 2020-08-06 (6 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "api.tally.so", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 3 of the 7 things a reader expects, and has 1 clause that costs points", "points": 4.6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.tally.so", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://tally.so/help/terms-conditions", "state": "read", "readAt": "2026-10-08", "words": 5646, "points": 4.6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Governing Law and Jurisdiction – These General Terms and Conditions and any applicable Special Terms and Conditions are governed by and must be construed and interpreted in accordance with the laws of Belgium.", "says": "The law of Belgium" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Subject to the maximum extent permitted by applicable law, our liability, whether in contract, tort, or otherwise, shall not exceed the total amount of License Fees paid by the User to Tally under this Agreement for the three (3) months immediately preceding the event giving rise to the claim.", "says": "Capped at the fees paid in the 3 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "The User acknowledges and agrees that the failure to make timely payments or Tally’s impossibility to collect the License Fee may result in the suspension or termination of the User’s access to the Tool, at the sole discretion of Tally." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": false }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Employ any automatic, electronic, or manual high-volume process to access, search, or collect information about our Tool (including, but not limited to, robots, spiders, or scripts);", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Furthermore, we reserve the right to immediately restrict, terminate, or suspend your use of the Tool at our sole discretion, without prior notice or liability, due to a serious breach of these General Terms and Conditions and/or any applicable Special Terms and Conditions" } ], "notes": [ { "date": "2026-10-08", "text": "Tally's liability is capped at the licence fees the user paid in the three months before the event giving rise to the claim.", "quote": "Subject to the maximum extent permitted by applicable law, our liability, whether in contract, tort, or otherwise, shall not exceed the total amount of License Fees paid by the User to Tally under this Agreement for the three (3) months immediately preceding the event giving rise to the claim." }, { "date": "2026-10-08", "text": "The user, or a third party acting for the user, may not integrate the Tool into or with other software unless Tally permits it in writing.", "quote": "Modify, adapt, or create derivative works from any part of our Tool or integrate our Tool into or with other software, except to the extent expressly permitted by us in writing." }, { "date": "2026-10-08", "text": "Tally may adjust the licence fee after at least 30 days' written notice.", "quote": "Any proposed changes to the License Fee shall be communicated to the User in writing, with at least thirty (30) days' notice before the implementation of such adjustments." } ] }, { "kind": "privacy", "url": "https://tally.so/help/privacy-policy", "state": "read", "readAt": "2026-10-08", "words": 2724, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We collect your information in order to provide you access to our tool in an optimal way, in accordance with our Terms and Conditions, through a personalized user profile." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Your Personal Data contained in Category 1 will be retained for 90 days after the deletion of your user profile (which indicates the end of our contractual relationship).", "says": "Names a period of 90 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Furthermore, we use some suppliers and service providers, such as but not limited to computer security, digital solutions and web hosting services." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Tally will not sell or hire out your Personal Data to third parties, except in the situations described in this Privacy Notice or unless you explicitly provide your prior consent.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Article 4 – The duration of the processing Article 5 – Your rights 5.1 Right of access and right to obtain a copy5.2 Right to rectification, erasure or restriction5.3 Right to object5.4 Right to data portability5.5 Right to withdraw consent5.6 Automated decisions and profiling5.7 Exercising your rights5.8." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Join the communityReferral programAPI docsMCP serverFair use policyGDPRTerms \u0026 Privacy" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/tally.json", "live": { "slug": "tally", "probe": { "target": "https://api.tally.so", "method": "get", "lastAt": "2026-10-08T18:20:41.500168063Z", "lastOk": true, "lastStatus": 200, "lastMs": 63, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 77, "p95ms24h": 155, "samples24h": 33, "samples30d": 33, "days": [ { "date": "2026-10-08", "probes": 33, "ok": 33 } ] }, "vendorStatus": { "page": "https://status.tally.so", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T17:51:14.870619556Z" }, "securityTxt": { "url": "https://tally.so/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:55.978667631Z" }, "pages": [ { "url": "https://developers.tally.so/api-reference/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:18:03.02632096Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "cc08fa442aff" }, { "url": "https://tally.so/help/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:25:05.667847097Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1d8b6671d903" }, { "url": "https://tally.so/help/terms-conditions", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:25:07.91997507Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f67a529c212c" } ], "updatedAt": "2026-10-08T18:25:07.91997507Z" } }, "verify": { "accepts": "a page on tally.so or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/tally.svg", "body": { "slug": "tally", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/tally", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/tally\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/tally.svg\" alt=\"Tally on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Tally on Anchor Terminal](https://www.anchorterminal.com/badges/tally.svg)](https://www.anchorterminal.com/tools/tally)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/tally\"\u003eTally on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/tally", "json": "https://www.anchorterminal.com/tools/tally.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/tally.md", "slim": "https://www.anchorterminal.com/tools/tally.min.md" }, "markdown": "## Overview\n\n**Grade C · 60.6/100 · rank #348 of 629 · #1 in Forms, surveys \u0026 structured intake · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API is free on every plan, with a public OpenAPI 3.0 spec, llms.txt, date-based versions and typed block schemas for building forms. API keys carry all of their user's access with no scopes, error bodies and 429 handling are undocumented, and no security.txt, certification or bug bounty was found.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Tally BV (https://tally.so) |\n| Kind | HTTP API |\n| Category | Forms, surveys \u0026 structured intake (https://www.anchorterminal.com/categories/forms) |\n| Transport | HTTP, Streamable HTTP |\n| Endpoint | `https://api.tally.so` |\n| Auth | OAuth or key · Self-serve. The REST API takes a Bearer API key that a signed-in user creates at tally.so/settings/api-keys. A key is tied to that user, carries all of the user's access, has no scopes and stops working when the user leaves the organisation. The MCP server takes the same key or OAuth 2 (authorisation code grant with PKCE S256, refresh tokens and dynamic client registration), where a person signs in to Tally and approves the client. The server metadata lists the scopes user, forms, responses, webhooks and mcp. No app review, partner approval or sales step was found. |\n| Pricing | Freemium ($24 / mo) · Free plan with unlimited forms and submissions under a fair use policy, and the API and the MCP server are free on every plan, so an agent's owner can start without a contract. Pro and Business are shown at $24 and $74 a month, with a monthly and yearly toggle and two months off for yearly billing. We could not establish which billing period the displayed figures belong to. Workspace and folder endpoints need Pro. There is no sandbox or test mode in the reviewed documentation (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the developer docs, the OpenAPI spec or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under Tally's terms and conditions. The OpenAPI spec names MIT as its own licence |\n| Docs | https://developers.tally.so |\n| llms.txt | https://developers.tally.so/llms.txt |\n| Last release | 2026-09-11 |\n| API | REST at https://api.tally.so, 38 operations in a public OpenAPI 3.0.1 spec (forms, blocks, questions, submissions, analytics, webhooks, workspaces, folders, organisation users and invites). Changelog numbers run to v0.10.0 (4 August 2026) |\n| MCP server | Hosted at https://api.tally.so/mcp, marked beta. Creates and edits forms, lists forms and fetches submissions. OAuth or an API key. The vendor's help page says it can't delete forms or submissions, and new forms stay drafts until published |\n| Credentials | API keys (`tly-` prefix) created at tally.so/settings/api-keys, tied to one user with all of that user's access and no scopes. OAuth 2 authorisation code grant with PKCE S256, refresh tokens and dynamic client registration, with scopes user, forms, responses, webhooks and mcp in the server metadata |\n| Rate limits | 100 requests a minute. 429 on excess, with no Retry-After header documented |\n| Versioning | Date versions (2025-01-15, 2025-02-01) chosen with the `tally-version` header. A key defaults to the version current when it was created |\n| Pagination | `page` and `limit` (1 to 500, default 50 on submissions) with `hasMore`. Submissions filter by status, `startDate`, `endDate` and `afterId` |\n| Webhooks | One event type, FORM_RESPONSE. Optional signing secret (HMAC SHA256 in `Tally-Signature`), custom headers, a 10 second timeout, retries after 5 minutes, 30 minutes, 1 hour, 6 hours and 1 day, a delivery log and a retry endpoint |\n| Form blocks | 40 block types in the spec, among them text, number, email, phone, date, file upload, rating, linear scale, matrix, ranking, payment, signature, hidden fields, conditional logic and calculated fields. Payloads are validated against the schema since v0.4.0 (5 February 2026) |\n| Plans | Free with unlimited forms and submissions under a fair use policy (examples of heavy use are 50,000 submissions a month and 100 GB of uploads a month). Pro and Business are shown at $24 and $74 a month. Workspace and folder endpoints need Pro |\n| Data | Tally says form data is stored in Europe on Google Cloud and encrypted in transit and at rest. Deleted form data leaves backups within 90 days. Business plans can set automatic deletion of submissions |\n| Sub-processors | 16 entries with country and whether each may process form submissions. Google Cloud (Belgium) always, Cloudflare storage, SendGrid and Stripe only when file uploads, email notifications or payments are used |\n| Status | status.tally.so on Better Stack with three components (Tally Application, Tally API, Custom domains), 90-day bars and an incident feed |\n| Capabilities | forms.create, forms.responses, forms.webhooks, forms.surveys, forms.embed |\n| Tags | official, hosted, mcp, oauth, api-key, openapi, llms-txt, webhooks, free-tier, closed-source, eu-hosted, status-page |\n| JSON | https://www.anchorterminal.com/api/v1/tools/tally.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 75 | 15.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 82 | 13.3 |\n| Agent ergonomics | 13% | 16.2 | 50 | 8.1 |\n| Security \u0026 auth | 14% | 17.5 | 47 | 8.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 30 | 3.8 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 66 | 5.8 |\n| Transparency \u0026 trust (editorial 67, provenance 79) | 7% | 8.8 | 73 | 6.4 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **60.6 → C** |\n\n### Why each score\n\n- Reliability 75: Read with the hosted lines and scored on the REST API, which is the surface an agent would call. The MCP server is marked beta. status.tally.so on Better Stack lists three components (Tally Application, Tally API, Custom domains) with 90-day bars and an incident feed (20). All three show 100 per cent over 90 days, and the latest incident in the feed is the Cloudflare outage of 18 November 2025 (30). The limit is published as 100 requests a minute (15). 429 is listed as a response code, but no Retry-After header, backoff guidance or idempotency key was found. Webhook deliveries retry five times on a published schedule and can be retried through the API, which earns part of the line (3 of 15). No SLA was found, and the terms promise reasonable efforts (0). The REST API carries no beta label, though its changelog numbers are still below 1.0 at v0.10.0 (7 of 10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 82: A public OpenAPI 3.0.1 spec with 38 operations and 140 schemas. The MCP tool definitions sit behind sign-in, so the API carries this line (25). llms.txt, llms-full.txt and a Markdown copy of each docs page (10). Descriptions are one sentence each. Some state consequences, such as deleted forms moving to the trash or an endpoint needing Pro, and the fact that PATCH replaces the whole blocks array is in a help page, not the reference (12 of 20). 119 enums, required fields marked, bounds on `limit`, and a typed payload per block type that the API has validated since 5 February 2026. `page` has no bounds (13 of 15). Eight worked guides with curl requests. Error responses are a status code and a short description with no body schema, and 429 is absent from the per-operation responses (7 of 15). Date-based versions through the `tally-version` header and a dated changelog with ten entries (15).\n- Agent ergonomics 50: Lists take `limit` from 1 to 500, and submissions filter by status and date. There is no field selection, and each submissions page repeats the form's questions. The MCP server's tool count could not be read (15 of 25). `page`, `limit` and `hasMore`, plus `startDate`, `endDate`, `afterId` and `workspaceIds` filters (18 of 20). Standard HTTP codes in one table, with no documented error body or per-field messages (8 of 20). No idempotency keys, and the MCP annotations could not be read. Deleted forms and workspaces go to a trash and can be restored (4 of 20). Creating a form needs a `status` and a blocks array in which the caller generates every UUID, PATCH replaces the whole array, and no official SDK was found (5 of 15).\n- Security \u0026 auth 47: REST API keys are tied to one user, carry all of that user's access and have no scopes. The MCP server also takes OAuth 2 with PKCE S256, refresh tokens and dynamic client registration, and the server metadata lists five scopes. Credentials travel only in the `Authorization` header (24 of 30). No read-only key exists. The vendor says the MCP server can't delete forms or submissions and that new forms stay drafts until the user asks to publish (12 of 20). Submissions are text written by respondents, and no prompt-injection guidance was found. The help page says submissions are fetched only on request (3 of 15). A delivery log for webhook events, and no audit log of API calls found (3 of 15). No security.txt (404), disclosure policy, bug bounty, SOC 2 or ISO 27001 claim found. The DPA commits to an independent audit every two years, and Tally says data is encrypted in transit and at rest (5 of 20). Submission responses include `previewUrl` and `pdfUrl`, signed links with an access token and no expiry.\n- Payments \u0026 pricing 30: Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, with a free plan and Pro and Business shown at $24 and $74 a month. The API has no per-call price because it is free on every plan (10). The free plan has unlimited forms and submissions under a fair use policy, and no card requirement was found (20). A person signs up in a browser behind a Cloudflare Turnstile check and creates the API key in settings, or approves the OAuth client (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 66: The product changelog's latest entry is 11 September 2026, covering the Claude connector and ChatGPT plugin built on the MCP server. The API changelog's latest entry is v0.10.0 on 4 August 2026 (30). Four dated product changelog entries since 10 July 2026 (14 July, 4 August, 27 August, 11 September), one of them an API release (20). Closed service with two public changelogs, a roadmap, a feature request board and a support form. Tally says support answers within four hours, which we didn't test (11 of 15). Not in the official MCP registry, and no official SDK found (0). No packages to assess. The OpenAPI spec includes the folder endpoints added on 23 June 2026, so the docs keep pace with the API (5 of 10).\n- Transparency \u0026 trust 73: The service is closed under terms and conditions at version 2.0 of 9 September 2024, governed by Belgian law. The OpenAPI spec names MIT as its licence (15). The privacy notice gives retention periods (90 days, two years and seven years after account deletion by data category), the GDPR page says deleted form data leaves backups within 90 days and that form data is stored in Europe, and a DPA applies to professional users without signature. These agree with each other. No retention period for API or webhook logs was found (26 of 30). API versions are dated and a key stays on its version, and the docs say users will be informed of unavoidable breaking changes. There is no stated notice period, and two changes in 2026 are marked breaking in the changelog (8 of 20). A sub-processor list of 16 entries gives each one's country and whether it may process form submissions, and the DPA promises notice of new substantial sub-processors (18 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/tally.md (JSON https://www.anchorterminal.com/fixes/tally.json)\n\n### What we couldn't check\n\n- unchecked: the MCP server's tool list, input schemas and readOnlyHint or destructiveHint annotations, which need a signed-in Tally account.\n- unchecked: whether $24 and $74 on the pricing page are the monthly or the yearly-billed figures. The toggle needs JavaScript.\n- unchecked: whether signup asks for a card. The pricing page describes the plan as free and we did not create an account.\n- unchecked: whether API keys can be revoked one by one and whether the dashboard shows their last use. The docs say only that a lost key can be replaced.\n- unchecked: NVD and other advisory databases for Tally.\n- The changelog marks two 2026 changes as breaking (5 February and 4 August). We could not establish whether users were told in advance, so no deduction is made.\n- The OAuth flow and its scopes appear in the server metadata but not in the developer docs, so whether third-party apps may use it for the REST API is not stated.\n- No retention period for API request logs or webhook event logs was found in the reviewed documentation.\n\n### Sources\n\n- developer docs index (llms.txt): \u003chttps://developers.tally.so/llms.txt\u003e (seen 2026-10-08)\n- API introduction, response codes and rate limit: \u003chttps://developers.tally.so/api-reference/introduction\u003e (seen 2026-10-08)\n- API keys: \u003chttps://developers.tally.so/api-reference/api-keys\u003e (seen 2026-10-08)\n- versioning: \u003chttps://developers.tally.so/api-reference/versioning\u003e (seen 2026-10-08)\n- API changelog: \u003chttps://developers.tally.so/api-reference/changelog\u003e (seen 2026-10-08)\n- MCP server docs: \u003chttps://developers.tally.so/api-reference/mcp\u003e (seen 2026-10-08)\n- OpenAPI spec: \u003chttps://developers.tally.so/api-reference/openapi.json\u003e (seen 2026-10-08)\n- listing submissions reference: \u003chttps://developers.tally.so/api-reference/endpoint/forms/submissions/list\u003e (seen 2026-10-08)\n- OAuth authorisation server metadata: \u003chttps://api.tally.so/.well-known/oauth-authorization-server\u003e (seen 2026-10-08)\n- OAuth protected resource metadata for MCP: \u003chttps://api.tally.so/.well-known/oauth-protected-resource/mcp\u003e (seen 2026-10-08)\n- MCP endpoint (401 without credentials): \u003chttps://api.tally.so/mcp\u003e (seen 2026-10-08)\n- pricing: \u003chttps://tally.so/pricing\u003e (seen 2026-10-08)\n- fair use policy: \u003chttps://tally.so/help/fair-use-policy\u003e (seen 2026-10-08)\n- API help page: \u003chttps://tally.so/help/api\u003e (seen 2026-10-08)\n- MCP help page: \u003chttps://tally.so/help/mcp\u003e (seen 2026-10-08)\n- Claude connector help page: \u003chttps://tally.so/help/claude-connector\u003e (seen 2026-10-08)\n- webhooks help page: \u003chttps://tally.so/help/webhooks\u003e (seen 2026-10-08)\n- product changelog: \u003chttps://tally.so/changelog\u003e (seen 2026-10-08)\n- AI info page: \u003chttps://tally.so/ai-info\u003e (seen 2026-10-08)\n- status page: \u003chttps://status.tally.so\u003e (seen 2026-10-08)\n- status incident feed: \u003chttps://status.tally.so/feed.rss\u003e (seen 2026-10-08)\n- terms and conditions, version 2.0: \u003chttps://tally.so/help/terms-conditions\u003e (seen 2026-10-08)\n- privacy notice: \u003chttps://tally.so/help/privacy-policy\u003e (seen 2026-10-08)\n- data processing agreement: \u003chttps://tally.so/help/data-processing-agreement\u003e (seen 2026-10-08)\n- GDPR page and sub-processors: \u003chttps://tally.so/help/gdpr\u003e (seen 2026-10-08)\n- security.txt (404): \u003chttps://tally.so/.well-known/security.txt\u003e (seen 2026-10-08)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=tally\u0026limit=50\u003e (seen 2026-10-08)\n- domain registration (RDAP): \u003chttps://rdap.nic.so/domain/tally.so\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 79/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Tally BV | 20/20 |\n| Domain age | tally.so, registered 2020-08-06 (6 years) | 11/15 |\n| Endpoint on the vendor's domain | api.tally.so | 15/15 |\n| Terms of service | read, states 3 of the 7 things a reader expects, and has 1 clause that costs points | 4.6/10 |\n| Privacy policy | read, states 6 of the 8 things a reader expects | 8.5/10 |\n| Status page | status.tally.so | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe terms (version 2.0, 9 September 2024) name Tally BV, Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium, enterprise number 0776.979.007, under Belgian law with the courts of Ghent.\n\nThe API and the MCP server answer at api.tally.so, and the developer docs at developers.tally.so.\n\ntally.so/.well-known/security.txt and tally.so/security.txt both return 404.\n\nRDAP at rdap.nic.so gives a registration date of 2020-08-06 for tally.so and NameCheap as registrar.\n\nA second changelog for the product as a whole is at tally.so/changelog.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://tally.so/help/terms-conditions), read 2026-10-08, gives no date, states 3 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Employ any automatic, electronic, or manual high-volume process to access, search, or collect information about our Tool (including, but not limited to, robots, spiders, or scripts);\"\n- To know. Says access can be ended without notice or for any reason. \"Furthermore, we reserve the right to immediately restrict, terminate, or suspend your use of the Tool at our sole discretion, without prior notice or liability, due to a serious breach of these General Terms and Conditions and/or any applicable Special Terms and Conditions\"\n- Not found in the text. Gives the date it was last updated.\n- Names the governing law or courts. The law of Belgium.\n- States a limit on its liability. Capped at the fees paid in the 3 months before the claim.\n- Not found in the text. Says how changes to the terms are announced.\n- Not found in the text. Lists what users may not do.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). Tally's liability is capped at the licence fees the user paid in the three months before the event giving rise to the claim. \"Subject to the maximum extent permitted by applicable law, our liability, whether in contract, tort, or otherwise, shall not exceed the total amount of License Fees paid by the User to Tally under this Agreement for the three (3) months immediately preceding the event giving rise to the claim.\"\n- Also in the text (2026-10-08). The user, or a third party acting for the user, may not integrate the Tool into or with other software unless Tally permits it in writing. \"Modify, adapt, or create derivative works from any part of our Tool or integrate our Tool into or with other software, except to the extent expressly permitted by us in writing.\"\n- Also in the text (2026-10-08). Tally may adjust the licence fee after at least 30 days' written notice. \"Any proposed changes to the License Fee shall be communicated to the User in writing, with at least thirty (30) days' notice before the implementation of such adjustments.\"\n\n**Privacy policy** (https://tally.so/help/privacy-policy), read 2026-10-08, gives no date, states 6 of the 8 things a reader expects.\n\n- Not found in the text. Gives the date it was last updated.\n- Says how long data is kept. Names a period of 90 days.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Not found in the text. Gives a privacy contact.\n\n## Live (updated 2026-10-08 18:25 UTC)\n\n- Right now: up, HTTP 200, 63 ms, checked 2026-10-08 18:20 UTC (get on `https://api.tally.so`)\n- Uptime 24h 100.0% (33 probes) · 30 days 100.0% (33 probes) · p50 77 ms · p95 155 ms\n- Vendor status page: unknown, no machine-readable status found\n- security.txt: none\n- Watching changelog \u003chttps://developers.tally.so/api-reference/changelog\u003e\n- Watching privacy \u003chttps://tally.so/help/privacy-policy\u003e\n- Watching terms \u003chttps://tally.so/help/terms-conditions\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/tally.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Pro | $24 | per month (plan) | as displayed on the pricing page, billing period not established. The free plan includes the API |\n| Business | $74 | per month (plan) | as displayed on the pricing page, billing period not established |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public OpenAPI 3.0.1 spec with 38 operations and 140 schemas, plus llms.txt, llms-full.txt and a Markdown copy of every docs page\n- The API and the MCP server are free on every plan, and the free plan has unlimited forms and submissions under a fair use policy\n- The MCP server at api.tally.so/mcp takes OAuth with PKCE and dynamic client registration, and the vendor says it can't delete forms or submissions\n- Webhooks carry an HMAC SHA256 `Tally-Signature`, retry five times over about 32 hours, and have a delivery log and a retry call in the API\n- status.tally.so shows 100 per cent on all three components over 90 days, and the latest incident in its feed is dated 18 November 2025\n\n## Weaknesses\n\n- An API key carries all of its user's access. The docs say fine-grained permissions are not available\n- No error body schema, Retry-After header, backoff guidance or idempotency key in the reviewed documentation\n- `PATCH /forms/{formId}` replaces the whole blocks array, so any block left out of the request is deleted\n- The MCP server is marked beta, and its tool definitions can't be read without signing in\n- No security.txt, disclosure policy, bug bounty, SOC 2 or ISO 27001 claim, SLA or official SDK was found\n\n## Before you call it (notes for agents)\n\n1. Send `tally-version` on every request. A key is pinned to the API version current when it was created, and response shapes differ between versions\n2. Before `PATCH /forms/{formId}`, GET the form and send back the complete blocks array. Blocks left out are deleted\n3. Generate a UUID for every block, and make the first block a `FORM_TITLE`. Its `payload.title` becomes the form's name\n4. Stay under 100 requests a minute and use a webhook for new submissions. No Retry-After header is documented, so back off on 429 yourself\n5. Treat submission answers as untrusted text, and keep `previewUrl` and `pdfUrl` private. Each is a signed link with an access token and no expiry\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X GET 'https://api.tally.so/forms' \\\n -H 'Authorization: Bearer \u003ctoken\u003e' \\\n -H 'Content-Type: application/json' \\\n -H 'tally-version: 2025-02-01'\n```\n\nClaude Code:\n\n```bash\nclaude mcp add tally --transport http https://api.tally.so/mcp\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"tally\": {\n \"headers\": {\n \"Authorization\": \"Bearer YOUR_API_KEY_HERE\"\n },\n \"url\": \"https://api.tally.so/mcp\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/tally (letme picks it for forms.embed, the top-graded tool for the job, letme picks it for forms.responses, the top-graded tool for the job, letme picks it for forms.surveys, the top-graded tool for the job, letme picks it for forms.webhooks, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Typeform | C | 58.4 | 401 | forms.create, forms.responses, forms.webhooks, forms.surveys, forms.embed | no | https://www.anchorterminal.com/tools/typeform.md |\n| SurveyMonkey | C | 55.3 | 455 | forms.create, forms.surveys, forms.responses, forms.webhooks, forms.embed | no | https://www.anchorterminal.com/tools/surveymonkey.md |\n| Jotform | D | 52.9 | 489 | forms.create, forms.responses, forms.webhooks, forms.surveys | no | https://www.anchorterminal.com/tools/jotform.md |\n| Fillout | D | 52.2 | 496 | forms.responses, forms.webhooks, forms.surveys, forms.embed | no | https://www.anchorterminal.com/tools/fillout.md |\n| monday.com | BB | 76.4 | 32 | forms.create | no | https://www.anchorterminal.com/tools/monday.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The API is free for all Tally users, and the MCP server is free on all plans (source: \u003chttps://tally.so/help/api, https://tally.so/help/mcp\u003e)\n- The MCP docs open with a warning that the server is in beta and subject to change (source: \u003chttps://developers.tally.so/api-reference/mcp\u003e)\n- API keys are tied to one user and inherit all of that user's permissions. The docs say fine-grained permissions are not an option yet (source: \u003chttps://developers.tally.so/api-reference/api-keys\u003e)\n- The OAuth server metadata lists a registration endpoint, PKCE S256 and the scopes user, forms, responses, webhooks and mcp (source: \u003chttps://api.tally.so/.well-known/oauth-authorization-server\u003e)\n- Two changelog entries in 2026 are marked breaking. Block payload validation on 5 February and rejection of `DELETED` as a form status on 4 August (source: \u003chttps://developers.tally.so/api-reference/changelog\u003e)\n- The product changelog of 11 September 2026 says Tally is a verified connector in Claude and an official plugin in ChatGPT (source: \u003chttps://tally.so/changelog\u003e)\n\n## Compare\n\n- [Jotform vs Tally](https://www.anchorterminal.com/compare/jotform-vs-tally.md): D 52.9 vs C 60.6\n- [SurveyMonkey vs Tally](https://www.anchorterminal.com/compare/surveymonkey-vs-tally.md): C 55.3 vs C 60.6\n- [Tally vs Typeform](https://www.anchorterminal.com/compare/tally-vs-typeform.md): C 60.6 vs C 58.4\n- [Fillout vs Tally](https://www.anchorterminal.com/compare/fillout-vs-tally.md): D 52.2 vs C 60.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on tally.so or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"tally\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/tally\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/tally.svg\" alt=\"Tally on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Tally on Anchor Terminal](https://www.anchorterminal.com/badges/tally.svg)](https://www.anchorterminal.com/tools/tally)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/tally\"\u003eTally on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Tally is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/tally-dark.png\n- Light: https://www.anchorterminal.com/assets/share/tally-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Forms, surveys \u0026 structured intake", "url": "https://www.anchorterminal.com/categories/forms" }, { "name": "Tally", "url": "" } ], "description": "Tally is a form and survey builder from Tally BV in Ghent, Belgium. Agents create forms, read submissions and manage webhooks through a REST API at api.tally.so, or through a hosted MCP server that is in beta.", "facts": [ "rank #348 of 629", "OAuth or key auth", "0 desk reviews" ], "h1": "Tally", "image": "https://www.anchorterminal.com/assets/og/tools-tally.png", "path": "/tools/tally", "published": "2026-10-01", "section": "tools", "title": "Tally review for AI agents, grade C (60.6/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/tally" }, "tokens": { "markdown": 7350, "slim": 1880 }, "version": 1 }