Zendesk MCP Server (SShadowS/zendesk-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 55 tools. No publisher has claimed this listing.

D
Caution
52/100

Zendesk MCP Server

Enables AI-powered ticket analysis and comprehensive Zendesk API integration via the Model Context Protocol, supporting both API token (CLI) and OAuth 2.1 (web) authentication modes.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

SShadowS

Source: Glama · also listed on npm

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 13 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: CONVERTER_API_KEY, ZENDESK_API_TOKEN, ZENDESK_OAUTH_CLIENT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes55 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_automations

List ALL automations (time-based rules that run hourly — e.g. closing pending tickets after 7 days). Unlike triggers, automations fire on a schedule, not on events. Use this to audit existing time-based workflows.

get_automation

Fetch one automation's definition by numeric ID, including its conditions and actions array.

create_automation

Create a new automation (runs hourly on tickets matching the conditions). Requires title, conditions, and actions. Conditions should include a time-based field (e.g. hours_since_update) — otherwise consider a trigger instead.

update_automation

Update an existing automation. Pass `conditions` and/or `actions` to replace those sections (not merge).

delete_automation

Delete an automation. Tickets previously modified by it are unaffected.

list_chats

List Zendesk Chat conversations (live chat transcripts), most recent first. Requires Zendesk Chat to be enabled on the account. Use this for end-of-day chat reviews or to find a recent chat by visitor name.

analyze_ticket_documents

Comprehensively analyze all document attachments from a ticket (PDF, DOCX, TXT, CSV, etc.) using AI. Long documents are truncated to fit the analysis budget. Note: this may take 30-60 seconds for multiple documents.

get_document_summary

Get a quick summary of all documents attached to a ticket

list_groups

List ALL agent groups (teams that own tickets) in the Zendesk instance. Each group has an ID used in ticket routing — use this when you need to discover group IDs for `update_ticket group_id:<id>` or `search type:ticket group:<id>`.

get_group

Fetch one agent group by numeric ID, returning name, description, and metadata.

create_group

Create a new agent group. Group members are added separately via Zendesk's group_memberships endpoint (not exposed by this tool).

update_group

Update an existing group's name or description.

delete_group

Delete an agent group. Tickets currently assigned to this group will be unassigned (group_id set to null).

list_articles

List Help Center (knowledge-base) articles. To find articles by title/body/section, use `search` with `type:article title:<text>` instead — list_articles has no filtering parameters and the catalog can be large.

get_article

Fetch one Help Center article by numeric ID, returning title, body (HTML), section_id, labels, and locale.

create_article

Create a Help Center article in a specific section. Body accepts HTML. Specify `locale` if you support multiple languages (defaults to instance default).

update_article

Update an existing Help Center article's title, body, labels, or section. Pass only the fields you want to change.

delete_article

Delete a Help Center article. Soft-deletable — Zendesk retains the record briefly for undo. Existing links to the article will 404.

list_macros

List ALL macros (predefined ticket actions agents can apply) accessible to the API user. Use this to discover macro IDs and inspect what canned responses or ticket updates your team has built.

get_macro

Fetch one macro's definition by numeric ID, including the title and the array of actions it performs (status change, comment, tag adds, etc.).

create_macro

Create a new macro. Provide `title` and an `actions` array. Each action is `{field, value}` describing what the macro changes when applied.

update_macro

Update an existing macro's title or actions. Pass `actions` to replace the full action set (not merge).

delete_macro

Delete a macro. Tickets previously modified by it are unaffected.

list_organizations

List ALL organizations in the Zendesk instance. No filter parameters — to find an organization by name, domain, external_id, or tag use `search` with `type:organization name:<name>` or `type:organization tags:<tag>`. Supports pagination.

get_organization

Fetch one organization by numeric ID, returning name, domain_names, tags, custom_fields, and notes. If you only have a name or domain, use `search` first to find the ID.

create_organization

Create a new organization. Name must be unique within the instance. Use domain_names (array) to auto-associate end-users whose email domain matches.

update_organization

Update an existing organization. Pass only the fields you want to change. To clear domain_names or tags, pass an empty array.

delete_organization

Delete an organization. Associated users are not deleted but are unlinked from the org.

search

Search Zendesk tickets, users, organizations, groups, and Help Center articles using Zendesk's full search query language. The `query` parameter supports operators (combined with spaces, implicit AND): `type:ticket|user|organization|group|article`, `recipient:<email>`, `assignee:<email|me|none>`, `r

support_info

Return the authenticated agent's identity (id, name, email, role) plus account-level Support metadata: subdomain, account settings, brands, and ticket forms. Use this to confirm which Zendesk instance the session is connected to and which ticket forms / brands are available before constructing ticke

get_talk_stats

Return Zendesk Talk (voice) aggregate stats: total calls, average wait, abandoned rate, agent availability. Requires Zendesk Talk add-on. Returns the rolling window Zendesk publishes (typically last 30 days).

list_tickets

List ALL tickets in the Zendesk instance (no filtering). Has no parameters for filtering by recipient, assignee, requester, status, tags, or dates — for any filtered query use `search` instead with operators like `type:ticket recipient:<email>` or `type:ticket assignee:me status<solved`. Use `list_t

get_ticket

Fetch one ticket by numeric ID, returning the full ticket object plus named_custom_fields (e.g. ado_work_item_id). Pass `include_comments:true` to also pull the comment thread inline (otherwise comments are omitted to save tokens — fetch them separately with `get_ticket_comments` if needed). If you

create_ticket

Create a new ticket. Supports named_custom_fields (e.g. ado_work_item_id) and raw custom_fields.

update_ticket

Update an existing ticket. Supports named_custom_fields (e.g. ado_work_item_id, pass null to clear) and raw custom_fields. Pass `macro_id` to apply a macro's field changes and comment as part of the update — explicit fields you also pass will override the macro's values.

delete_ticket

Delete a ticket

get_ticket_comments

List the comment thread for a ticket (both public replies and internal agent notes). Useful when you need conversation history but already used `get_ticket` without `include_comments:true`. Comments are paginated — large tickets may have 50+ comments across multiple pages.

add_ticket_comment

Append a comment to an existing ticket. Default visibility is `internal` (agent-only note) — pass `type:'public'` to send a reply visible to the requester. Use this rather than `update_ticket` when you only want to add a comment without changing other ticket fields.

get_ticket_attachments

List every attachment across a ticket's comment thread (files and inline images). Use this to discover what's attached before deciding to call `analyze_ticket_images` or `analyze_ticket_documents`. Each attachment includes content_type, size, filename, and a content_url for downloading.

analyze_ticket_images

Download and analyze images from a ticket using AI vision with comprehensive analysis. Includes both file attachments and inline images embedded in comment bodies. Optionally scope to a single comment/post via comment_id, or to specific images via attachment_ids (discover ids with get_ticket_attachm

list_triggers

List ALL triggers (event-driven rules that fire on ticket create/update). Use this to audit existing triggers before adding new ones, or to discover trigger IDs for inspection. For time-based rules use `list_automations` instead.

get_trigger

Fetch one trigger's definition by numeric ID, returning its conditions (all_conditions/any_conditions) and actions array.

create_trigger

Create a new trigger. Requires title, conditions (when it fires), and actions (what it does). Triggers run on every ticket create/update — be conservative with conditions to avoid performance impact.

update_trigger

Update an existing trigger. Pass `conditions` and/or `actions` to replace those sections (not merge).

delete_trigger

Delete a trigger. Tickets previously modified by it are unaffected.

list_users

List Zendesk users with optional role filter (`end-user`, `agent`, `admin`). For finding a user by email/name/organization/external_id, use `search` with `type:user email:<email>` — that's far cheaper than paginating the full directory. `list_users` is appropriate when you need the full directory fe

get_user

Fetch one user by numeric ID, returning the full profile (name, email, role, organization, tags, custom_fields). If you only have an email or name, use `search` with `type:user email:<email>` first to find the ID.

create_user

Create a new Zendesk user. Email must be unique across the instance — duplicates return 422. Role defaults to `end-user`; specify `agent` or `admin` for staff accounts. Returns the created user's full profile including the auto-assigned ID.

update_user

Update an existing user. Pass only the fields you want to change; omitted fields are preserved. Use `get_user` first to confirm the ID and current state. Pass `organization_id: null` to detach the user from their current organization. String fields can be cleared by passing an empty string.

delete_user

Soft-delete a Zendesk user (sets active:false; the record is retained for ticket history). To permanently purge, use Zendesk's GDPR delete endpoint (not exposed by this tool). Cannot delete the account owner.

list_views

List ALL saved ticket views (filtered ticket lists agents use as dashboards) accessible to the API user. Use this to discover view IDs, then call Zendesk's `/api/v2/views/{id}/tickets` for the actual ticket list (this MCP doesn't yet expose execute_view; use `search` with the equivalent filters as a

get_view

Fetch one view's definition by numeric ID, returning the filter conditions, title, and metadata. Useful for understanding how an agent's existing dashboard is built.

create_view

Create a new ticket view. Pass `conditions` as an object with optional `all` and `any` arrays (Zendesk evaluates `all` as AND-logic, `any` as OR-logic). Each condition is `{field, operator, value}` per Zendesk's view conditions schema. Use `output` to control which columns appear, plus grouping and

update_view

Update an existing view's title, description, conditions, and/or output (columns, grouping, sort). Use `get_view` first to retrieve and modify the current structure. Only fields you pass are changed — omitted fields are preserved.

delete_view

Delete a saved view. Tickets are unaffected.

// known CVEs in dependencies1 critical13 high6 medium11 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.18GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.24.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.24.2GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

highaxios@1.13.2GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.2GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretCONVERTER_API_KEY
configCONVERTER_API_URL
configMODEfull # 'full' (all 55 tools) or 'lite' (10 essential tools)
configSERVER_BASE_URL
🔐 secretZENDESK_API_TOKEN"": "your-api-token"
configZENDESK_DEBUGfalse # Enable debug logging
configZENDESK_EMAIL"": "you@example.com",
configZENDESK_MAX_RETRIES
configZENDESK_OAUTH_CLIENT_IDyour_client_id
🔐 secretZENDESK_OAUTH_CLIENT_SECRETyour_client_secret
configZENDESK_OAUTH_REDIRECT_URI
configZENDESK_RETRY_DELAY
configZENDESK_RETRY_MAX_DELAY
configZENDESK_SUBDOMAIN"": "your-subdomain",
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

55/55 tools missing one or more hints — list_automations (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_automation (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_automation (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +52 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 7/55 tools referenced in tests (13%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

10 secret values sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 13 high severity in production deps — @modelcontextprotocol/sdk@1.24.2 (high), @modelcontextprotocol/sdk@1.24.2 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sshadows/zendesk-mcp-server?variant=verified)](https://m8ven.ai/mcp/sshadows/zendesk-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: fc26766c962e77b55c58da9c7b1485b53f86dd33
code hash: 85ac304f2d586c8cb35db75d1bebb46887c4428fc361047ecd7f9f614e3c5314
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client