Zendesk MCP Server (SShadowS/zendesk-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 55 tools. No publisher has claimed this listing.
Enables AI-powered ticket analysis and comprehensive Zendesk API integration via the Model Context Protocol, supporting both API token (CLI) and OAuth 2.1 (web) authentication modes.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
SShadowS
Source: Glama · also listed on npm
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_automationsList ALL automations (time-based rules that run hourly — e.g. closing pending tickets after 7 days). Unlike triggers, automations fire on a schedule, not on events. Use this to audit existing time-based workflows.
get_automationFetch one automation's definition by numeric ID, including its conditions and actions array.
create_automationCreate a new automation (runs hourly on tickets matching the conditions). Requires title, conditions, and actions. Conditions should include a time-based field (e.g. hours_since_update) — otherwise consider a trigger instead.
update_automationUpdate an existing automation. Pass `conditions` and/or `actions` to replace those sections (not merge).
delete_automationDelete an automation. Tickets previously modified by it are unaffected.
list_chatsList Zendesk Chat conversations (live chat transcripts), most recent first. Requires Zendesk Chat to be enabled on the account. Use this for end-of-day chat reviews or to find a recent chat by visitor name.
analyze_ticket_documentsComprehensively analyze all document attachments from a ticket (PDF, DOCX, TXT, CSV, etc.) using AI. Long documents are truncated to fit the analysis budget. Note: this may take 30-60 seconds for multiple documents.
get_document_summaryGet a quick summary of all documents attached to a ticket
list_groupsList ALL agent groups (teams that own tickets) in the Zendesk instance. Each group has an ID used in ticket routing — use this when you need to discover group IDs for `update_ticket group_id:<id>` or `search type:ticket group:<id>`.
get_groupFetch one agent group by numeric ID, returning name, description, and metadata.
create_groupCreate a new agent group. Group members are added separately via Zendesk's group_memberships endpoint (not exposed by this tool).
update_groupUpdate an existing group's name or description.
delete_groupDelete an agent group. Tickets currently assigned to this group will be unassigned (group_id set to null).
list_articlesList Help Center (knowledge-base) articles. To find articles by title/body/section, use `search` with `type:article title:<text>` instead — list_articles has no filtering parameters and the catalog can be large.
get_articleFetch one Help Center article by numeric ID, returning title, body (HTML), section_id, labels, and locale.
create_articleCreate a Help Center article in a specific section. Body accepts HTML. Specify `locale` if you support multiple languages (defaults to instance default).
update_articleUpdate an existing Help Center article's title, body, labels, or section. Pass only the fields you want to change.
delete_articleDelete a Help Center article. Soft-deletable — Zendesk retains the record briefly for undo. Existing links to the article will 404.
list_macrosList ALL macros (predefined ticket actions agents can apply) accessible to the API user. Use this to discover macro IDs and inspect what canned responses or ticket updates your team has built.
get_macroFetch one macro's definition by numeric ID, including the title and the array of actions it performs (status change, comment, tag adds, etc.).
create_macroCreate a new macro. Provide `title` and an `actions` array. Each action is `{field, value}` describing what the macro changes when applied.
update_macroUpdate an existing macro's title or actions. Pass `actions` to replace the full action set (not merge).
delete_macroDelete a macro. Tickets previously modified by it are unaffected.
list_organizationsList ALL organizations in the Zendesk instance. No filter parameters — to find an organization by name, domain, external_id, or tag use `search` with `type:organization name:<name>` or `type:organization tags:<tag>`. Supports pagination.
get_organizationFetch one organization by numeric ID, returning name, domain_names, tags, custom_fields, and notes. If you only have a name or domain, use `search` first to find the ID.
create_organizationCreate a new organization. Name must be unique within the instance. Use domain_names (array) to auto-associate end-users whose email domain matches.
update_organizationUpdate an existing organization. Pass only the fields you want to change. To clear domain_names or tags, pass an empty array.
delete_organizationDelete an organization. Associated users are not deleted but are unlinked from the org.
searchSearch Zendesk tickets, users, organizations, groups, and Help Center articles using Zendesk's full search query language. The `query` parameter supports operators (combined with spaces, implicit AND): `type:ticket|user|organization|group|article`, `recipient:<email>`, `assignee:<email|me|none>`, `r…
support_infoReturn the authenticated agent's identity (id, name, email, role) plus account-level Support metadata: subdomain, account settings, brands, and ticket forms. Use this to confirm which Zendesk instance the session is connected to and which ticket forms / brands are available before constructing ticke…
get_talk_statsReturn Zendesk Talk (voice) aggregate stats: total calls, average wait, abandoned rate, agent availability. Requires Zendesk Talk add-on. Returns the rolling window Zendesk publishes (typically last 30 days).
list_ticketsList ALL tickets in the Zendesk instance (no filtering). Has no parameters for filtering by recipient, assignee, requester, status, tags, or dates — for any filtered query use `search` instead with operators like `type:ticket recipient:<email>` or `type:ticket assignee:me status<solved`. Use `list_t…
get_ticketFetch one ticket by numeric ID, returning the full ticket object plus named_custom_fields (e.g. ado_work_item_id). Pass `include_comments:true` to also pull the comment thread inline (otherwise comments are omitted to save tokens — fetch them separately with `get_ticket_comments` if needed). If you …
create_ticketCreate a new ticket. Supports named_custom_fields (e.g. ado_work_item_id) and raw custom_fields.
update_ticketUpdate an existing ticket. Supports named_custom_fields (e.g. ado_work_item_id, pass null to clear) and raw custom_fields. Pass `macro_id` to apply a macro's field changes and comment as part of the update — explicit fields you also pass will override the macro's values.
delete_ticketDelete a ticket
get_ticket_commentsList the comment thread for a ticket (both public replies and internal agent notes). Useful when you need conversation history but already used `get_ticket` without `include_comments:true`. Comments are paginated — large tickets may have 50+ comments across multiple pages.
add_ticket_commentAppend a comment to an existing ticket. Default visibility is `internal` (agent-only note) — pass `type:'public'` to send a reply visible to the requester. Use this rather than `update_ticket` when you only want to add a comment without changing other ticket fields.
get_ticket_attachmentsList every attachment across a ticket's comment thread (files and inline images). Use this to discover what's attached before deciding to call `analyze_ticket_images` or `analyze_ticket_documents`. Each attachment includes content_type, size, filename, and a content_url for downloading.
analyze_ticket_imagesDownload and analyze images from a ticket using AI vision with comprehensive analysis. Includes both file attachments and inline images embedded in comment bodies. Optionally scope to a single comment/post via comment_id, or to specific images via attachment_ids (discover ids with get_ticket_attachm…
list_triggersList ALL triggers (event-driven rules that fire on ticket create/update). Use this to audit existing triggers before adding new ones, or to discover trigger IDs for inspection. For time-based rules use `list_automations` instead.
get_triggerFetch one trigger's definition by numeric ID, returning its conditions (all_conditions/any_conditions) and actions array.
create_triggerCreate a new trigger. Requires title, conditions (when it fires), and actions (what it does). Triggers run on every ticket create/update — be conservative with conditions to avoid performance impact.
update_triggerUpdate an existing trigger. Pass `conditions` and/or `actions` to replace those sections (not merge).
delete_triggerDelete a trigger. Tickets previously modified by it are unaffected.
list_usersList Zendesk users with optional role filter (`end-user`, `agent`, `admin`). For finding a user by email/name/organization/external_id, use `search` with `type:user email:<email>` — that's far cheaper than paginating the full directory. `list_users` is appropriate when you need the full directory fe…
get_userFetch one user by numeric ID, returning the full profile (name, email, role, organization, tags, custom_fields). If you only have an email or name, use `search` with `type:user email:<email>` first to find the ID.
create_userCreate a new Zendesk user. Email must be unique across the instance — duplicates return 422. Role defaults to `end-user`; specify `agent` or `admin` for staff accounts. Returns the created user's full profile including the auto-assigned ID.
update_userUpdate an existing user. Pass only the fields you want to change; omitted fields are preserved. Use `get_user` first to confirm the ID and current state. Pass `organization_id: null` to detach the user from their current organization. String fields can be cleared by passing an empty string.
delete_userSoft-delete a Zendesk user (sets active:false; the record is retained for ticket history). To permanently purge, use Zendesk's GDPR delete endpoint (not exposed by this tool). Cannot delete the account owner.
list_viewsList ALL saved ticket views (filtered ticket lists agents use as dashboards) accessible to the API user. Use this to discover view IDs, then call Zendesk's `/api/v2/views/{id}/tickets` for the actual ticket list (this MCP doesn't yet expose execute_view; use `search` with the equivalent filters as a…
get_viewFetch one view's definition by numeric ID, returning the filter conditions, title, and metadata. Useful for understanding how an agent's existing dashboard is built.
create_viewCreate a new ticket view. Pass `conditions` as an object with optional `all` and `any` arrays (Zendesk evaluates `all` as AND-logic, `any` as OR-logic). Each condition is `{field, operator, value}` per Zendesk's view conditions schema. Use `output` to control which columns appear, plus grouping and …
update_viewUpdate an existing view's title, description, conditions, and/or output (columns, grouping, sort). Use `get_view` first to retrieve and modify the current structure. Only fields you pass are changed — omitted fields are preserved.
delete_viewDelete a saved view. Tickets are unaffected.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
CONVERTER_API_KEYCONVERTER_API_URLMODEfull # 'full' (all 55 tools) or 'lite' (10 essential tools)SERVER_BASE_URLZENDESK_API_TOKEN"": "your-api-token"ZENDESK_DEBUGfalse # Enable debug loggingZENDESK_EMAIL"": "you@example.com",ZENDESK_MAX_RETRIESZENDESK_OAUTH_CLIENT_IDyour_client_idZENDESK_OAUTH_CLIENT_SECRETyour_client_secretZENDESK_OAUTH_REDIRECT_URIZENDESK_RETRY_DELAYZENDESK_RETRY_MAX_DELAYZENDESK_SUBDOMAIN"": "your-subdomain",PORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
55/55 tools missing one or more hints — list_automations (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_automation (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_automation (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +52 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 7/55 tools referenced in tests (13%)
Write tests that reference each tool by name so every tool has at least one test.
Secrets not logged
10 secret values sent to console.log
Redact or omit secret values from log output.
Production dependencies are patched
0 critical, 13 high severity in production deps — @modelcontextprotocol/sdk@1.24.2 (high), @modelcontextprotocol/sdk@1.24.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sshadows/zendesk-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check