zendesk-mcp-serverCAUTION
Bring Zendesk deep into your AI assistant: find answers and draft, update and translate Help Center articles, and manage Support tickets end to end: comments, triage and attachments. All in plain language.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://glama.ai/mcp/servers/fruggr/zendesk-mcp-server) [](https://registry.modelcontextprotocol.io/?search=io.github.fruggr/zendesk-mcp-server) [](https://www.npmjs.com/package/@fruggr/zendesk-mcp-server) [](LICENSE) [](https://nodejs.org)
A Model Context Protocol (MCP) server that puts Zendesk inside your AI assistant, for both sides of the conversation.
For agents: it finds answers in the Help Center; drafts, updates and translates articles while keeping the languages in sync; and handles Support tickets end to end, comments, triage and image attachments included.
For your customers: it opens the same door the Help Center's "Submit a request" form does. They pick the kind of request, get walked through the questions that form actually asks, attach a screenshot, then follow the ticket — read the replies, answer back, close it when it's resolved. See End-user mode.
It all happens in plain language, without switching apps.
It does roughly what the Zendesk agent for Microsoft 365 Copilot does, minus the tie to one vendor: it drops into any MCP client (Claude Desktop, Claude Code, Cursor, VS Code, and the rest). And it always acts with each user's own Zendesk permissions, never a shared admin key.
What your assistant can do
Ask in natural language; the assistant works out the context and t
a48b16b82d7bOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add zendesk-mcp-server -- npx -y @fruggr/[email protected]
Exposed tools (8)
7 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
FAQ | read | Frequently asked questions |
General | read | General category |
ZENDESK_SUBDOMAIN | read | Zendesk subdomain, used when no positional subdomain argument is given. |
get_thing | read | Retrieve a thing by ID. Lots more context that should be trimmed. |
list_things | read | List things. |
probe | read | Probe tool. ${MARKERS.description[0]}. ${pad(3000)} ${MARKERS.description[1]}. |
reload_tools | read | |
update_thing | write | Update a thing. Prefer update_thing_section for targeted edits. |
Trust audit
CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (19)
logger.warn('oauth_token_scope_insufficient', { requested, granted: token.scope });const base = `http://127.0.0.1:${port}`;redirect_uris: ['http://127.0.0.1:9/cb'],
.coderabbit.yaml
.releaserc.json
CLAUDE.md
const hex = createHash('sha1').update(JSON.stringify(body)).digest('hex');import base from '../../stryker.config.mjs';
import type { Config } from '../../config';import { type Logger, silentLogger } from '../../utils/logger';import type { Logger } from '../../utils/logger';import { escapeHtml } from '../../utils/html';const target = `http://127.0.0.1:${relayPort}${pathname}${search}`;const baseUrl = `http://127.0.0.1:${port}`;const baseUrl = `http://127.0.0.1:${handle.port}`;@semantic-release/changelog, @semantic-release/exec, @semantic-release/git, @semantic-release/github, @semantic-release/npm, @semantic-release/release-notes-generator, @stryker-mutator/core, @stryker-
| Self-hosted Keycloak as the AS | Rejected | It would work: it brokers generic OAuth 2 upstreams since 26.3, has experimental CIMD since 26.6, and hands the Zendesk token back via `POST /realms/{realfull access to every ticket, and bolt on a fixed set of tools. This one is built
| Access-token key | Encrypts the JWE access tokens (`dir` + `A256GCM`). Authenticated encryption, no separate signature: `oidc-provider` accepts encrypt-only with a symmetric key. | 256-bit symmetric
Gates applied: no_behavioural_pass.
a48b16b82d7bfull audit observations/trust-audit/mcp-server/fruggr__zendesk-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | a48b16b82d7b | CAUTION | B | 86 | first audit |
Questions
What is the zendesk-mcp-server MCP server?
Bring Zendesk deep into your AI assistant: find answers and draft, update and translate Help Center articles, and manage Support tickets end to end: comments, triage and attachments. All in plain language.
What tools does zendesk-mcp-server expose?
8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is zendesk-mcp-server safe to connect to an agent?
With care. The audit graded it B (86/100) and found 19 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does zendesk-mcp-server need?
It reads STRYKER_DASHBOARD_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does zendesk-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @fruggr/zendesk-mcp-server at 3.3.0.
How current is this page?
The grade is for one exact copy of the source (a48b16b82d7b), read on 2026-10-10. The repository is watched and re-audited when it changes.