Atlas / MCP servers / fruggr / zendesk-mcp-server

zendesk-mcp-serverCAUTION

mcp/fruggr/zendesk-mcp-server

Bring Zendesk deep into your AI assistant: find answers and draft, update and translate Help Center articles, and manage Support tickets end to end: comments, triage and attachments. All in plain language.

Verdict
CAUTION
Grade
B
Trust score
86 /100
Exposed tools
8 7r · 1w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
12
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://glama.ai/mcp/servers/fruggr/zendesk-mcp-server) [](https://registry.modelcontextprotocol.io/?search=io.github.fruggr/zendesk-mcp-server) [](https://www.npmjs.com/package/@fruggr/zendesk-mcp-server) [](LICENSE) [](https://nodejs.org)

A Model Context Protocol (MCP) server that puts Zendesk inside your AI assistant, for both sides of the conversation.

For agents: it finds answers in the Help Center; drafts, updates and translates articles while keeping the languages in sync; and handles Support tickets end to end, comments, triage and image attachments included.

For your customers: it opens the same door the Help Center's "Submit a request" form does. They pick the kind of request, get walked through the questions that form actually asks, attach a screenshot, then follow the ticket — read the replies, answer back, close it when it's resolved. See End-user mode.

It all happens in plain language, without switching apps.

It does roughly what the Zendesk agent for Microsoft 365 Copilot does, minus the tie to one vendor: it drops into any MCP client (Claude Desktop, Claude Code, Cursor, VS Code, and the rest). And it always acts with each user's own Zendesk permissions, never a shared admin key.

What your assistant can do

Ask in natural language; the assistant works out the context and t

Read from source at commit a48b16b82d7bOBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add zendesk-mcp-server -- npx -y @fruggr/[email protected]
03

Exposed tools (8)

7 read · 1 write · 0 destructive.

ToolRiskDescription
FAQreadFrequently asked questions
GeneralreadGeneral category
ZENDESK_SUBDOMAINreadZendesk subdomain, used when no positional subdomain argument is given.
get_thingreadRetrieve a thing by ID. Lots more context that should be trimmed.
list_thingsreadList things.
probereadProbe tool. ${MARKERS.description[0]}. ${pad(3000)} ${MARKERS.description[1]}.
reload_toolsread
update_thingwriteUpdate a thing. Prefer update_thing_section for targeted edits.
04

Trust audit

CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (7 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (19)

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
src/auth/token-store.ts:78
logger.warn('oauth_token_scope_insufficient', { requested, granted: token.scope });
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/container-smoke.mjs:62
const base = `http://127.0.0.1:${port}`;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/container-smoke.mjs:97
redirect_uris: ['http://127.0.0.1:9/cb'],
LOWInventory / provenance · inv.hidden_file · CWE-1104
.coderabbit.yaml
.coderabbit.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.releaserc.json
.releaserc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.symlink · CWE-1104
CLAUDE.md
CLAUDE.md
Why it matters. link not followed
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/bundle-manifest.mjs:69
const hex = createHash('sha1').update(JSON.stringify(body)).digest('hex');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/mutation-canary/stryker.config.mjs:1
import base from '../../stryker.config.mjs';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/auth/server/authorization-server.ts:5
import type { Config } from '../../config';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/auth/server/authorization-server.ts:6
import { type Logger, silentLogger } from '../../utils/logger';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/auth/server/cimd-documents.ts:7
import type { Logger } from '../../utils/logger';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/auth/server/consent.ts:1
import { escapeHtml } from '../../utils/html';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/bundle/bundle.test.ts:95
const target = `http://127.0.0.1:${relayPort}${pathname}${search}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/bundle/bundle.test.ts:160
const baseUrl = `http://127.0.0.1:${port}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/integration/http-harness.ts:29
const baseUrl = `http://127.0.0.1:${handle.port}`;
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@semantic-release/changelog, @semantic-release/exec, @semantic-release/git, @semantic-release/github, @semantic-release/npm, @semantic-release/release-notes-generator, @stryker-mutator/core, @stryker-
Why it matters. 23 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/decisions/oauth-authorization-server.md:61
| Self-hosted Keycloak as the AS | Rejected | It would work: it brokers generic OAuth 2 upstreams since 26.3, has experimental CIMD since 26.6, and hands the Zendesk token back via `POST /realms/{real
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
README.md:58
full access to every ticket, and bolt on a fixed set of tools. This one is built
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/decisions/oauth-authorization-server.md:294
| Access-token key | Encrypts the JWE access tokens (`dir` + `A256GCM`). Authenticated encryption, no separate signature: `oidc-provider` accepts encrypt-only with a symmetric key. | 256-bit symmetric
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha a48b16b82d7bfull audit observations/trust-audit/mcp-server/fruggr__zendesk-mcp-server.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-10a48b16b82d7bCAUTIONB86first audit
06

Questions

What is the zendesk-mcp-server MCP server?

Bring Zendesk deep into your AI assistant: find answers and draft, update and translate Help Center articles, and manage Support tickets end to end: comments, triage and attachments. All in plain language.

What tools does zendesk-mcp-server expose?

8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is zendesk-mcp-server safe to connect to an agent?

With care. The audit graded it B (86/100) and found 19 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does zendesk-mcp-server need?

It reads STRYKER_DASHBOARD_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does zendesk-mcp-server run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @fruggr/zendesk-mcp-server at 3.3.0.

How current is this page?

The grade is for one exact copy of the source (a48b16b82d7b), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement