ZenMLBLOCK
MCP server to connect an MCP client (Cursor, Claude Desktop etc) with your ZenML MLOps and LLMOps pipelines
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://archestra.ai/mcp-catalog/zenml-io__mcp-zenml)
This project implements a Model Context Protocol (MCP) server for interacting with the ZenML API.
What is MCP?
The Model Context Protocol (MCP) is an open protocol that standardizes how applications provide context to Large Language Models (LLMs). It acts like a "USB-C port for AI applications" - providing a standardized way to connect AI models to different data sources and tools.
MCP follows a client-server architecture where:
- MCP Hosts: Programs like Claude Desktop or IDEs that want to access data through MCP
- MCP Clients: Protocol clients that maintain 1:1 connections with servers
- MCP Servers: Lightweight programs that expose specific capabilities through the standardized protocol
- Local Data Sources: Your computer's files, databases, and services that MCP servers can securely access
- Remote Services: External systems available over the internet that MCP servers can connect to
What is ZenML?
ZenML is an open-source platform for building and managing ML and AI pipelines. It provides a unified interface for managing data, models, and experiments.
For more information, see the ZenML website and our documentation.
Features
The server provides MCP tools to access core read functionality from the ZenML server, providing a way to get live information about:
Core Entities
- Users - user accounts and permissions
- Stacks - infrastructure configurations
- Stack Components - individual stack building blocks
- Flavors - available component types
- Service Connectors - cloud authentication
Pipeline Execution
- Pipelines - pipeline definitions
- Pipeline Runs - execution history
c9593a9452c3OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-zenml:2.0.0 --env ZENML_STORE_API_KEY=${ZENML_STORE_API_KEY} -- docker run -i --rm docker.io/zenmldocker/mcp-zenml:2.0.0:NoneExposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
slow_call | read | with events.open( |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (11)
verify=False,
verify=False,
.env.local.example
`http://127.0.0.1:8001`, require an identity or service credential for the
assert "http://127.0.0.2:*" in alternate_loopback.allowed_origins
"origin": "http://127.0.0.1:8000",
"origin": "http://127.0.0.1:evil.com",
"http://127.0.0.1:8000/path",
assets/icon.png
assets/mcp-settings-page.gif
mcp-zenml.mcpb
Gates applied: no_behavioural_pass.
c9593a9452c3full audit observations/trust-audit/mcp-server/zenml-io__zenml.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | c9593a9452c3 | BLOCK | D | 69 | first audit |
Questions
What is the ZenML MCP server?
MCP server to connect an MCP client (Cursor, Claude Desktop etc) with your ZenML MLOps and LLMOps pipelines
What tools does ZenML expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ZenML safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does ZenML need?
It reads ZENML_MCP_RESTRICTED_API_KEY and ZENML_STORE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ZenML run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-zenml.
How current is this page?
The grade is for one exact copy of the source (c9593a9452c3), read on 2026-10-08. The repository is watched and re-audited when it changes.