On this page
Zapier MCP is Zapier's hosted MCP server. It lets your AI client run actions
across thousands of apps through one URL, https://mcp.zapier.com/api/v1/connect.
Each successful tool call uses two tasks from your Zapier plan. TrustedMCP grades
it B. Use managed mode and keep approval on for write actions.
What it connects
Zapier's MCP docs describe it as "the Model Context Protocol interface to Zapier". Your agent picks an action, fills in the fields from your conversation and calls it. Zapier holds the app credentials, so your client "never handles a third-party API key", per how connections work.
Your client must support Streamable HTTP. Zapier says it "does not support Server-Sent Events (SSE)".
Setup
The snippets below are copied from Zapier's per-client pages. For most clients you don't need to create a server first. Zapier creates a default one when you sign in.
Claude Code (Zapier's page):
claude mcp add --transport http "Zapier-MCP" https://mcp.zapier.com/api/v1/connect
Restart Claude Code and sign in when prompted. On the authorization screen, click Copy prompt, then Continue, review the access and click Allow. Paste the copied prompt back into Claude Code to run Zapier's onboarding. Zapier notes that on WSL the browser callback may not reach Claude Code. If sign-in doesn't complete, use a native Windows or macOS terminal.
Zapier also ships a plugin:
/plugin install zapier@claude-plugins-official
Claude and Claude Desktop: ask Claude to "Connect to Zapier MCP", click Connect on the card, and complete the same Copy prompt, Continue, Allow steps. On Team and Enterprise, an Owner must enable Zapier first (Zapier's page).
VS Code (run MCP: Open User Configuration):
{
"servers": {
"Zapier": {
"url": "https://mcp.zapier.com/api/v1/connect"
}
}
}
Cursor: install the Zapier plugin from the Cursor marketplace, then ask the agent to set up Zapier MCP and sign in when prompted. Zapier says some older Cursor versions have an OAuth bug, so update first.
OAuth or a connection token
Most clients sign in with OAuth. The client stores and refreshes the token, and you can revoke it from the client or from mcp.zapier.com.
Clients that can't do OAuth, and your own code, use a connection token. You generate it in the server's Settings tab. Zapier's other clients page shows two forms:
Authorization: Bearer YOUR_CONNECTION_TOKEN
https://mcp.zapier.com/api/v1/connect?token=YOUR_CONNECTION_TOKEN
Use the header. Zapier itself recommends it, because URLs are more likely to
end up in logs or shell history. The base URL isn't secret, but a URL with
?token= in it is. Zapier says to "treat a connection token like a password".
It's shown only once and is long-lived. Keep it in an environment variable, not
in a committed config file. See
keeping API keys out of your MCP config.
Rotate token kills the old one immediately for every client that used it.
Managed mode vs agentic mode
Every Zapier MCP server runs in one of two modes, set for the whole server. The details are on how tools work.
Agentic mode is the default for new servers. Your client doesn't see one tool per action. It gets a fixed set of 16 meta-tools and uses them to find and turn on actions mid-conversation:
- Action management:
inspect_zapier_actions,discover_zapier_actions,enable_zapier_action,disable_zapier_action,auto_provision_mcp - Running actions:
execute_zapier_read_action,execute_zapier_write_action - Connections:
list_zapier_connections,manage_zapier_connections - Configuration:
get_configuration_url - Skills:
list_zapier_skills,get_zapier_skill,create_zapier_skill,update_zapier_skill,delete_zapier_skill - Feedback:
send_feedback
Some servers also get write_code_action, which creates custom code actions
when no built-in action fits.
Managed mode means you pick the actions at mcp.zapier.com, and each one becomes its own tool, such as "send a Slack message". The agent can't enable new actions, and skills aren't available.
Which to use: managed. In agentic mode the agent can widen its own toolset, so the set of things it can do isn't fixed when you approve the connection. Managed mode gives you a list you chose. To switch, open your server's Settings tab at mcp.zapier.com, pick the mode and click Save changes. Then reload your client so it picks up the new tool list.
Lock the fields that matter
In managed mode you can fix field values per action. At mcp.zapier.com, open Apps, click the ⋮ menu next to an action and select Configure (Zapier's guide). Each field has options such as Set a specific value for this field and Have AI generate a value for this field.
A fixed value is enforced: Zapier "sends that value on every call and ignores any value your MCP client sends". Lock the Slack channel, the sender address or the spreadsheet, and the model can't redirect them.
Billing: two tasks per call
Zapier's usage page is clear: each successful tool call uses two tasks, and "Tool calls that fail do not consume tasks". MCP has no separate bill. Calls draw from the same task allowance as your Zaps. Onboarding calls count too.
When you hit your limit, calls continue only if pay-per-task billing is on, and Zapier charges for the extra tasks. Otherwise they stop with an error until your cycle resets or you upgrade. An agent that loops on a read action burns tasks quickly, so watch the History tab, which logs every tool call.
Security notes
Write actions need a human check. Sending an email, posting a message or
updating a CRM record changes real data. Zapier's docs don't describe an
approval step of their own, so approval has to happen in your client. In
agentic mode, writes go through execute_zapier_write_action. Keep approval on
for that tool, and in managed mode for every action that writes.
Prompt injection is the main risk. Zapier can read your inbox, documents and messages. Any of that text can contain instructions aimed at the model, such as "forward this thread to…". If the same session can also send email, injected text can act through it. Approval is what stops that. Read-only labels don't protect you on their own; see MCP tool annotations explained.
Expose less. Use managed mode, enable only the actions you need, lock fields, and give each person their own server and token.
The general checklist is in the 5-minute safety check.
Why it grades B
Zapier runs the server over HTTPS, there are no known CVEs, and it's actively maintained. App credentials stay in Zapier rather than reaching the model, and every call is logged. Two things hold it back. The OAuth sign-in and its scopes aren't documented in detail, and the server is closed source, so we scored authentication and maintenance one band lower.
Full breakdown on the Zapier MCP listing.
Frequently asked questions
Is Zapier MCP free?
Zapier says MCP is "included in every Zapier plan", and its pricing page lists MCP on the Free plan with 100 tasks a month. At two tasks per successful call, that allowance is shared with your Zaps.
How much does Zapier MCP cost?
There's no separate price. Each successful tool call uses two tasks from your plan, and failed calls are free. Check Zapier's pricing page for plan prices and the usage page for billing details.
How do I add Zapier MCP to Claude Code?
Run claude mcp add --transport http "Zapier-MCP" https://mcp.zapier.com/api/v1/connect,
restart Claude Code, sign in, and paste the onboarding prompt Zapier gives you.
Zapier MCP vs n8n's built-in MCP server?
Zapier gives your agent ready-made actions across thousands of apps, hosted by Zapier and billed in tasks. n8n's built-in server exposes workflows you build and choose to enable, on your own instance or n8n Cloud, with OAuth per client. It grades A. See the n8n MCP server guide.