Zapier MCP

Zapier MCP is a hosted server that lets an AI agent run actions in 9,000+ apps through your own Zapier connections. Every client points at https://mcp.zapier.com/api/v1/connect. There is no separate MCP bill: each successful tool call uses two tasks from your Zapier plan, and failed calls use none. We checked the docs on 31 October 2026.

Quick facts

The server is not a single app's API. It is a router. You connect Gmail, Slack, HubSpot or Sheets in Zapier once, and the agent asks Zapier to call them. The agent never sees the third-party API key.

What it does

Most MCP servers wrap one product. Zapier's wraps a catalog. If your agent needs to "find a contact in HubSpot and email them through Gmail", it does not need two servers. It calls Zapier twice, and Zapier uses the connections you already set up.

Zapier's own docs push this hard. The docs index says to reach for Zapier MCP before calling a third-party API directly, "Zapier holds the credentials, token refresh, and retries." That is a vendor view, and it fits the pitch, but the practical gain is real. OAuth setup for each service is the dull part of agent work, and this removes it.

It also means you inherit Zapier's limits. Zapier's older "AI Actions" and "Natural Language Actions" are retired, and the docs say to use MCP instead.

How tools work: two modes

A Zapier MCP server has two modes, and the difference changes how your agent behaves.

New servers default to agentic mode. A few programmatic clients, such as Vapi and the OpenAI API, start in managed mode.

Agentic mode and the meta-tools

In agentic mode the server exposes 16 meta-tools, always available. The agent uses them to find, enable and run actions as needed.

Notice the split between a read action and a write action. That is useful: an agent client that asks permission per tool can allow reads and prompt for writes. Some servers also expose a write_code_action tool that generates custom code for an app when no built-in action matches, and runs it in a sandbox with authenticated API access. It is rolling out to more accounts over time, and Enterprise admins can allow or block its requests per app.

Agentic mode keeps the tool list short, which saves context. The cost is that the agent spends calls on discovery.

Auto-provisioning

Zapier auto-provisions a server from the apps already connected in your account. It enables their actions and sets default connections. Shared connections from other users are not included. With no connections, the server starts empty and the agent finds an action, enables it and asks you to connect the app.

Skills

Skills are reusable Markdown workflow instructions the agent loads on demand. They exist only in agentic mode. Zapier also describes Next Gen Zaps, where you describe a workflow and your client builds, tests and deploys it, as early access.

What it costs

Zapier's usage page says: "There is no separate MCP billing." The numbers:

Batch work adds up. Zapier's examples: adding 5 rows to a sheet is 5 calls (10 tasks), and "search and update 10 records" is 11 calls (22 tasks). Asking what tools exist, authenticating and viewing history do not count.

If pay-per-task billing is on, calls continue up to a usage cap and Zapier charges for the extra tasks. The dashboard sidebar shows Plan Tasks and MCP Tasks. Zapier's pricing page lists Free at 100 tasks a month and Professional from $19.99 a month, with the price rising by task tier.

The practical rule: an agent that loops over 200 rows costs 400 tasks. Put a cap in your prompt, or use a bulk action.

Install it in each agent

Zapier documents Claude, Claude Code, ChatGPT, Cursor, Codex and Antigravity, with many more clients on its quickstart. OpenCode is not on its list, so that line is our adaptation. See MCP clients for how agents differ.

Claude Code

From Zapier's page:

claude mcp add --transport http "Zapier-MCP" https://mcp.zapier.com/api/v1/connect

Restart Claude Code, then sign in to Zapier in the browser when prompted. On Claude Team or Enterprise, an Owner may need to approve MCP servers first. Zapier warns that on WSL the OAuth callback may not reach Claude Code, so use a native terminal if sign-in fails. Zapier also publishes a plugin: /plugin install zapier@claude-plugins-official, or add the zapier/zapier-mcp marketplace first.

Codex

From Zapier's page:

codex mcp add zapier --url https://mcp.zapier.com/api/v1/connect
codex mcp login zapier

Run /mcp in the Codex TUI to confirm the server is listed. The ChatGPT desktop app route is Settings, MCP servers, Add server, with the name zapier, transport Streamable HTTP and the same URL.

Cursor

Zapier's docs describe a team plugin or the Cursor marketplace plugin. The flow is to open an Agent chat, ask for something that uses Zapier and sign in when prompted. If sign-in fails repeatedly, update Cursor, since Zapier notes an RFC 9728 OAuth issue in some versions. Cursor and Grok Bot share one Zapier connection.

Antigravity

From Zapier's page, in the Antigravity app or CLI:

/mcp add https://mcp.zapier.com/api/v1/connect

Allow the change, restart, open Customizations, find Zapier under Installed, MCP Servers, and choose Authenticate. Copy the code from Zapier and paste it into Antigravity. This differs from the config-file route, but it is Zapier's documented flow. The config-file equivalent uses serverUrl in ~/.gemini/config/mcp_config.json. Gemini CLI is now Code Assist enterprise only.

OpenCode

Our adaptation, with a connection token from mcp.zapier.com:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zapier": {
      "type": "remote",
      "url": "https://mcp.zapier.com/api/v1/connect",
      "headers": { "Authorization": "Bearer {env:ZAPIER_MCP_TOKEN}" }
    }
  }
}

Zapier prefers the Authorization header over the ?token= URL form, since URLs end up in logs and shell history. OpenCode's docs say remote servers that require OAuth prompt you to sign in, but we did not confirm that Zapier's server offers OAuth, so use the token header.

Connection tokens

OAuth is the default and the client manages the credential. The token route is for unlisted clients and your own Python or TypeScript code. You create a server at mcp.zapier.com, generate a token and pass it to the client. Zapier's warnings:

• A token is long-lived and tied to one server.
• Whoever holds it can run the server's tools and read the data they return.
• It is shown once. Regenerating it invalidates the old one at once.
• Rotating it cuts off every client that uses it.
• Treat it like a password and give each user their own server and token.

Security notes

The risk with Zapier MCP is reach. One connection can touch your email, calendar, CRM and chat. Think about what the agent could do in the worst case.

• Permissions follow your apps. Zapier says permissions inside the apps still apply. If you cannot change something in Rippling, you cannot through MCP either.
• No MCP-only restrictions. Zapier states app and action restrictions cannot be set only for MCP. They apply account-wide.
• Read versus write. Use your client's per-tool approvals. Allow execute_zapier_read_action, and prompt for execute_zapier_write_action.
• Prompt injection. An agent that reads email and can also send email can be steered by a hostile message. Keep write actions on a short, deliberate list, or use managed mode with only the actions you chose.
• Managed mode for scope. If you want exactly five actions and nothing else, managed mode gives you that.
• Audit. Every call appears in the History tab at mcp.zapier.com.
• Workspace controls. Admins can disable MCP per workspace by contacting their Zapier account manager, restrict it by membership and set task quotas.
• Data. Customer data is stored in AWS US-East 1. Enterprise customers are opted out of AI training by default, per Zapier's AI Supplementary Terms. Multi-tenant cloud only, with no dedicated VPC.
• Server sharing. Sharing a server lets others review or manage tools. It does not share app connections.

Limits and known issues

• Streamable HTTP only. SSE-only clients cannot connect.
• Auto-provisioning ignores connections shared with you.
• Skills and Next Gen Zaps need agentic mode, and Next Gen Zaps are early access.
• Each client connects to one server at a time.
• Credentials and shared connections cannot be pooled across users.
• WSL OAuth callbacks can fail with Claude Code.

Example prompts

Alternatives

Direct servers give you finer scope and no per-call charge. Zapier gives you breadth and the credential handling. The choice is simple. If you need three apps, use three servers. If you need thirty, Zapier is less work.

Which agents it suits

Any client that speaks Streamable HTTP can connect. Claude Code, Codex, Cursor and Antigravity have documented flows. Chat clients such as Claude and ChatGPT have first-party connectors. Org admins can roll out to a Claude, ChatGPT or Cursor team so members sign in once.

Our take

Zapier MCP is the quickest route we know of from a coding agent to a long tail of business apps. The two-task cost is predictable and the 16 meta-tools keep the tool list small. For small teams that already use Zapier, there is little reason not to try it.

Three cautions. Watch task use on any loop. Do not give an agent write access to an inbox it also reads. And remember it runs in a single US region on multi-tenant infrastructure, which may rule it out for some regulated data.

This is our reading of the documentation, not a hands-on test.

A short setup checklist

1. Check your Zapier plan's task allowance.
2. Connect the apps you need in Zapier first.
3. Add the server in your agent with its documented command.
4. Sign in with OAuth. Avoid tokens unless needed.
5. Require approval for write actions.
6. Ask for a read action first.
7. Check History at mcp.zapier.com.
8. Set a task quota for your workspace if you are an admin.

See also the MCP server list and best MCP servers.

Frequently asked questions

What does Zapier MCP do?

It gives an agent one hosted endpoint to run actions in 9,000+ apps through your own Zapier connections.

How much does Zapier MCP cost?

No separate bill. Each successful call uses 2 tasks from your plan, and failed calls use none.

Is Zapier MCP open source?

The server is hosted. The zapier/zapier-mcp repository is an MIT plugin distribution.

Do I need an API key?

Not for listed clients. They use OAuth. A connection token is the fallback.

Does it support SSE?

No. It supports Streamable HTTP only.