ContactZapp
REMOTE · APP.CONTACTZ.APP
Keeps your contacts in sync across Google, Microsoft, Apple and CardDAV, and cleans up duplicates.
Available components
Last scanned (14 hours ago)
Scores higher than 44% of remote servers
Reachable. Last reached 5 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (contact_change). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1569 tokens (~224/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 71% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Server version: 2.0.0 → 2.0.1 functional
- 4 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 3 Nov 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://app.contactz.app/api/v1/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=contactz.app | CN=WE1,O=Google Trust Services,C=US | 30 Oct 2026 | 28 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | dc80e24bf239ef8d0e88b0e890fef3c7 |
| SANs: contactz.app, *.contactz.app | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of app.contactz.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| app. | DS published | 23684 | 8 | Verified |
| contactz.app. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
| content-security-policy | default-src 'self'; script-src 'self' https://checkout.freemius.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://lh3.googleusercontent.com https://checkout.freemius.com; font-src 'self' data:; connect-src 'self' https://checkout.freemius.com; frame-src https://checkout.freemius.com; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; report-uri /api/csp-report |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://app.contactz.app/api/v1/mcp | Verified | 200 | |
| http (plaintext) | http://app.contactz.app/api/v1/mcp | HTTPS enforced | 301 | https://app.contactz.app/api/v1/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
api_key_check API key – Check ~41
Returns the user the key acts for, the user's plan and the key's scopes. Any live key can call it, so call it to test a key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
contact_change Contact – Change ~417
Changes a contact, as editing it in ContactZapp does. Only the fields you send change. A field you leave out keeps its value. The change goes to every two-way account the contact is in, never to a read-only one. History records it as the user's change and names the API key. A contact waiting in Review duplicates cannot be changed until the review is decided: 409, `contact_pending_review`. Send an `Idempotency-Key` header to make a retry safe.
| Name | Type | Req | Description |
|---|---|---|---|
| Idempotency-Key | string | – | Any string of 1 to 255 bytes you choose for this write, such as a UUID. Repeat the request with the same key and body within 24 hours, and you get the first result back and nothing is written twice.… |
| body | object | yes | The body of a contact create or update: the contact fields a read shows that a write can change, under the same names and in the same shapes, and nothing else. A field the body carries that is not o… |
| id | string | yes | The contact's `id` or its `publicId` (`CS-0042`). |
No output schema declared.
No examples provided.
contact_create Contact – Create ~489
Adds a contact. If the user already has this person, the values may go to that contact instead: - If the user's Auto-Merge level covers the match, the values are added to the existing contact: 200, `merged`. - Otherwise a new contact is created: 201, `created`. If it may be a duplicate, it also waits in Review duplicates: 201, `needs_review`. ContactZapp saves the contact in one two-way account: the first one the user linked that keeps an address book and is not paused. The next sync copies it to the user's other two-way accounts, never to a read-only one. A create is never refused for the plan's contact limit. Over the limit, the contact is created frozen and `contact.frozen` is true. ContactZapp keeps a frozen contact but does not sync it until the user upgrades or frees a place. Send an `Idempotency-Key` header to make a retry safe.
| Name | Type | Req | Description |
|---|---|---|---|
| Idempotency-Key | string | – | Any string of 1 to 255 bytes you choose for this write, such as a UUID. Repeat the request with the same key and body within 24 hours, and you get the first result back and nothing is written twice.… |
| body | object | yes | The body of a contact create or update: the contact fields a read shows that a write can change, under the same names and in the same shapes, and nothing else. A field the body carries that is not o… |
No output schema declared.
No examples provided.
contact_find Contact – Find ~185
Finds the user's contacts by email address, phone number or text. Give at most one of `email`, `phone` and `query`: - `email` finds the contacts with that address. Case does not matter. - `phone` finds the contacts with that number, however it is formatted. - `query` searches the way the Contacts screen's search does. - With none of them, every contact is listed, newest first. Deleted and merged contacts are never returned. For the next page, send the `nextCursor` you got as `cursor`, with the same filter. The last page has no `nextCursor`.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | The previous page's `nextCursor`. |
| string | – | – | |
| limit | integer | – | Page size; 50 when omitted. |
| phone | string | – | – |
| query | string | – | – |
No output schema declared.
No examples provided.
contact_read Contact – Read ~60
Returns one contact. `id` is the contact's `id` or its `publicId`, such as `CS-0042`. A deleted or merged contact is a 404, and so is another user's contact.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
event_list Event – List ~311
Lists the events of one type, newest first. Zapier, Make and n8n poll this to start an automation. Each item's `id` never changes. Poll again and the items you already have come back with the same ids, with new ones on top. Skip the ids you have seen. - `contact.created`, `contact.updated`, `contacts.merged` and `account.needs_attention` come from History, and are kept as long as History keeps them. - `match.needs_review` lists each contact flagged as a possible duplicate and not yet merged. Its `id` changes when the flag is raised again. Each item carries what an automation needs, with no second call: - the contact's fields, or null once the contact is deleted or merged - for a merge, the ids of the contacts it absorbed - for an account, the account and why it needs attention
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | The previous page's `nextCursor`, to read further back. |
| event | string | yes | The events the API reports, as polling triggers. - `contact.created`: a contact was added. - `contact.updated`: a contact was changed. - `contacts.merged`: contacts were merged into one. - `match.ne… |
| limit | integer | – | Page size; 50 when omitted. |
No output schema declared.
No examples provided.
sync_start Sync – Start ~66
Starts a sync, the same as Sync now in ContactZapp. History shows it as a manual run. The answer is 202 with the sync's state, `queued` or `running`. If a sync is already going, you get that one back and no second one starts.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the ContactZapp MCP server?
ContactZapp is a hosted endpoint at https://app.contactz.app/api/v1/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · app.contactz.app
claude mcp add --transport http app-contactz-contactzapp 'https://app.contactz.app/api/v1/mcp'
What is the ContactZapp MCP server?
ContactZapp is an MCP server listed in the public MCP registry as app.contactz/contactzapp. Keeps your contacts in sync across Google, Microsoft, Apple and CardDAV, and cleans up duplicates. This page covers its hosted endpoint (https://app.contactz.app/api/v1/mcp).
Is the ContactZapp MCP server safe to use?
ContactZapp scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ContactZapp MCP server expose?
ContactZapp exposes 7 tools: api_key_check, contact_find, contact_create, contact_read, contact_change, and 2 more. Their descriptions and schemas cost roughly 1,569 tokens of context every time the server is loaded.
Does the ContactZapp MCP server require authentication?
No. We connected to ContactZapp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the ContactZapp MCP server still maintained?
ContactZapp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the ContactZapp MCP server?
VerifyMCP ran 13 checks on ContactZapp, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.