{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T17:55:32.972Z","url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp","markdownUrl":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.md","server":{"slug":"app-contactz-contactzapp","name":"ContactZapp","registryName":"app.contactz/contactzapp","description":"Keeps your contacts in sync across Google, Microsoft, Apple and CardDAV, and cleans up duplicates.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"api-v1-mcp","type":"remote","identifier":"https://app.contactz.app/api/v1/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp","version":"1.0.5","transport":null,"scoredAt":"2026-11-05T02:11:01.077Z"},"score":{"total":63,"tier":"medium","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":63},{"date":"2026-11-04","total":63},{"date":"2026-11-03","total":63}]},"categories":[{"name":"Endpoint Security","score":63,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (contact_change).","HTTPS is enforced; there's no plaintext access path.","The HSTS (Strict-Transport-Security) header is present.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.none_destructive","args":{"tool":"contact_change"}},{"code":"https.enforced","args":{}},{"code":"headers.hsts_present","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":65,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 1569 tokens (~224/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"224","items":"7","tools":"7","tokens":"1569","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":7,"verdict":"partial","reasons":["Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"2"}}]},{"name":"Tool Coverage","score":90,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","71% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"71"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"7"}},{"code":"toolsafety.manipulation_clean","args":{"units":"7","judged":"7"}}]},{"name":"Capabilities","score":60,"verdict":"fail","reasons":["Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28."],"codes":[{"code":"protocol.outdated","args":{"latest":"2026-07-28","version":"2025-06-18"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"api-v1-mcp","type":"remote","identifier":"https://app.contactz.app/api/v1/mcp","withdrawn":false,"score":63,"current":true,"url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp","markdownUrl":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.md"}],"facts":[{"label":"Endpoint","value":"https://app.contactz.app/api/v1/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"none"},{"label":"Version","value":"1.0.5"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"api_key_check","title":"API key – Check","description":"Returns the user the key acts for, the user's plan and the key's scopes. Any live key can call it, so call it to test a key.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":41},{"name":"contact_find","title":"Contact – Find","description":"Finds the user's contacts by email address, phone number or text. Give at most one of `email`, `phone` and `query`:\n\n- `email` finds the contacts with that address. Case does not matter.\n- `phone` finds the contacts with that number, however it is formatted.\n- `query` searches the way the Contacts screen's search does.\n- With none of them, every contact is listed, newest first.\n\nDeleted and merged contacts are never returned. For the next page, send the `nextCursor` you got as `cursor`, with the same filter. The last page has no `nextCursor`.","inputs":[{"name":"cursor","type":"string","required":false,"description":"The previous page's `nextCursor`."},{"name":"email","type":"string","required":false,"description":null},{"name":"limit","type":"integer","required":false,"description":"Page size; 50 when omitted."},{"name":"phone","type":"string","required":false,"description":null},{"name":"query","type":"string","required":false,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":185},{"name":"contact_create","title":"Contact – Create","description":"Adds a contact. If the user already has this person, the values may go to that contact instead:\n\n- If the user's Auto-Merge level covers the match, the values are added to the existing contact: 200, `merged`.\n- Otherwise a new contact is created: 201, `created`. If it may be a duplicate, it also waits in Review duplicates: 201, `needs_review`.\n\nContactZapp saves the contact in one two-way account: the first one the user linked that keeps an address book and is not paused. The next sync copies it to the user's other two-way accounts, never to a read-only one.\n\nA create is never refused for the plan's contact limit. Over the limit, the contact is created frozen and `contact.frozen` is true. ContactZapp keeps a frozen contact but does not sync it until the user upgrades or frees a place.\n\nSend an `Idempotency-Key` header to make a retry safe.","inputs":[{"name":"Idempotency-Key","type":"string","required":false,"description":"Any string of 1 to 255 bytes you choose for this write, such as a UUID. Repeat the request with the same key and body within 24 hours, and you get the first result back and nothing is written twice.…"},{"name":"body","type":"object","required":true,"description":"The body of a contact create or update: the contact fields a read shows that a write can change, under the same names and in the same shapes, and nothing else.\n\nA field the body carries that is not o…"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":489},{"name":"contact_read","title":"Contact – Read","description":"Returns one contact. `id` is the contact's `id` or its `publicId`, such as `CS-0042`. A deleted or merged contact is a 404, and so is another user's contact.","inputs":[{"name":"id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":60},{"name":"contact_change","title":"Contact – Change","description":"Changes a contact, as editing it in ContactZapp does. Only the fields you send change. A field you leave out keeps its value.\n\nThe change goes to every two-way account the contact is in, never to a read-only one. History records it as the user's change and names the API key.\n\nA contact waiting in Review duplicates cannot be changed until the review is decided: 409, `contact_pending_review`. Send an `Idempotency-Key` header to make a retry safe.","inputs":[{"name":"Idempotency-Key","type":"string","required":false,"description":"Any string of 1 to 255 bytes you choose for this write, such as a UUID. Repeat the request with the same key and body within 24 hours, and you get the first result back and nothing is written twice.…"},{"name":"body","type":"object","required":true,"description":"The body of a contact create or update: the contact fields a read shows that a write can change, under the same names and in the same shapes, and nothing else.\n\nA field the body carries that is not o…"},{"name":"id","type":"string","required":true,"description":"The contact's `id` or its `publicId` (`CS-0042`)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":417},{"name":"sync_start","title":"Sync – Start","description":"Starts a sync, the same as Sync now in ContactZapp. History shows it as a manual run. The answer is 202 with the sync's state, `queued` or `running`. If a sync is already going, you get that one back and no second one starts.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":66},{"name":"event_list","title":"Event – List","description":"Lists the events of one type, newest first. Zapier, Make and n8n poll this to start an automation.\n\nEach item's `id` never changes. Poll again and the items you already have come back with the same ids, with new ones on top. Skip the ids you have seen.\n\n- `contact.created`, `contact.updated`, `contacts.merged` and `account.needs_attention` come from History, and are kept as long as History keeps them.\n- `match.needs_review` lists each contact flagged as a possible duplicate and not yet merged. Its `id` changes when the flag is raised again.\n\nEach item carries what an automation needs, with no second call:\n\n- the contact's fields, or null once the contact is deleted or merged\n- for a merge, the ids of the contacts it absorbed\n- for an account, the account and why it needs attention","inputs":[{"name":"cursor","type":"string","required":false,"description":"The previous page's `nextCursor`, to read further back."},{"name":"event","type":"string","required":true,"description":"The events the API reports, as polling triggers.\n\n- `contact.created`: a contact was added.\n- `contact.updated`: a contact was changed.\n- `contacts.merged`: contacts were merged into one.\n- `match.ne…"},{"name":"limit","type":"integer","required":false,"description":"Page size; 50 when omitted."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":311}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T02:11:01.000Z","track":"remote","endpoint":"https://app.contactz.app/api/v1/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=contactz.app","issuer":"CN=WE1,O=Google Trust Services,C=US","notBefore":"2026-10-30T10:25:32Z","notAfter":"2027-01-28T11:23:58Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=WE1,O=Google Trust Services,C=US","issuer":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","notBefore":"2023-12-13T09:00:00Z","notAfter":"2029-02-20T14:00:00Z","keyType":"ECDSA","keyBits":256,"isCa":true},{"subject":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","issuer":"CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE","notBefore":"2023-11-15T03:43:21Z","notAfter":"2028-01-28T00:00:42Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"app.contactz.app.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"app.","outcome":"verified","label":"Verified"},{"zone":"contactz.app.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"none","label":"No authorisation required","gate":null,"gateLabel":null,"status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"https_enforced","label":"HTTPS enforced","status":301},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-11-03","recent":[{"id":"chg_01a1a979-4b6c-7cef-914d-05cb39c08eed","kind":"server.version_changed","summary":"Server version (2.0.0 → 2.0.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp#chg-chg_01a1a979-4b6c-7cef-914d-05cb39c08eed"},{"id":"chg_01a1a453-8005-7316-98b8-8f5a38e5e617","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp#chg-chg_01a1a453-8005-7316-98b8-8f5a38e5e617"},{"id":"chg_01a1a336-5192-7a82-9de3-2013d97ff22c","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp#chg-chg_01a1a336-5192-7a82-9de3-2013d97ff22c"},{"id":"chg_01a1a1ec-bb85-755a-aefb-f1a3af8c1a2b","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp#chg-chg_01a1a1ec-bb85-755a-aefb-f1a3af8c1a2b"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp","markdown":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.md","changelogJson":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.xml","external":[{"label":"Remote endpoint","href":"https://app.contactz.app/api/v1/mcp"},{"label":"Authorisation metadata","href":"https://app.contactz.app/.well-known/oauth-protected-resource/api/v1/mcp"},{"label":"Website","href":"https://contactz.app/developers"}]}}