# ContactZapp (remote · app.contactz.app)

Keeps your contacts in sync across Google, Microsoft, Apple and CardDAV, and cleans up duplicates.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `app.contactz.app`: 63/100 (this document), [markdown](https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.md), [page](https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp)

## Channel facts

- Endpoint: `https://app.contactz.app/api/v1/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.5`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (contact_change).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1569 tokens (~224/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 71% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the ContactZapp MCP server?

ContactZapp is a hosted endpoint at https://app.contactz.app/api/v1/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http app-contactz-contactzapp 'https://app.contactz.app/api/v1/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "app-contactz-contactzapp": {
      "url": "https://app.contactz.app/api/v1/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "app-contactz-contactzapp": {
      "type": "http",
      "url": "https://app.contactz.app/api/v1/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.app-contactz-contactzapp]
url = "https://app.contactz.app/api/v1/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-contactz-contactzapp": {
      "type": "remote",
      "url": "https://app.contactz.app/api/v1/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-contactz-contactzapp --url 'https://app.contactz.app/api/v1/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  app-contactz-contactzapp:
    url: "https://app.contactz.app/api/v1/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "app-contactz-contactzapp": {
      "Transport": "http",
      "Url": "https://app.contactz.app/api/v1/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add app-contactz-contactzapp -t streamable-http -u 'https://app.contactz.app/api/v1/mcp'
```

### Other

```json
{
  "mcpServers": {
    "app-contactz-contactzapp": {
      "type": "http",
      "url": "https://app.contactz.app/api/v1/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 63, 0)

- [functional] Server version: 2.0.0 → 2.0.1

### 2026-11-04 (score 63, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-11-03 (score 63)

First indexed and scored.

## MCP tools (7)

### `api_key_check` (~41 tokens)

API key – Check

Returns the user the key acts for, the user's plan and the key's scopes. Any live key can call it, so call it to test a key.

### `contact_find` (~185 tokens)

Contact – Find

Finds the user's contacts by email address, phone number or text. Give at most one of `email`, `phone` and `query`:

\- `email` finds the contacts with that address. Case does not matter.
\- `phone` finds the contacts with that number, however it is formatted.
\- `query` searches the way the Contacts screen's search does.
\- With none of them, every contact is listed, newest first.

Deleted and merged contacts are never returned. For the next page, send the `nextCursor` you got as `cursor`, with the same filter. The last page has no `nextCursor`.

Input parameters:

- `cursor` (string): The previous page's `nextCursor`.
- `email` (string)
- `limit` (integer): Page size; 50 when omitted.
- `phone` (string)
- `query` (string)

### `contact_create` (~489 tokens)

Contact – Create

Adds a contact. If the user already has this person, the values may go to that contact instead:

\- If the user's Auto-Merge level covers the match, the values are added to the existing contact: 200, `merged`.
\- Otherwise a new contact is created: 201, `created`. If it may be a duplicate, it also waits in Review duplicates: 201, `needs_review`.

ContactZapp saves the contact in one two-way account: the first one the user linked that keeps an address book and is not paused. The next sync copies it to the user's other two-way accounts, never to a read-only one.

A create is never refused for the plan's contact limit. Over the limit, the contact is created frozen and `contact.frozen` is true. ContactZapp keeps a frozen contact but does not sync it until the user upgrades or frees a place.

Send an `Idempotency-Key` header to make a retry safe.

Input parameters:

- `Idempotency-Key` (string): Any string of 1 to 255 bytes you choose for this write, such as a UUID. Repeat the request with the same key and body within 24 hours, and you get the first result back and nothing is written twice.…
- `body` (object, required): The body of a contact create or update: the contact fields a read shows that a write can change, under the same names and in the same shapes, and nothing else. A field the body carries that is not o…

### `contact_read` (~60 tokens)

Contact – Read

Returns one contact. `id` is the contact's `id` or its `publicId`, such as `CS-0042`. A deleted or merged contact is a 404, and so is another user's contact.

Input parameters:

- `id` (string, required)

### `contact_change` (~417 tokens)

Contact – Change

Changes a contact, as editing it in ContactZapp does. Only the fields you send change. A field you leave out keeps its value.

The change goes to every two-way account the contact is in, never to a read-only one. History records it as the user's change and names the API key.

A contact waiting in Review duplicates cannot be changed until the review is decided: 409, `contact_pending_review`. Send an `Idempotency-Key` header to make a retry safe.

Input parameters:

- `Idempotency-Key` (string): Any string of 1 to 255 bytes you choose for this write, such as a UUID. Repeat the request with the same key and body within 24 hours, and you get the first result back and nothing is written twice.…
- `body` (object, required): The body of a contact create or update: the contact fields a read shows that a write can change, under the same names and in the same shapes, and nothing else. A field the body carries that is not o…
- `id` (string, required): The contact's `id` or its `publicId` (`CS-0042`).

### `sync_start` (~66 tokens)

Sync – Start

Starts a sync, the same as Sync now in ContactZapp. History shows it as a manual run. The answer is 202 with the sync's state, `queued` or `running`. If a sync is already going, you get that one back and no second one starts.

### `event_list` (~311 tokens)

Event – List

Lists the events of one type, newest first. Zapier, Make and n8n poll this to start an automation.

Each item's `id` never changes. Poll again and the items you already have come back with the same ids, with new ones on top. Skip the ids you have seen.

\- `contact.created`, `contact.updated`, `contacts.merged` and `account.needs_attention` come from History, and are kept as long as History keeps them.
\- `match.needs_review` lists each contact flagged as a possible duplicate and not yet merged. Its `id` changes when the flag is raised again.

Each item carries what an automation needs, with no second call:

\- the contact's fields, or null once the contact is deleted or merged
\- for a merge, the ids of the contacts it absorbed
\- for an account, the account and why it needs attention

Input parameters:

- `cursor` (string): The previous page's `nextCursor`, to read further back.
- `event` (string, required): The events the API reports, as polling triggers. - `contact.created`: a contact was added. - `contact.updated`: a contact was changed. - `contacts.merged`: contacts were merged into one. - `match.ne…
- `limit` (integer): Page size; 50 when omitted.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp#diagnostics

## Score history

- 2026-11-05: 63
- 2026-11-04: 63
- 2026-11-03: 63

## Common questions

### What is the ContactZapp MCP server?

ContactZapp is an MCP server listed in the public MCP registry as app.contactz/contactzapp. Keeps your contacts in sync across Google, Microsoft, Apple and CardDAV, and cleans up duplicates. This page covers its hosted endpoint (https://app.contactz.app/api/v1/mcp).

### Is the ContactZapp MCP server safe to use?

ContactZapp scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the ContactZapp MCP server expose?

ContactZapp exposes 7 tools: api_key_check, contact_find, contact_create, contact_read, contact_change, and 2 more. Their descriptions and schemas cost roughly 1,569 tokens of context every time the server is loaded.

### Does the ContactZapp MCP server require authentication?

No. We connected to ContactZapp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the ContactZapp MCP server still maintained?

ContactZapp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the ContactZapp MCP server?

VerifyMCP ran 13 checks on ContactZapp, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://app.contactz.app/api/v1/mcp
- Authorisation metadata: https://app.contactz.app/.well-known/oauth-protected-resource/api/v1/mcp
- Website: https://contactz.app/developers
- Changelog RSS feed: https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp.json
- HTML version of this page: https://verifymcp.io/servers/app-contactz-contactzapp/api-v1-mcp