# Zammad MCP by usefulapi (remote · zammad.usefulapi.io)

Search and read Zammad tickets, customers and organizations; add notes, replies and ticket updates.

- Trust score: 65/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-17

## Components

- remote · `zammad.usefulapi.io`: 65/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-zammad/zammad.md), [page](https://verifymcp.io/servers/io-usefulapi-zammad/zammad)

## Channel facts

- Endpoint: `https://zammad.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-17.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2280 tokens (~120/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Zammad MCP by usefulapi server?

Zammad MCP by usefulapi is a hosted endpoint at https://zammad.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-zammad 'https://zammad.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-zammad": {
      "url": "https://zammad.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-zammad": {
      "type": "http",
      "url": "https://zammad.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-zammad]
url = "https://zammad.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-zammad": {
      "type": "remote",
      "url": "https://zammad.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-zammad --url 'https://zammad.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-zammad:
    url: "https://zammad.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-zammad": {
      "Transport": "http",
      "Url": "https://zammad.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-zammad -t streamable-http -u 'https://zammad.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-zammad": {
      "type": "http",
      "url": "https://zammad.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-16 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-14 (score 64, +2)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional] The server now declares the “prompts” capability
- [functional] First check of Schema quality: 100
- [functional] New prompt “getting_started”
- [functional] Server version: 1.0.0 → 1.1.0

### 2026-10-13 (score 62, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-12 (score 61)

First indexed and scored.

## MCP tools (19)

### `zammad_get_me` (~51 tokens)

Get current user

The Zammad user this access token belongs to: id, name, e-mail, roles and groups. Use it to confirm the connection and the token's permissions. GET /api/v1/users/me.

### `zammad_search_tickets` (~189 tokens)

Search tickets

Search tickets with Zammad's query syntax. With Elasticsearch on the instance you can use fields, e.g. `state.name:open AND group.name:Sales`, `customer.email:"a@b.com"`, `title:invoice`, `number:20001`; a plain word searches ticket text. Replies carry ids plus names (group, state, priority, owner, customer). GET /api/v1/tickets/search?expand=true.

Input parameters:

- `order_by` (string): Sort direction (default: relevance).
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (default 25).
- `query` (string, required): Search query.
- `sort_by` (string): Field to sort by, e.g. updated_at or created_at.

### `zammad_list_tickets` (~102 tokens)

List tickets

List the tickets the token's user can see (an agent sees the tickets of their groups; a customer only their own). For anything targeted use zammad_search_tickets. GET /api/v1/tickets?expand=true.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (default 25).

### `zammad_get_ticket` (~83 tokens)

Get ticket

One ticket by its numeric id (not the ticket number): title, group, state, priority, owner, customer, organization, dates, escalation and article count. GET /api/v1/tickets/{id}?expand=true.

Input parameters:

- `ticket_id` (integer, required): Zammad ticket id (the number in the ticket URL, not the 5-digit ticket number).

### `zammad_list_ticket_articles` (~103 tokens)

List ticket articles

All articles (messages, internal notes, e-mails, phone notes) of one ticket in order, with sender, type, internal flag, from/to/cc, subject, body and attachment names (attachments are not downloaded). Long bodies are cut at 6000 characters; use zammad_get_ticket_article for the full text. GET /api/v1/ticket_articles/by_ticket/{ticket_id}.

Input parameters:

- `ticket_id` (integer, required): Zammad ticket id.

### `zammad_get_ticket_article` (~56 tokens)

Get ticket article

One article by its id with its full body, headers and attachment names. GET /api/v1/ticket_articles/{id}.

Input parameters:

- `article_id` (integer, required): Zammad article id (from zammad_list_ticket_articles).

### `zammad_list_ticket_tags` (~51 tokens)

List ticket tags

The tags on one ticket. GET /api/v1/tags?object=Ticket&o_id={ticket_id}. Needs an agent token.

Input parameters:

- `ticket_id` (integer, required): Zammad ticket id.

### `zammad_list_ticket_states` (~57 tokens)

List ticket states

The ticket states of the instance (new, open, pending reminder, pending close, closed, ...) with ids and whether they are active. Use the names in zammad_update_ticket. GET /api/v1/ticket_states.

### `zammad_list_ticket_priorities` (~56 tokens)

List ticket priorities

The ticket priorities of the instance (e.g. '1 low', '2 normal', '3 high') with ids. Use the names in zammad_update_ticket. GET /api/v1/ticket_priorities.

### `zammad_list_groups` (~102 tokens)

List groups

The ticket groups (queues) of the instance, with ids, names and agent ids. Zammad requires the admin.group permission for this list; with an agent-only token it returns an authorization error. GET /api/v1/groups.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (default 25).

### `zammad_search_users` (~114 tokens)

Search users

Search customers and agents by name, e-mail, login, phone or organization. Returns profile fields (no credentials). Needs an agent token. GET /api/v1/users/search?expand=true.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (default 25).
- `query` (string, required): Search text, e.g. an e-mail address or a name.

### `zammad_get_user` (~63 tokens)

Get user

One user (customer or agent) by id: name, e-mail, phone, organization, roles, VIP flag and notes. No credentials. GET /api/v1/users/{id}?expand=true.

Input parameters:

- `user_id` (integer, required): Zammad user id.

### `zammad_search_organizations` (~94 tokens)

Search organizations

Search customer organizations by name or domain. Needs an agent token. GET /api/v1/organizations/search.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (default 25).
- `query` (string, required): Search text, e.g. an organization name.

### `zammad_list_organizations` (~81 tokens)

List organizations

List customer organizations with domain, VIP flag and member ids. Needs an agent token. GET /api/v1/organizations.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (default 25).

### `zammad_get_organization` (~50 tokens)

Get organization

One organization by id: name, domain, notes, VIP flag, member ids. GET /api/v1/organizations/{id}.

Input parameters:

- `organization_id` (integer, required): Zammad organization id.

### `zammad_add_internal_note` (~118 tokens)

Add internal note

WRITE: add an INTERNAL note (visible to agents only, never e-mailed to the customer) to ONE ticket. Needs an agent's token (a customer's token is refused, because Zammad would make the note public). The ticket's other data is not changed. POST /api/v1/ticket_articles with type=note, internal=true.

Input parameters:

- `body` (string, required): Note text (plain text).
- `subject` (string): Optional note subject (one line).
- `ticket_id` (integer, required): Zammad ticket id.

### `zammad_reply_to_ticket` (~198 tokens)

Reply to ticket (e-mails the customer)

WRITE: send a customer-visible reply on ONE ticket. THIS E-MAILS A REAL PERSON: the reply is delivered by e-mail to exactly ONE recipient and cannot be recalled. By default the recipient is the ticket's customer (looked up from the ticket); `to` may name one other single address. No cc, no bulk, no attachments. Needs an agent's token (a customer's token is refused). For an internal remark use zammad_add_internal_note. GET /api/v1/tickets/{id}, then POST /api/v1/ticket_articles with type=email, internal=false.

Input parameters:

- `body` (string, required): Reply text (plain text).
- `subject` (string): Optional subject (one line). Default: 'Re: <ticket title>'.
- `ticket_id` (integer, required): Zammad ticket id.
- `to` (string): Optional: ONE recipient e-mail address. Default: the ticket customer's address.

### `zammad_update_ticket` (~246 tokens)

Update ticket

WRITE: change fields of ONE ticket: state, priority, owner (agent), group and/or title. Use names from zammad_list_ticket_states / zammad_list_ticket_priorities / zammad_list_groups. Pending states need `pending_time`. Never deletes, removes or merges (those states are refused). The instance's own triggers still run, so closing or reassigning a ticket can send the customer or agent a notification e-mail. PUT /api/v1/tickets/{id}.

Input parameters:

- `group` (string): Group name, e.g. Sales (subgroups as Sales::Europe).
- `owner_id` (integer): User id of the agent who should own the ticket. Id 1 is Zammad's 'no owner' placeholder.
- `pending_time` (string): Required for the pending states: when the ticket reminds or closes, ISO 8601 with a timezone.
- `priority` (string): Priority name, e.g. '3 high'.
- `state` (string): State name, e.g. open, closed, 'pending reminder'.
- `ticket_id` (integer, required): Zammad ticket id.
- `title` (string): New ticket title.

### `zammad_create_ticket` (~258 tokens)

Create ticket

WRITE: create ONE new ticket for an EXISTING customer (by e-mail address or user id) in a group, with a first article recorded as written by the customer (type note or phone). It does not send an e-mail by itself, but the instance's triggers may (for example an automatic confirmation to the customer). It never creates new users. POST /api/v1/tickets.

Input parameters:

- `article_type` (string): Type of the first article: note (default) or phone.
- `body` (string, required): First message of the ticket (plain text).
- `customer` (string): E-mail address of an existing customer. Give this or customer_id.
- `customer_id` (integer): User id of an existing customer. Give this or customer.
- `group` (string, required): Group name the ticket goes to, e.g. Users or Sales.
- `owner_id` (integer): User id of the agent who should own the ticket.
- `priority` (string): Initial priority name (default: 2 normal).
- `state` (string): Initial state name (default: new).
- `subject` (string): Subject of the first article (default: the title).
- `title` (string, required): Ticket title.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-zammad/zammad#diagnostics

## Score history

- 2026-10-17: 65
- 2026-10-16: 65
- 2026-10-15: 64
- 2026-10-14: 64
- 2026-10-13: 62
- 2026-10-12: 61

## Common questions

### What is the Zammad MCP by usefulapi server?

Zammad MCP by usefulapi is listed in the public MCP registry as io.usefulapi/zammad. Search and read Zammad tickets, customers and organizations; add notes, replies and ticket updates. This page covers its hosted endpoint (https://zammad.usefulapi.io/mcp).

### Is the Zammad MCP by usefulapi server safe to use?

Zammad MCP by usefulapi scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Zammad MCP by usefulapi server expose?

Zammad MCP by usefulapi exposes 19 tools: zammad_get_me, zammad_search_tickets, zammad_list_tickets, zammad_get_ticket, zammad_list_ticket_articles, and 14 more. Their descriptions and schemas cost roughly 2,072 tokens of context every time the server is loaded.

### Does the Zammad MCP by usefulapi server require authentication?

Yes. Zammad MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Zammad MCP by usefulapi server still maintained?

Zammad MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://zammad.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/zammad/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-zammad/zammad.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-zammad/zammad.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-zammad/zammad