Server

Zoom

Endpoint
https://mcp.zoom.us/mcp/zoom/streamable
Transport
Streamable HTTP
Access
Closed Connecting needs something not available by self-service: an existing contract, a tenant an admin must enable, a sales process or a private beta. A catalog of approved clients is not one: any account connects through a listed client. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · Needs a Zoom account with admin or developer authorizations, a manually created Marketplace app, product licenses, and a ZoomMate license for this server.
Auth
OAuth An OAuth 2.x authorization obtained through the server's authorization server. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · OAuth 2.0 authorization code with PKCE using a pre-registered app's client ID and secret; no DCR or CIMD.
Why it is listed
Listed because it appears in a public directory of MCP servers. Source
Homepage
https://zoom.us

Against MCP Authorization 2026-07-28current

  • Supported 11
  • Partial 1
  • Unsupported 4
  • Unknown 7

Passive scanGrade C · · Report

Contribute a correctionWithdraw this serverJSON

Older revisions of the matrix: 2025-11-25

MCP server features 13

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; resource: https://mcp.zoom.us/mcp/zoom/streamable
1 earlier observation
  1. Supported · Passive scan · scanner@0.2.0 · evidence
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; authorization_servers: [https://zoom.us]
1 earlier observation
  1. Supported · Passive scan · scanner@0.2.0 · evidence
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYSupportedPassive scan · scanner@0.3.0source— HTTP 200; scopes_supported: [docs:read:export, agentic_search:read:search, my_notes:read:content, meeting:update:in_meeting_controls, docs:write:import, cloud_recording:read:content, docs:read:list_file_collaborators, do…
2 earlier observations
  1. Supported · Passive scan · scanner@0.3.0 · evidence
  2. Supported · Passive scan · scanner@0.2.0 · evidence
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; found at the path-aware location
1 earlier observation
  1. Supported · Passive scan · scanner@0.2.0 · evidence
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 401; WWW-Authenticate resource_metadata: https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown no observationno observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnsupportedPassive scan · scanner@0.3.0source— HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable", no scope parameter
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDSupportedPassive scan · scanner@0.3.0source— HTTP 200; scopes_supported without offline_access: [docs:read:export, agentic_search:read:search, my_notes:read:content, meeting:update:in_meeting_controls, docs:write:import, cloud_recording:read:content, docs:read:list…
2 earlier observations
  1. Supported · Passive scan · scanner@0.3.0 · evidence
  2. Supported · Passive scan · scanner@0.2.0 · evidence
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTUnknown no observationno observation yet
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTPartialVendor claim · jbspeakr (documentation pass with Claude Code)source— "Once you have the access token, your MCP client must include it as a Bearer token in the Authorization header for all requests to the Zoom MCP server." (Docs require the Authorization header; they do not say whether tokens in the query string are rejected.)
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown no observationno observation yet

Authorization server features 10

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; issuer: https://zoom.us equals the issuer the PRM named
1 earlier observation
  1. Supported · Passive scan · scanner@0.2.0 · evidence
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; issuer: https://zoom.us
1 earlier observation
  1. Supported · Passive scan · scanner@0.2.0 · evidence
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDUnsupportedPassive scan · scanner@0.3.0source— HTTP 200; client_id_metadata_document_supported: absent
2 earlier observations
  1. Unsupported · Passive scan · scanner@0.2.0 · evidence
  2. Unsupported · Vendor claim · jbspeakr (documentation pass with Claude Code) · evidence
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYUnsupportedPassive scan · scanner@0.3.0source— HTTP 200; registration_endpoint: absent
3 earlier observations
  1. Unsupported · Passive scan · scanner@0.2.0 · evidence
  2. Unsupported · Vendor claim · jbspeakr (documentation pass with Claude Code) · evidence
  3. Unknown · Vendor claim · jbspeakr · evidence
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Zoom remote MCP servers require manual client registration. [...] Get from your Zoom app's configuration page on the Zoom App Marketplace." (Client developer creates an app in the Zoom App Marketplace, takes the OAuth Client ID and Client Secret from the app's Basic information page, and enters the MCP client's callback in the OAuth redirect URL field (examples given for Claude and ChatGPT).)
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnsupportedPassive scan · scanner@0.3.0source— HTTP 200; authorization_response_iss_parameter_supported: absent
1 earlier observation
  1. Unsupported · Passive scan · scanner@0.2.0 · evidence
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; code_challenge_methods_supported: [S256]
2 earlier observations
  1. Supported · Passive scan · scanner@0.2.0 · evidence
  2. Partial · Vendor claim · jbspeakr (documentation pass with Claude Code) · evidence
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTUnknown no observationno observation yet
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown no observationno observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTSupportedPassive scan · scanner@0.3.0source— HTTP 200; all 2 endpoints use https
1 earlier observation
  1. Supported · Passive scan · scanner@0.2.0 · evidence