Back to Browse

Zola MCP Server

Developer ToolsModerate6.0Local
Free

Zola wedding planning for Claude — vendors, budget, guests, seating, registry, and RSVPs

About

Zola wedding planning for Claude — vendors, budget, guests, seating, registry, and RSVPs

Security Report

6.0
Moderate6.0Moderate Risk

This is an AI-developed MCP server for Zola wedding planning with generally sound architecture and proper authentication patterns. The codebase demonstrates good security practices around token handling, input validation via Zod schemas, and careful credential redaction in error messages. However, there are moderate concerns around insufficient input validation on numeric IDs, potential for unintended data modification through overly permissive tool designs, and lack of rate-limiting on write operations. Permissions align well with the server's purpose of managing wedding data via Zola's API. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

4 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Zola refresh token JWT (~1 year lifetime). Optional — when unset, the MCP falls back to the fetchproxy 0.3.0 browser extension to read the `usr` cookie from your signed-in zola.com tab.Required

Environment variable: ZOLA_REFRESH_TOKEN

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-chrischall-zola-mcp": {
      "env": {
        "ZOLA_REFRESH_TOKEN": "your-zola-refresh-token-here"
      },
      "args": [
        "-y",
        "zola-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Zola MCP

CI npm license

A Model Context Protocol server that connects Claude to Zola, giving you natural-language access to your wedding vendors, budget, guest list, seating chart, events, registry, inquiries, and more.

[!WARNING] AI-developed project. This codebase was entirely built and is actively maintained by Claude Code. No human has audited the implementation. Review all code and tool permissions before use.

What you can do

Ask Claude things like:

  • "How's wedding planning going?"
  • "Find a photographer in Charlotte, NC"
  • "Update the venue cost to $25,000"
  • "Who hasn't RSVP'd yet?"
  • "Seat Jennifer at Table 1"
  • "Any new vendor messages?"
  • "Add my cousin Mike to the guest list"
  • "Show me the gift tracker"

Requirements

Acknowledgement of Terms

By using this MCP server, you acknowledge and agree to the following:

1. This server accesses your own Zola account. Auth happens via your own credentials. It does not — and cannot — access anyone else's wedding website, registry, or guest list.

2. Zola's Terms of Use govern your use of this server, just as they govern your direct use of zola.com. The clauses most relevant here:

[You may not use] any hardware or software intended to surreptitiously intercept or otherwise obtain any information… including but not limited to the use of any "scraping" or other data mining techniques, robots or similar data gathering and extraction tools.

And, critically, on agent-acting-as-you: "You are responsible for maintaining the confidentiality of your account and password… You accept full responsibility for all activities that occur under your account and password, even if such actions are undertaken by your Authorized Agent or other third party."

You are agreeing to those terms — read by the maintainer 2026-05-23 — every time you invoke a tool in this server. Zola's ToU is explicit: this MCP acting as your Authorized Agent counts as you.

3. Personal, non-commercial use only. This project is not affiliated with, endorsed by, sponsored by, or in partnership with Zola, Inc. It is a personal automation tool for one couple to manage their own wedding website, registry, vendor research, and guest list. Do not use it to bulk-extract Zola's vendor directory, scrape registries, or compete with Zola.

4. Stability is not guaranteed. This server may call internal Zola endpoints that change without notice. It may break.

5. You accept full responsibility for any consequences of using this server in connection with your Zola account — rate limiting, account warnings, suspension, or any enforcement action. Per Zola's ToU, anything this MCP does under your account is your action — review guest list edits, registry changes, and inquiries before confirming. If Zola objects to your use, stop using this server.

This section is the maintainer's good-faith summary of the terms — it is not legal advice and does not modify or supersede Zola's actual ToU.

Installation

Option A — MCPB (recommended)

Download the latest .mcpb bundle from Releases and install:

claude mcp add-from-mcpb zola-mcp-x.y.z.mcpb

You'll be prompted for your ZOLA_REFRESH_TOKEN (see Getting your refresh token below).

Option B — npm

npx -y zola-mcp

Add to your Claude config (.mcp.json or Claude Desktop config):

{
  "mcpServers": {
    "zola": {
      "command": "npx",
      "args": ["-y", "zola-mcp"],
      "env": {
        "ZOLA_REFRESH_TOKEN": "your-refresh-token-jwt"
      }
    }
  }
}

Option C — from source

git clone https://github.com/chrischall/zola-mcp.git
cd zola-mcp
npm install
npm run build

Add to Claude Desktop config:

  • Mac: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
{
  "mcpServers": {
    "zola": {
      "command": "node",
      "args": ["/absolute/path/to/zola-mcp/dist/bundle.js"],
      "env": {
        "ZOLA_REFRESH_TOKEN": "your-refresh-token-jwt"
      }
    }
  }
}

Getting your refresh token

You have two options. Both produce the same usr cookie value — a ~1-year JWT that doubles as the refresh token.

Option A — fetchproxy extension (recommended)
  1. Install the fetchproxy 0.3.0 extension (Chrome Web Store or Safari .dmg).
  2. Sign in at zola.com/account/login in that browser.
  3. Leave ZOLA_REFRESH_TOKEN unset in your Claude config.

On the first tool call, the MCP asks the extension for the HttpOnly usr cookie via chrome.cookies.get, then operates direct-to-API from Node. No persistent storage of the token in any env file. To re-auth (e.g. after Zola signs you out), just sign back in to zola.com.

You can opt out of this fallback with ZOLA_DISABLE_FETCHPROXY=1 (e.g. in headless / CI environments where no extension is available).

Option B — manual (DevTools)
  1. Sign in at zola.com/account/login in any browser.
  2. Open DevTools → ApplicationCookieshttps://www.zola.com.
  3. Copy the value of the usr cookie.
  4. Paste it into .env as ZOLA_REFRESH_TOKEN=<value> (or into your Claude config env block).

Restart Claude Desktop

Quit completely (Cmd+Q on Mac) and relaunch.

Verify

Ask Claude: "How's wedding planning going?" — it should show your wedding dashboard.

Credentials

Env varRequiredNotes
ZOLA_REFRESH_TOKENConditionalRefresh token JWT (~1 year lifetime). When unset, the MCP falls back to the fetchproxy extension to read the usr cookie from your signed-in zola.com tab.
ZOLA_DISABLE_FETCHPROXYNoSet to 1 to opt out of the fetchproxy fallback (headless / CI).
ZOLA_ACCOUNT_IDNoAuto-resolved from API on first use
ZOLA_REGISTRY_IDNoAuto-resolved from API on first use

Available tools

27 tools across 8 domains. Read-only tools run automatically. Write tools ask for confirmation.

Vendors

ToolWhat it doesPermission
list_vendorsList all booked vendorsAuto
search_vendorsSearch vendors by name/categoryAuto
add_vendorBook a new vendorConfirm
update_vendorUpdate vendor detailsConfirm
remove_vendorUnbook a vendorConfirm

Budget

ToolWhat it doesPermission
get_budgetBudget summary with all itemsAuto
update_budget_itemUpdate cost or noteConfirm

Guests

ToolWhat it doesPermission
list_guestsList all guest groups with statsAuto
add_guestAdd a guest groupConfirm
update_guest_addressUpdate mailing addressConfirm
remove_guestRemove a guest groupConfirm

Seating

ToolWhat it doesPermission
list_seating_chartsList seating chartsAuto
get_seating_chartChart with tables/seats/occupantsAuto
list_unseated_guestsGuests not yet seatedAuto
assign_seatAssign guest to a seatConfirm

Inquiries

ToolWhat it doesPermission
list_inquiriesAll vendor inquiries with statusAuto
get_inquiry_conversationFull conversation messagesAuto
mark_inquiry_readMark as readConfirm

Events & RSVPs

ToolWhat it doesPermission
list_eventsAll events with RSVP countsAuto
track_rsvpsRSVP tracking per eventAuto
update_eventUpdate event detailsConfirm

Registry & Gifts

ToolWhat it doesPermission
get_registryRegistry items with per-item purchase state (requested_qty, purchased_qty, marked_fulfilled, availability, inconsistent); paged via limit/offsetAuto
get_gift_trackerGifts received, thank-you statusAuto
reconcile_registryJoins the registry against the gift tracker: DUPLICATE_RISK (flagged fulfilled but nothing purchased — still buyable), UNATTRIBUTED (purchased with no order, so giver and value are lost), ORPHAN_ORDER, MATCHEDAuto

Discovery

ToolWhat it doesPermission
get_wedding_dashboardPlanning dashboard overviewAuto
search_storefrontsSearch marketplace by category/locationAuto
get_storefrontFull vendor storefront detailsAuto
list_favoritesFavorited vendorsAuto

Troubleshooting

"Zola auth: set ZOLA_REFRESH_TOKEN, or install the fetchproxy extension…" — either set ZOLA_REFRESH_TOKEN in your config or install the fetchproxy extension and sign into zola.com.

"Zola session refresh failed" — your refresh token has expired (~1 year) or been revoked. Either capture a new usr cookie (DevTools) or sign back into zola.com with the fetchproxy extension installed.

403 from mobile API — the x-zola-session-id header may be missing. Update to the latest version.

Tools not appearing in Claude — go to Claude Desktop → Settings → Developer to see connected servers. Make sure you fully quit and relaunched after editing the config.

Security

  • The refresh token lives only in your local .env or config file (when set) or in the user's browser cookie store (fetchproxy path)
  • It is passed as an environment variable and never logged
  • The server authenticates with Zola's mobile API using the same flow as the iOS app
  • Account and registry IDs are auto-resolved from the API (no manual configuration needed)

Development

npm test        # run the test suite (vitest)
npm run build   # compile TypeScript → dist/

Project structure

src/
  client.ts         Zola mobile API client (auth, token refresh, context)
  index.ts          MCP server entry point
  tools/
    vendors.ts      list, search, add, update, remove vendors
    budget.ts       get budget, update budget items
    guests.ts       list, add, update, remove guests
    seating.ts      seating charts, seat assignment
    inquiries.ts    vendor inquiry conversations
    events.ts       events, RSVPs, gift tracker, registry
    discover.ts     dashboard, storefront search, favorites
tests/
  client.test.ts
  vendors.test.ts
  budget.test.ts
  guests.test.ts
  seating.test.ts
  inquiries.test.ts
  events.test.ts
  discover.test.ts

Auth flow

All tools use the Zola mobile API (mobile-api.zola.com) with Bearer JWT auth:

  1. POST /v3/sessions/refresh with refresh token JWT → returns 30-min session token
  2. All API calls use Authorization: Bearer <session_token> + x-zola-session-id header
  3. On 401, auto-refreshes and retries once
  4. Session tokens are cached for their lifetime (30 min)

Building the MCPB bundle

The .mcpb bundle is built automatically by the Release workflow when a version tag is pushed. To build locally:

npm run build
npx @anthropic-ai/mcpb pack

This produces zola-mcp.mcpb using the configuration in manifest.json. The bundle includes the compiled dist/bundle.js and user config prompts for ZOLA_REFRESH_TOKEN.

Releasing

Releases are automated via GitHub Actions:

  1. Run the Cut & Bump workflow (manual trigger) — tags the current version and bumps patch
  2. The tag push triggers the Release workflow which:
    • Runs CI (build + test)
    • Packages .skill and .mcpb bundles
    • Publishes to npm
    • Creates a GitHub Release with the bundles

License

MIT

Reviews

No reviews yet

Be the first to review this server!

Zola MCP Server - Zola wedding planning for Claude — vendors, budget, guests, | MCP Marketplace