Zola wedding planning for Claude — vendors, budget, guests, seating, registry, and RSVPs
Zola wedding planning for Claude — vendors, budget, guests, seating, registry, and RSVPs
This is an AI-developed MCP server for Zola wedding planning with a clear authentication model using JWT refresh tokens. The codebase shows good security practices overall—credentials are properly handled via environment variables, there is no evidence of malicious patterns or code injection vulnerabilities, and permissions align with its stated purpose. However, there are some code quality concerns around input validation, error handling consistency, and the reliance on undocumented/internal Zola APIs that could break. The explicit warning in the README about being AI-developed and not human-audited is appropriate. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.
5 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: ZOLA_REFRESH_TOKEN
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-chrischall-zola-mcp": {
"env": {
"ZOLA_REFRESH_TOKEN": "your-zola-refresh-token-here"
},
"args": [
"-y",
"zola-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
A Model Context Protocol server that connects Claude to Zola, giving you natural-language access to your wedding vendors, budget, guest list, seating chart, events, registry, inquiries, and more.
[!WARNING] AI-developed project. This codebase was entirely built and is actively maintained by Claude Code. No human has audited the implementation. Review all code and tool permissions before use.
Ask Claude things like:
By using this MCP server, you acknowledge and agree to the following:
1. This server accesses your own Zola account. Auth happens via your own credentials. It does not — and cannot — access anyone else's wedding website, registry, or guest list.
2. Zola's Terms of Use govern your use of this server, just as they govern your direct use of zola.com. The clauses most relevant here:
[You may not use] any hardware or software intended to surreptitiously intercept or otherwise obtain any information… including but not limited to the use of any "scraping" or other data mining techniques, robots or similar data gathering and extraction tools.
And, critically, on agent-acting-as-you: "You are responsible for maintaining the confidentiality of your account and password… You accept full responsibility for all activities that occur under your account and password, even if such actions are undertaken by your Authorized Agent or other third party."
You are agreeing to those terms — read by the maintainer 2026-05-23 — every time you invoke a tool in this server. Zola's ToU is explicit: this MCP acting as your Authorized Agent counts as you.
3. Personal, non-commercial use only. This project is not affiliated with, endorsed by, sponsored by, or in partnership with Zola, Inc. It is a personal automation tool for one couple to manage their own wedding website, registry, vendor research, and guest list. Do not use it to bulk-extract Zola's vendor directory, scrape registries, or compete with Zola.
4. Stability is not guaranteed. This server may call internal Zola endpoints that change without notice. It may break.
5. You accept full responsibility for any consequences of using this server in connection with your Zola account — rate limiting, account warnings, suspension, or any enforcement action. Per Zola's ToU, anything this MCP does under your account is your action — review guest list edits, registry changes, and inquiries before confirming. If Zola objects to your use, stop using this server.
This section is the maintainer's good-faith summary of the terms — it is not legal advice and does not modify or supersede Zola's actual ToU.
Download the latest .mcpb bundle from Releases and install:
claude mcp add-from-mcpb zola-mcp-x.y.z.mcpb
You'll be prompted for your ZOLA_REFRESH_TOKEN (see Getting your refresh token below).
npx -y zola-mcp
Add to your Claude config (.mcp.json or Claude Desktop config):
{
"mcpServers": {
"zola": {
"command": "npx",
"args": ["-y", "zola-mcp"],
"env": {
"ZOLA_REFRESH_TOKEN": "your-refresh-token-jwt"
}
}
}
}
git clone https://github.com/chrischall/zola-mcp.git
cd zola-mcp
npm install
npm run build
Add to Claude Desktop config:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"zola": {
"command": "node",
"args": ["/absolute/path/to/zola-mcp/dist/bundle.js"],
"env": {
"ZOLA_REFRESH_TOKEN": "your-refresh-token-jwt"
}
}
}
}
You have two options. Both produce the same usr cookie value — a ~1-year JWT that doubles as the refresh token.
.dmg).ZOLA_REFRESH_TOKEN unset in your Claude config.On the first tool call, the MCP asks the extension for the HttpOnly usr cookie via chrome.cookies.get, then operates direct-to-API from Node. No persistent storage of the token in any env file. To re-auth (e.g. after Zola signs you out), just sign back in to zola.com.
You can opt out of this fallback with ZOLA_DISABLE_FETCHPROXY=1 (e.g. in headless / CI environments where no extension is available).
https://www.zola.com.usr cookie..env as ZOLA_REFRESH_TOKEN=<value> (or into your Claude config env block).Quit completely (Cmd+Q on Mac) and relaunch.
Ask Claude: "How's wedding planning going?" — it should show your wedding dashboard.
| Env var | Required | Notes |
|---|---|---|
ZOLA_REFRESH_TOKEN | Conditional | Refresh token JWT (~1 year lifetime). When unset, the MCP falls back to the fetchproxy extension to read the usr cookie from your signed-in zola.com tab. |
ZOLA_DISABLE_FETCHPROXY | No | Set to 1 to opt out of the fetchproxy fallback (headless / CI). |
ZOLA_ACCOUNT_ID | No | Auto-resolved from API on first use |
ZOLA_REGISTRY_ID | No | Auto-resolved from API on first use |
27 tools across 8 domains. Read-only tools run automatically. Write tools ask for confirmation.
| Tool | What it does | Permission |
|---|---|---|
list_vendors | List all booked vendors | Auto |
search_vendors | Search vendors by name/category | Auto |
add_vendor | Book a new vendor | Confirm |
update_vendor | Update vendor details | Confirm |
remove_vendor | Unbook a vendor | Confirm |
| Tool | What it does | Permission |
|---|---|---|
get_budget | Budget summary with all items | Auto |
update_budget_item | Update cost or note | Confirm |
| Tool | What it does | Permission |
|---|---|---|
list_guests | List all guest groups with stats | Auto |
add_guest | Add a guest group | Confirm |
update_guest_address | Update mailing address | Confirm |
remove_guest | Remove a guest group | Confirm |
| Tool | What it does | Permission |
|---|---|---|
list_seating_charts | List seating charts | Auto |
get_seating_chart | Chart with tables/seats/occupants | Auto |
list_unseated_guests | Guests not yet seated | Auto |
assign_seat | Assign guest to a seat | Confirm |
| Tool | What it does | Permission |
|---|---|---|
list_inquiries | All vendor inquiries with status | Auto |
get_inquiry_conversation | Full conversation messages | Auto |
mark_inquiry_read | Mark as read | Confirm |
| Tool | What it does | Permission |
|---|---|---|
list_events | All events with RSVP counts | Auto |
track_rsvps | RSVP tracking per event | Auto |
update_event | Update event details | Confirm |
| Tool | What it does | Permission |
|---|---|---|
get_registry | Registry categories and items | Auto |
get_gift_tracker | Gifts received, thank-you status | Auto |
| Tool | What it does | Permission |
|---|---|---|
get_wedding_dashboard | Planning dashboard overview | Auto |
search_storefronts | Search marketplace by category/location | Auto |
get_storefront | Full vendor storefront details | Auto |
list_favorites | Favorited vendors | Auto |
"Zola auth: set ZOLA_REFRESH_TOKEN, or install the fetchproxy extension…" — either set ZOLA_REFRESH_TOKEN in your config or install the fetchproxy extension and sign into zola.com.
"Zola session refresh failed" — your refresh token has expired (~1 year) or been revoked. Either capture a new usr cookie (DevTools) or sign back into zola.com with the fetchproxy extension installed.
403 from mobile API — the x-zola-session-id header may be missing. Update to the latest version.
Tools not appearing in Claude — go to Claude Desktop → Settings → Developer to see connected servers. Make sure you fully quit and relaunched after editing the config.
.env or config file (when set) or in the user's browser cookie store (fetchproxy path)npm test # run the test suite (vitest)
npm run build # compile TypeScript → dist/
src/
client.ts Zola mobile API client (auth, token refresh, context)
index.ts MCP server entry point
tools/
vendors.ts list, search, add, update, remove vendors
budget.ts get budget, update budget items
guests.ts list, add, update, remove guests
seating.ts seating charts, seat assignment
inquiries.ts vendor inquiry conversations
events.ts events, RSVPs, gift tracker, registry
discover.ts dashboard, storefront search, favorites
tests/
client.test.ts
vendors.test.ts
budget.test.ts
guests.test.ts
seating.test.ts
inquiries.test.ts
events.test.ts
discover.test.ts
All tools use the Zola mobile API (mobile-api.zola.com) with Bearer JWT auth:
POST /v3/sessions/refresh with refresh token JWT → returns 30-min session tokenAuthorization: Bearer <session_token> + x-zola-session-id headerThe .mcpb bundle is built automatically by the Release workflow when a version tag is pushed. To build locally:
npm run build
npx @anthropic-ai/mcpb pack
This produces zola-mcp.mcpb using the configuration in manifest.json. The bundle includes the compiled dist/bundle.js and user config prompts for ZOLA_REFRESH_TOKEN.
Releases are automated via GitHub Actions:
.skill and .mcpb bundlesMIT
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.