// SCAN REPORT

Zola

75 tools. 36 can modify or destroy data without limits.

8 destructive tools with no built-in limits. Policy required.

Last updated: 29 Jun 2026

36 can modify or destroy data

39 read-only

75 tools total

Community server · catalogue entry verified 29/06/2026

How to control Zola ↓

TOOL MAP

What Zola exposes to your agents

Read (39) Write / Execute (28) Destructive / Financial (8)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Zola tools

Destructive · High remove_event_invitation Remove an event invitation for a single guest or guest group. Pass exactly one of guest_group_id (removes for all guests in the group) or gu Destructive · High remove_faq Remove an FAQ from the website Destructive · High remove_guest Remove a guest group from the guest list Destructive · High remove_home_section Remove a story section from the home page

36 of Zola's 75 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Zola

PolicyLayer is an MCP gateway — it sits between your AI agents and Zola, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "remove_event_invitation": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_faq": {
    "limits": [
      {
        "counter": "add_faq_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_budget": {
    "limits": [
      {
        "counter": "get_budget_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Zola — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ZOLA →

Instant setup, no code required.

FULL CATALOGUE

All 75 Zola tools

DESTRUCTIVE 8 tools

Destructive remove_event_invitation Remove an event invitation for a single guest or guest group. Pass exactly one of guest_group_id (removes for Destructive remove_faq Remove an FAQ from the website Destructive remove_guest Remove a guest group from the guest list Destructive remove_home_section Remove a story section from the home page Destructive remove_poi Remove a point-of-interest from the Things-to-Do page Destructive remove_registry_item Remove an item from the registry Destructive remove_travel_item Remove a travel item from the Travel page Destructive remove_vendor Unbook a vendor

WRITE 28 tools

Write add_faq Add a new FAQ (question + answer) to the website FAQ page Write add_guest Add a new guest group (household) to the guest list Write add_home_section Add a story section to the home page (title + subtitle + description block) Write add_poi Add a point-of-interest to the Things-to-Do page (restaurant, attraction, etc.) Write add_registry_item Add a product (by SKU) to the registry. If collection_id is omitted, the default collection is looked up autom Write add_travel_item Add a travel item (hotel, flight, train, car, bus) to the Travel page Write add_vendor Book a new vendor Write assign_seat Assign a guest to a specific seat in a seating chart Write create_card_project Create a new invitation project from a design suite and a lead variation (specific size/paper). Write invite_guest_to_event Invite a single guest or guest group to an event (additive — does not affect other events). Pass exactly one o Write mark_inquiry_read Mark a vendor inquiry conversation as read Write set_card_project_guests Enable / disable guest groups for an invitation project and optionally override font sizes for printed names a Write set_card_project_qrcode Place (or update) a QR code on a specific page of an invitation project. The page UUID comes from get_card_pro Write set_event_guests Set which guest groups are invited to an event (bulk). For each group, invited:true ensures every guest in the Write set_page_hidden Show or hide a page on the wedding website (e.g., hide the RSVP page until invites go out) Write update_budget_item Update a budget item Write update_current_theme Switch the wedding website to a different theme template Write update_event Update a wedding event (name, time, venue, location, dress code, RSVP settings) Write update_faq Update an existing FAQ — all three fields (question, answer, display_order) must be supplied Write update_guest_address Update a guest group Write update_home_section Update a home page story section — all fields must be supplied Write update_page Update page-level metadata (title, intro copy, nav title, visibility, layout customization) Write update_poi Update a point-of-interest. Provide only the fields you want to change. Write update_registry_item Update an existing registry item — all fields must be supplied (it Write update_travel_item Update a travel item. Provide only the fields you want to change. Write update_vendor Update a booked vendor\ Write update_website_customization Update website colors and fonts. Provide only what changes. Colors are 6-char hex without . Write update_wedding_settings Update top-level wedding settings. Provide only the fields you want to change; the rest are preserved.

READ 39 tools

Read get_budget Get the wedding budget summary including total budgeted, actual cost, paid, and all budget items Read get_card_project Get full details for one invitation project including all customizations (invitation, envelope, RSVP card, det Read get_card_project_guests List the guest groups assigned to an invitation project, including per-group font-size overrides for printed a Read get_card_suite Get details for an invitation design Read get_current_theme Get the currently-selected website theme: key, name, swatch color, layout type Read get_gift_tracker View gift tracking: total gifts received, values, thank-you note status Read get_inquiry_conversation Get full conversation for a vendor inquiry including messages and inquiry details Read get_registry View the wedding registry with categories and items Read get_rsvp_page Get the RSVP page settings on the wedding website (title, intro copy, visibility, customization). Read get_seating_chart Get full seating chart with all tables, seats, and current occupants Read get_storefront Get full details for a vendor storefront (pricing, reviews, photos, about, FAQs) Read get_website_customizations Get current website colors, font settings, and available font/color options Read get_wedding_dashboard Get the wedding planning dashboard overview (invites, paper, planning progress) Read get_wedding_settings Get top-level wedding settings: title, URL slug, partner names, date, city, hashtag, guest count, search visib Read list_card_projects List your invitation / save-the-date / shower-invite Read list_events List all wedding events (ceremony, reception, rehearsal dinner, etc.) with RSVP counts Read list_faqs List all FAQs on the wedding website Read list_favorite_card_suites List invitation design suites you have favorited (hearted). Read list_favorites List all favorited/saved vendors Read list_guests List all guest groups with stats (total, invited, missing addresses) Read list_home_sections List the story sections on the website home page Read list_inquiries List all vendor inquiries with status, vendor name, and unread flag Read list_pages List all wedding-website pages with their IDs, types, display order, visibility, and theme info Read list_pois List points-of-interest on the Read list_seating_charts List all seating charts with their UUID and event name Read list_travel_items List hotels, flights, and transportation on the website Travel page Read list_unseated_guests List all guests who have not yet been assigned a seat Read list_vendors List all booked vendors with details Read preview_card_template Render an invitation template preview with text substituted in. Use to see how a design would look with your c Read preview_qrcode Generate a QR-code PNG for an invitation. Returns the image so it can be inspected. Use set_card_project_qrcod Read reorder_pages Reorder pages in the website navigation. Pass the complete ordered list of page IDs. Read search_card_catalog Search the invitation design catalog. Faceted search returning suites matching the requested card type. Read search_registry_products Browse Zola products in a category, scoped to your registry. Category IDs are Zola constants (e.g. 544 = Kitch Read search_storefronts Search Zola vendor marketplace by category and location (1=Venues, 2=Photographers, 3=Florists, 7=Planners, 9= Read search_themes Browse the catalog of available wedding-website themes Read search_vendors Search for vendors by name (typeahead) within a vendor category Read swap_card_project_variation Swap one or more customizations on a project to different variations (e.g. switch paper type, color, or size). Read track_rsvps Get RSVP tracking summary per event (attending, declined, not responded) Read validate_card_project Validate an invitation project — reports any text-fit, image, or guest-addressing errors per customization. Us

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Zola

Can an AI agent delete data through the Zola MCP server? +

Yes. The Zola server exposes 8 destructive tools including remove_event_invitation, remove_faq, remove_guest. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Zola? +

The Zola server has 28 write tools including add_faq, add_guest, add_home_section. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Zola.

How many tools does the Zola MCP server expose? +

75 tools across 3 categories: Destructive, Read, Write. 39 are read-only. 36 can modify, create, or delete data.

How do I enforce a policy on Zola? +

Register the Zola MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Zola tool call.

Deterministic rules across all 75 Zola tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ZOLA →

Instant setup, no code required.

75 Zola tools catalogued and risk-classified — across an index of 43,000+ MCP servers.