// SCAN REPORT

ZulipChat MCP Server

67 tools. 31 can modify or destroy data without limits.

3 destructive tools with no built-in limits. Policy required.

Last updated: 28 Jun 2026

31 can modify or destroy data

36 read-only

67 tools total

Community server · catalogue entry verified 28/06/2026

How to control ZulipChat MCP Server ↓

TOOL MAP

What ZulipChat MCP Server exposes to your agents

Read (36) Write / Execute (28) Destructive / Financial (3)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous ZulipChat MCP Server tools

Destructive · High delete_scheduled_message Delete (cancel) a scheduled message Destructive · High remove_reaction Remove emoji reaction from message Destructive · High toggle_reaction Add or remove an emoji reaction. Execute · Medium construct_narrow Build a narrow filter for Zulip API.

31 of ZulipChat MCP Server's 67 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control ZulipChat MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and ZulipChat MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_scheduled_message": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_reaction": {
    "limits": [
      {
        "counter": "add_reaction_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "advanced_search": {
    "limits": [
      {
        "counter": "advanced_search_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register ZulipChat MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ZULIPCHAT →

Instant setup, no code required.

FULL CATALOGUE

All 67 ZulipChat MCP Server tools

DESTRUCTIVE 3 tools

Destructive delete_scheduled_message Delete (cancel) a scheduled message Destructive remove_reaction Remove emoji reaction from message Destructive toggle_reaction Add or remove an emoji reaction.

EXECUTE 2 tools

Execute construct_narrow Build a narrow filter for Zulip API. Execute execute_chain Execute a command chain workflow.

WRITE 26 tools

Write add_reaction Add emoji reaction to a message. Write agent_message Send a session-scoped message into the bound Zulip topic. Write close_agent_session Close a session binding and optionally announce the result. Write create_scheduled_message Create a scheduled message using Zulip Write cross_post_message Share a message across streams. Write edit_message Edit message content, topic, or move between streams. Write ensure_agent_session Create or refresh the Zulip topic binding for an agent session. Write manage_files List, delete, share, or download files. Write manage_message_flags Mark messages as read/unread or star/unstar. Write manage_scheduled_message Create, update, or delete a scheduled message. Write manage_task Start, update, or complete a task. Write manage_user_mute Mute or unmute a user. Write mark_all_as_read Mark all messages as read using modern narrow approach Write mark_messages_unread Mark messages as unread using flexible narrow construction Write mark_stream_as_read Mark all messages in a stream as read Write mark_topic_as_read Mark all messages in a topic as read Write register_agent Register or update a stable agent profile for Zulip control. Write register_events Register for real-time event streams. Write resolve_user Resolve display name to email with fuzzy matching. Write send_agent_status Send agent status update. Write send_message Send a message to a stream or user. Write switch_identity Switch between user and bot identities. Write update_message_flags_for_narrow Update message flags for a narrow (raw API). Write update_scheduled_message Update a scheduled message Write update_status Update your own status and emoji. Write upload_file Upload a file to Zulip.

READ 36 tools

Read advanced_search Multi-faceted search across messages, users, streams. Read agents_channel_topic_ops Topic operations in Agents-Channel (bot only). Read analyze_stream_with_llm Analyze stream data with LLM insights. Read analyze_team_activity_with_llm Analyze team activity across streams with LLM. Read check_messages_match_narrow Check if messages match a narrow filter. Read deregister_events Deregister an event queue. Read get_daily_summary Get daily message summary. Read get_events Poll events from a registered queue. Read get_message Retrieve a single message by ID. Read get_own_user Get current authenticated user Read get_presence Get presence info for all users. Read get_scheduled_messages Get all scheduled messages. Read get_stream_info Get detailed stream information. Read get_stream_topics List recent topics in a stream. Read get_streams List available streams/channels. Read get_user Look up a user by ID or email. Read get_user_by_email Get specific user by email Read get_user_by_id Get specific user by ID Read get_user_group_members Get members of a user group. Read get_user_groups Get all user groups. Read get_user_presence Get presence info for a specific user. Read get_user_status Get user Read get_users List all users in the organization. Read intelligent_report_generator Generate reports using LLM analysis. Read is_user_group_member Check if user is in a group. Read list_command_types List available command types. Read list_instances Compatibility alias for listing sessions. Read list_sessions List known agent sessions. Read mute_user Mute a user for your own notifications Read poll_agent_events Poll unacknowledged inbound session events. Read request_user_input Request a question or approval response from the owner in-topic. Read search_messages Search messages with filters for stream, topic, sender, time. Read server_info Get server version and capabilities. Read star_messages Star messages matching criteria Read unmute_user Unmute a user for your own notifications Read unstar_messages Unstar messages matching criteria

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about ZulipChat MCP Server

Can an AI agent delete data through the ZulipChat MCP Server MCP server? +

Yes. The ZulipChat MCP Server server exposes 3 destructive tools including delete_scheduled_message, remove_reaction, toggle_reaction. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through ZulipChat MCP Server? +

The ZulipChat MCP Server server has 26 write tools including add_reaction, agent_message, close_agent_session. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach ZulipChat MCP Server.

How many tools does the ZulipChat MCP Server MCP server expose? +

67 tools across 4 categories: Destructive, Execute, Read, Write. 36 are read-only. 31 can modify, create, or delete data.

How do I enforce a policy on ZulipChat MCP Server? +

Register the ZulipChat MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every ZulipChat MCP Server tool call.

Deterministic rules across all 67 ZulipChat MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ZULIPCHAT →

Instant setup, no code required.

67 ZulipChat MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.