Zulip MCP

Team communication tools contain useful context and untrusted content. An AI tool needs topic awareness without treating messages as instructions or writing on a user's behalf by default.

Credentials must be redacted, writes must fail closed, inputs require schemas, and stream scope may need an explicit allowlist.

The TypeScript MCP server wraps the Zulip REST API with Zod-validated tools for streams, topics, messages, mentions, direct messages, summaries, digests, and draft-first communication.

Read tools and draft tools are distinct from write tools. Approval-gated sends fail closed, and all Zulip content remains untrusted through sanitization and prompt-injection guards.

Representative tools include list_streams, list_topics, get_topic_messages, search_messages, get_unread_mentions, get_unread_dms, summarize_topic, triage_mentions, draft_reply, daily_digest, compose_project_update, and approval-gated send and reaction tools.

The server supports credential redaction, optional stream allowlists, Zod validation, sanitization, injection guards, draft-first flows, and explicit approval gates.

Automated tests cover tool behavior and the safety boundary. The repository remains the source of truth for exact coverage.

The server provides topic-aware assistance without collapsing read, draft, and send into one opaque operation.

Use requires a configured Zulip workspace and credentials. Approval gates reduce risk but do not replace organizational access controls or human review.

Good AI tooling makes authority boundaries visible in the API surface itself.