A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API
Zooza is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
What it does
MCP server for Zooza — class scheduling, attendance, and booking for activity businesses.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http zooza-mcp https://mcp.zooza.app/mcp
# 2 — ask your agent for something these tools do
# get_terminology, whoami, classes_find_courses and 15 more
Zooza costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http zooza-mcp https://mcp.zooza.app/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
18 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Search the Zooza domain glossary. Returns canonical term names, definitions, cross-language synonyms, disambiguation rules, and AI guidance notes. No Zooza API call is made — purely local lookup against the compiled glossary. Use this to resolve ambiguous user input before calling operational tools. Examples: query="hodina" → Session; query="kurz", language="sk" → Programme; category="product-hier
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | no | Term, synonym, or keyword to look up. Matched against canonical_en, synonyms, deprecated terms, and intent_keywords (all languages). Case-insensitive substring match. |
| language | string | no | Restrict intent_keyword matching to this language. Also highlights translations for the given language in the response. |
| category | string | no | Filter by glossary category. |
Returns the connected user's identity, the companies they can operate on, regional context, and the session's token state. Call ONCE at the start of every conversation. How to interpret the response: - 'status: "ok"' — authenticated, at least one company available. Pick a 'company_id' from 'companies' for follow-up calls (ask the user if more than one exists). - 'status: "no_companies"' — authen
No parameter schema on file.
Search the company's courses by name (substring match) and optionally by registration_type. Returns a slim list of matches — {id, name, registration_type, target_audience, price, schedules_count, ...} — enough to disambiguate, not enough to act. Use this whenever the user names a course in natural language; never demand a raw course_id. Archived courses are excluded by default (pass `include_arc
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| name | string | no | Substring match on the programme (course) name, e.g. "Ballet". Matches any programme whose name contains this text. |
| registration_type | string | no | Registration model. 'single' = drop-in / per-session booking (customer books one event at a time). 'full2' = full-course enrollment (customer signs up for the entire course at once). 'open' = open-end |
| include_archived | boolean | no | Default false → archived programmes are excluded. Set true to also include archived (retired) programmes. |
| page | integer | no | 0-based page index (default 0). |
| page_size | integer | no | Number of results per page (max 200). |
Resolve a NAME the operator said into an id, for four kinds of company-level records. Pick kind: - place — venues. Returns {id, name, city, street, rooms: [{id, name, capacity}]}. Rooms are inlined because picking a venue is usually followed by picking a room. Filters: name, city. - billing_period — term blocks (e.g. "Autumn 2026"). Returns {id, name, active, period_start, period_end};
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| kind | string | yes | Which kind of record to resolve. 'place' = venue, 'billing_period' = term block, 'trainer' = team member, 'trainer_rate_type' = named pay rate. |
| name | string | no | Substring match on the record's name. Applies to every kind. |
| city | string | no | kind=place only. |
| place_id | integer | no | kind=trainer only — narrow to trainers associated with this venue. |
| course_id | integer | no | kind=trainer only — narrow to trainers associated with this programme. |
| include_inactive | boolean | no | kind=trainer or billing_period. Default false — include former staff / deactivated periods. |
| page | integer | no | kind=place or trainer. Default 0. |
| page_size | integer | no | kind=place or trainer. Default 25, max 200. billing_period and trainer_rate_type are small bounded sets and are returned in full. |
Search this company's CLASSES — the scheduled groups inside a programme (a "class" / "group" / "skupina"; internally a *schedule*) — by name (substring) and resolve them to a schedule_id. Reach for this whenever the user names a specific group rather than a whole programme ("the Nejaké class", "the Monday 5pm group", "her Wednesday ballet class"), or whenever a downstream tool needs a `schedule_
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| name | string | no | Substring match on the class (schedule) name, e.g. "Nejaké". Case- and accent-insensitive (DB collation utf8mb4_unicode_ci) — "nejake" matches "Nejaké", so you need not reproduce diacritics. |
| course_id | integer | no | Only classes inside this programme. Resolve the course_id first with classes_find_courses; never guess it. |
| trainer_id | integer | no | Only classes this trainer is assigned to. Resolve with classes_find_resource (kind:'trainer'). |
| place_id | integer | no | Only classes at this venue. Resolve with classes_find_resource (kind:'place'). |
| billing_period_id | no | Only classes in this billing period (term block) — or these. Resolve via classes_find_resource kind:'billing_period'. | |
| day | integer | no | Day-of-week the class falls on (its start day): 1=Sunday, 2=Monday, … 7=Saturday (MySQL DAYOFWEEK convention). |
| registration_type | string | no | Filter by the parent course's registration model: 'single' = drop-in / per-session, 'full2' = full-course enrollment, 'open' = open-ended / membership. |
| in_trial | boolean | no | Set true to return only classes that currently have a TRIAL enabled (the schedule in_trial flag). Omit to include all classes regardless of trial. |
| active_only | boolean | no | Set true to exclude classes whose schedule has already ENDED (keeps not-yet-started and in-progress classes). Omit to include ended classes too. |
| lead_only | boolean | no | Set true to return only LEAD-COLLECTION schedules (schedule_type='lead_collection' — the lead pipelines that bookings_add_lead attaches leads to). Every row also carries schedule_type, so you can tell |
| with_sessions | boolean | no | Set true to return only classes that HAVE at least one session (schedule total_events > 0). Use this for "classes that actually have sessions" instead of scanning sessions_find_events. |
| sort | string | no | Result ordering. created_desc = newest class first (the default), created_asc = oldest first, date_asc/date_desc by schedule start date, name_asc alphabetical, registrations_desc most-enrolled first. |
| include_archived | boolean | no | Default false → returns active + paused (inactive) classes. Set true to search ARCHIVED (retired) classes instead. |
| page | integer | no | 0-based page index (default 0). |
| page_size | integer | no | Number of results per page (max 200). |
Find this company's bookings — a client's enrolment in a class (registration; "prihláška"/"Buchung") — and resolve them to a registration_id, or a client to a user_id. Use for "is X enrolled?", "who's in this class?", "who hasn't paid?" (set payment_status:["unpaid","partially_paid"]), and "find client X". Filter by search (loose: name/email/phone) or name, by course_id/schedule_id (
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| search | string | no | Broad freetext: matches the enrolled person's or account holder's name, email, phone, or id (substring, accent-insensitive). Best for a loose term. Use name instead to match only the enrolled person |
| name | string | no | Enrolled person's name (substring, accent-insensitive). Blank for a kids' class? Try search (matches the parent too). |
| course_id | integer | no | Bookings in this programme. Resolve the id with classes_find_courses; never guess it. |
| schedule_id | integer | no | Bookings in this class (schedule). Resolve the id with classes_find_classes; never guess it. |
| billing_period_id | integer | no | Bookings in this billing period (term/season). Resolve via classes_find_resource (kind:'billing_period'); one period per call. |
| place_id | integer | no | Bookings at this venue. Resolve via classes_find_resource (kind:'place'). |
| user_id | integer | no | All bookings of one client, by their user id. |
| registration_id | integer | no | ONE exact booking by id, whatever its status (unlike search, which substring-matches: 45 also hits 145). |
| status | array | no | Enrolment statuses to include (piped to the api). Omit → confirmed enrolments only (registered, late, trial_*); guest, waitlist, canceled and deleted are excluded — pass them to widen. `auto_unenrolle |
| payment_status | array | no | Payment state — the "who hasn't paid" lever, e.g. ["unpaid","partially_paid"]. |
| distinct | boolean | no | true → one row per CLIENT (deduped by account-holder user_id), person fields only — use to find a person or resolve a name to a single user_id. Default false → one row per booking. |
| inactive_only | boolean | no | true → ONLY clients marked inactive (former clients). Default already includes them; never set it to widen. |
| include_extra_fields | boolean | no | true → each booking gets extra_fields: [{field, label, value}]: filled custom booking-form answers, labelled per programme. Not with distinct. |
| created_from | string | no | Only bookings CREATED on/after this date (YYYY-MM-DD, inclusive). The "new registrations" lever — e.g. created_from=<Monday> for this week's sign-ups. You supply the literal date; the api does no rela |
| created_to | string | no | Only bookings CREATED on/before this date (YYYY-MM-DD, inclusive). Pair with created_from for a window. |
| page | integer | no | 0-based page index (default 0). |
| page_size | integer | no | Number of results per page (max 200). |
List events (scheduled sessions of classes) in the caller's company. Use this whenever you need to resolve an event_id from natural language ("my next class," "Monday's ballet," "all swim sessions this week," "Sarah's classes tomorrow") before chaining into another tool like sessions_get_attendance or sessions_mark_attendance. With no filters at all, returns the company's upcoming sc
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| ids | array | no | Specific event (session) ids to fetch. Bypasses the upcoming/scheduled defaults so the requested rows come back as-is. |
| from | string | no | YYYY-MM-DD, inclusive lower bound on event date. To see PAST sessions, set this (e.g. from a schedule's start) — there is no past flag; past + future is simply an unbounded-below range. |
| to | string | no | YYYY-MM-DD, inclusive upper bound on event date. |
| date | string | no | YYYY-MM-DD, exact-day match. |
| status | string | no | Event lifecycle status. Default "scheduled" (matches dashboard; attendance can only be tracked on scheduled events). "unplanned" covers cancelled events. "any" expands to (scheduled, unplanned). |
| type | string | no | Event-shape filter. "cancelled" surfaces events explicitly cancelled (server-side maps to status=unplanned). Other values target dashboard cases: oversold, undersold, ad-hoc replacements, etc. |
| schedule_id | integer | no | Restrict to sessions belonging to one class. Resolve with classes_find_classes. |
| course_id | no | Restrict to sessions of one or more programmes (courses). Resolve with classes_find_courses. | |
| trainer_id | no | Restrict to sessions an instructor is connected to (one or more). Resolve: classes_find_resource kind:trainer. See the trainer filter note above — this matches across five trainer relationships. | |
| place_id | no | Restrict to sessions at one or more venues (places). Resolve: classes_find_resource kind:place. | |
| room_id | no | Restrict to sessions held in one or more specific rooms within a venue. | |
| segment_id | array | no | Schedule-segment id(s). Pass [0] to match events with NO segment assignment (sentinel). |
| billing_period_id | no | Restrict to sessions in one or more billing periods (term blocks). Resolve: classes_find_resource kind:billing_period. | |
| sort | string | no | Result ordering. date_asc/date_desc sort by session date; event_no_asc/event_no_desc by event number; created_asc/created_desc by record creation time. Default date_asc. |
| page | integer | no | 0-based page index (default 0). |
| page_size | integer | no | Number of results per page (max 200). |
Read who's enrolled in one event (a single session of a class) and their current attendance, so you can show the list and then mark it. Pass an event_id; the tool returns each enrolled attendee, their current attendance value (if already marked), and per-row context the LLM needs to mark attendance correctly: allowed_statuses[] (the statuses the current caller is permitted to set for T
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| event_id | integer | yes | Target event id (one session of a class). Required. |
Record per-attendee attendance for one event (a single session of a class — e.g. "Monday Ballet on 2026-06-03 at 09:00"). Pass an event_id and a list of attendees, each with their own attendance value (attended, noshow, canceled, going, ignore). Each value is set on that one attendee for that one event, never on the event as a whole. The tool writes each attendee individually a
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| event_id | integer | yes | Target event id (one session of a class). Required. |
| attendees | array | yes | Per-attendee marks. At least one item required. Each item targets ONE attendee on the event by registration_id; the attendance value is set per attendee, not on the event as a whole. |
Edit one or more existing classes (a "class"/"timetable" is the recurring group within a programme) — name, price, registration fee, capacity, make-up/replacement extra capacity ("počet miest navyše pre náhradné hodiny" → extra_capacity/extra_capacity_usage, NOT registrations_cap, which caps the NUMBER OF REGISTRATIONS), registration-count cap, billing period, online-registration, trial lessons, s
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| token | string | no | Omit on the FIRST call — that call previews the change and returns a token. Pass the token back on the SECOND call to apply the previewed change. Single-use, expires in 15 minutes; if it is expired or |
| confirmed | boolean | no | Required (true) on the apply call, alongside token. Asserts that you have SHOWN the user the preview from the first call and they approved it — not that you believe the change is correct. If the use |
| schedule_ids | array | no | Required on the FIRST call. One or many class (schedule) ids. Resolve by name with classes_find_classes. |
| changes | object | no | Required on the FIRST call. The fields to change — at least one. |
| session_scope | string | no | REQUIRED when changing instructor/venue/duration. 'upcoming' = the class + its future sessions (usual); 'all' = every session; 'class_only' = re-advertise the class only, existing sessions keep their |
| confirm_course_change | boolean | no | REQUIRED true to change changes.course_id — reprogramming a class rewrites ALL its sessions AND all registrations (irreversible). Only set after the operator explicitly asked to move the class to a di |
Edit specific individual sessions (events) of a class, OR add new sessions to a class. Two modes, one tool. NOT for a change that holds from a date onward or for every session ("from next week Jana teaches the Monday class", "the class moves to Room B") — that is ONE classes_update call with session_scope ('upcoming' or 'all'), never a per-session edit of each date. EDIT-MODE — pass event_ids
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| token | string | no | Omit on the FIRST call — that call previews the change and returns a token. Pass the token back on the SECOND call to apply the previewed change. Single-use, expires in 15 minutes; if it is expired or |
| confirmed | boolean | no | Required (true) on the apply call, alongside token. Asserts that you have SHOWN the user the preview from the first call and they approved it — not that you believe the change is correct. If the use |
| event_ids | array | no | EDIT-MODE. Session ids to change, with changes; resolve via sessions_find_events. Not with schedule_id/sessions. |
| changes | object | no | EDIT-MODE. The edits to apply to event_ids. |
| schedule_id | integer | no | ADD-MODE. Class to append NEW sessions to; pair with sessions. Resolve with classes_find_classes. Not with event_ids/changes. |
| sessions | array | no | ADD-MODE. New sessions on schedule_id; each needs a date, time/duration default from the class. "One more at the end": the date after the last session (sessions_find_events). |
| notify | boolean | no | Default false. true emails enrolled clients — confirm with the operator first. Set on the FIRST call (frozen into the plan). |
Cancel one or more scheduled SESSIONS of a class so they do not take place — "cancel Tuesday's sessions", "the pool is closed on Friday", "Martina is ill all week, cancel her classes". A cancelled session stays visible in Zooza with a cancelled status; it is NOT deleted. Scope the call to exactly ONE entity: event_ids, a single date, a single trainer_id with from/to, a single `schedule_
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| token | string | no | Omit on the FIRST call — that call previews the change and returns a token. Pass the token back on the SECOND call to apply the previewed change. Single-use, expires in 15 minutes; if it is expired or |
| confirmed | boolean | no | Required (true) on the apply call, alongside token. Asserts that you have SHOWN the user the preview from the first call and they approved it — not that you believe the change is correct. If the use |
| event_ids | array | no | SCOPE. Exact sessions, at most 7 days apart. Resolve with sessions_find_events. The only scope that may cross classes and instructors. |
| date | string | no | SCOPE. One whole day, YYYY-MM-DD, company-wide unless place_id narrows it. |
| trainer_id | integer | no | SCOPE. ONE instructor, with from/to. Resolve with classes_find_resource kind:'trainer'. |
| schedule_id | integer | no | SCOPE. ONE class, with from/to. Resolve with classes_find_classes. |
| place_id | integer | no | SCOPE. ONE venue, with date. Resolve with classes_find_resource kind:'place'. |
| from | string | no | Inclusive range start, YYYY-MM-DD. Only with trainer_id or schedule_id. |
| to | string | no | Inclusive range end, YYYY-MM-DD. |
| reason | string | no | REQUIRED. Internal, staff-only; Zooza cannot clear it later. The operator's stated reason — ask, never invent. |
| public_reason | string | no | Client-facing email text. Required when notify is true. |
| notify | boolean | no | Default false. Set it on the FIRST call; it is frozen into the plan. |
| include_past | boolean | no | Default false — past sessions are skipped and reported. |
| replacement_date | string | no | Make-up session date, "YYYY-MM-DD HH:MM:SS" — time defaults to the cancelled session's own. One session in scope only. |
| replacement_place_id | integer | no | Make-up venue. Defaults to the cancelled session's. |
| replacement_room_id | integer | no | Make-up room; needs replacement_place_id. 0 = no room. |
Copy or move a client's existing booking into a different class. COPY creates a second booking and leaves the original in place — use it when the client is continuing into a new term or adding a class alongside their current one. MOVE relocates the booking itself, carrying its payment history and debt, and the client is no longer in the old class — use it when they are switching. TWO CALLS. First
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| token | string | no | Omit on the FIRST call — that call previews the change and returns a token. Pass the token back on the SECOND call to apply the previewed change. Single-use, expires in 15 minutes; if it is expired or |
| confirmed | boolean | no | Required (true) on the apply call, alongside token. Asserts that you have SHOWN the user the preview from the first call and they approved it — not that you believe the change is correct. If the use |
| registration_id | integer | no | Required on the FIRST call. The existing booking. Resolve with bookings_find. |
| target_schedule_id | integer | no | Required on the FIRST call. The class it goes into. Resolve with classes_find_classes. |
| action | string | no | Required on the FIRST call. See the tool description for which to pick. |
| payments | string | no | Required on the FIRST call — NO default, ask the operator. from_target_class = price it by the target class. do_not_change = on copy, no payments on the new booking; on move, leave existing payments u |
| status | string | no | Omit to use what Zooza computes for the target class (usual choice). |
| start | string | no | Enrolment start, YYYY-MM-DD. Default today. Affects price and session count. |
| target_event_id | integer | no | One-off (single-session) programmes only. Resolve with sessions_find_events. |
| send_confirmation | boolean | no | Default false. true emails the client — confirm intent with the operator first. |
Email clients of this company. Describe the audience (a course/programme, a class schedule, a specific booking, one client, a saved segment, an ad-hoc cohort, or course-level labels) and the content (an existing template type from comms_list_templates, or a custom subject + body which may use *|MERGE_VAR|* tags from comms_list_merge_vars). TWO CALLS. First WITHOUT token: sends NOTHING. Return
| Parameter | Type | Required | Notes |
|---|---|---|---|
| company_id | integer | no | Zooza company id to operate against. Optional: if the user has exactly one company, the server defaults to it — you can omit this field. With multiple companies, you MUST specify which; get the id lis |
| token | string | no | Omit on the FIRST call — that call previews the change and returns a token. Pass the token back on the SECOND call to apply the previewed change. Single-use, expires in 15 minutes; if it is expired or |
| confirmed | boolean | no | Required (true) on the apply call, alongside token. Asserts that you have SHOWN the user the preview from the first call and they approved it — not that you believe the change is correct. If the use |
| confirm_large_send | boolean | no | Different from confirmed. Set true ONLY on the follow-up call after a send came back requires_second_confirmation: true AND the operator explicitly approved the recipient COUNT. Never set it on the |
| channel | string | no | Only 'email' is implemented. WhatsApp is specced and coming — do not promise it yet. |
| audience | object | no | Who receives the message. At least one targeting field is required. |
| content | object | no | EITHER template_type OR subject+body — not both. |
| marketing | boolean | no | REQUIRED on the FIRST call. true = promotional content (consent rules apply; say so to the operator). false = operational (schedule changes, payment reminders, session info). |
| schedule_at | object | no | Omit to send immediately on commit. |
| bcc | string | no | Comma-separated BCC addresses. |
Return the REAL, pre-aggregated numbers for ONE business question about an activity brand — and the basis for SHOWING it. This is how you show an operator a report / dashboard / chart of their business numbers (occupancy, unpaid, churn, attendance, trials, retention, revenue, "how are we doing", per programme / venue / instructor): call this, then COMPOSE a focused report as an ARTIFACT in the con
| Parameter | Type | Required | Notes |
|---|---|---|---|
| view | string | no | Question to pull data for. One of: occupancy, unpaid, churn, attendance, trials, retention, clients_by_location, replacements, summary. Default "summary". |
| from | string | no | First month YYYY-MM-01. Both from+to or neither (default: last 6 months). |
| to | string | no | Last month YYYY-MM-01. |
| company_id | integer | no | Resolved from the session when omitted. |
Returns the full markdown playbook for one of the registered skills. Call this BEFORE starting a flow named in the server's instructions — the playbook contains the interview steps, mapping rules, and confirmation pattern for that scenario. Available skills: business-model-validator, class-management, communication, feedback-nudge, negotiate-terminology, report-compose, report-discovery, report-pa
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact skill name from the available list. |
Returns the description and exact input schema of a Zooza tool, including tools not in your tool list (call_tool lists them). Call it once per tool before that tool's first call_tool.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Tool name, e.g. "todos_add". |
Runs a Zooza tool by name. Use it for every Zooza tool that is NOT in your tool list — these exist and work; never send the user to another app because a Zooza tool isn't listed. Call get_tool_schema(name) first for the arguments. Write tools behave exactly as when called directly: the first call previews and returns a token, the second (token + confirmed:true) applies. Tools reachable this way: -
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Tool name, e.g. "todos_add". |
| arguments | object | no | The tool's arguments, shaped as its get_tool_schema input_schema. Omit when it takes none. |
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Zooza or to call it, at any volume.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| get_terminology | no tags | |
| whoami | untrusted-input | untrusted-input: keyword "fetch" |
| classes_find_courses | no tags | |
| classes_find_resource | no tags | |
| classes_find_classes | no tags | |
| bookings_find | no tags | |
| sessions_find_events | no tags | |
| sessions_get_attendance | no tags | |
| sessions_mark_attendance | state-write | state-write: declares readOnlyHint: false |
| classes_update | state-write | state-write: declares readOnlyHint: false |
| sessions_update | state-write | state-write: declares readOnlyHint: false |
| sessions_cancel | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| bookings_copy_booking | state-write | state-write: declares readOnlyHint: false |
| comms_send_message | external-sink | external-sink: keyword "send_message", declares readOnlyHint: false, openWorldHint: true |
| reports_get_data | no tags | |
| get_skill | no tags | |
| get_tool_schema | no tags | |
| call_tool | state-write | state-write: declares readOnlyHint: false |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
Supply chain and provenance
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 0.2.0.
No release note was published with this version.
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Any signed-in account that does not publish Zooza can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.