
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@zapier/mcp-integration
Advanced tools
SDK for using Model Context Protocol (MCP) servers in/as Zapier integrations
SDK for integrating with Model Context Protocol (MCP) servers, designed for use in Zapier integrations.
Install the package via npm:
npm install @zapier/mcp-integration
zcache
via https://admin.zapier.com/nexus/gargoyle/ for the CLI App: app_id
found in your .zapierapprc
file after running zapier register
.Here's a minimal example to get started:
Create a file called mcp.ts
:
export const mcp = new Proxy({
name: packageJson.name,
version: packageJson.version,
serverUrl: process.env.SERVER_URL,
transport: 'sse', // or 'streamable'
});
Use it to initialize your app in index.ts
:
import { Proxy } from '@zapier/mcp-integration';
import packageJson from '../package.json' with { type: 'json' };
import { mcp } from './mcp.js';
export default defineApp({
...mcp.defineApp(),
triggers: {
my_trigger: {
noun: 'Item',
display: {
label: 'New Item',
description: 'Triggers when a new item is available.',
},
operation: {
perform: async (z, bundle) => {
// Call MCP tool
return await mcp.callTool({
name: 'list_items',
arguments: {},
});
},
},
},
},
});
You can use @zapier/mcp-integration
in two ways:
In this mode, you use @zapier/mcp-integration
to handle authentication and all or most actions.
Create e.g. src/mcp.ts
with the following content:
import { Proxy } from '@zapier/mcp-integration';
import packageJson from '../package.json' with { type: 'json' };
export const mcp = new Proxy({
name: packageJson.name,
version: packageJson.version,
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
});
Update src/index.ts
to use the singleton:
import { mcp } from './mcp.js';
export default defineApp({
...mcp.app(),
// .. (your actions)
// If you need additional `beforeRequest` middleware:
// beforeRequest: [mcp.beforeRequest(), yourMiddleware],
});
In this mode, you handle authentication yourself, and use @zapier/mcp-integration
for some of the actions.
Create e.g. src/mcp.ts
with the following content:
import { Proxy } from '@zapier/mcp-integration';
import packageJson from '../package.json' with { type: 'json' };
export const mcp = new Proxy({
name: packageJson.name,
version: packageJson.version,
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
auth: {
type: 'oauth',
},
});
Update src/index.ts
to use the singleton:
import { mcp } from './mcp.js';
export default defineApp({
...mcp.app({ handleAuth: false }),
authentication: yourAuthConfig,
// .. (your actions)
});
Use the singleton to call a tool:
import { mcp } from './mcp.js';
const perform = async (z: ZObject, bundle: Bundle) => {
const result = await mcp.callTool({
name: 'my_tool',
arguments: {
hello: 'world',
},
// Override these default options as needed:
// parse: true,
// error: true,
// filter: "content[0].json",
});
return result;
};
// Action configuration, leveraging perform
Use z.request()
as normally, as unless you have called mcp.app
with { handleAuth: false }
, it will have injected beforeRequest
middleware to inject tokens into requests.
The Proxy class supports multiple authentication methods:
import { Proxy } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'my-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
auth: {
type: 'oauth',
// OAuth configuration handled automatically
},
});
import { Proxy } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'my-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
auth: {
type: 'bearer',
token: 'your-bearer-token',
},
});
Choose between two transport protocols:
sse
(Server-Sent Events) - Recommended for most use casesstreamable
(HTTP streaming) - Alternative transport optionConfigure how MCP tools are called:
const result = await mcp.callTool({
name: 'my_tool',
arguments: { param: 'value' },
parse: true, // Parse JSON responses (default: true)
error: true, // Throw on MCP errors (default: true)
filter: 'data.items', // JSONata filter expression (optional)
});
The main class for interacting with MCP servers.
new Proxy(config?: ProxyConfig)
ProxyConfig:
name: string
- Integration nameversion: string
- Integration versionserverUrl: string
- MCP server URLtransport: 'sse' | 'streamable'
- Transport protocolauth?: AuthConfig
- Authentication configuration (optional)AuthConfig:
OAuth configuration:
{
type: 'oauth';
clientInformation: OAuthClientInformationFull;
tokens: OAuthTokens;
}
Bearer token configuration:
{
type: 'bearer';
token: string;
}
app(options?: AppOptions): Partial<App>
Returns Zapier app configuration with MCP integration.
AppOptions:
handleAuth?: boolean
- Whether to handle authentication (default: true)Returns: Partial Zapier App configuration including beforeRequest
middleware and afterApp
cleanup.
callTool(options: CallToolOptions): Promise<any>
Calls an MCP tool with the specified arguments.
CallToolOptions:
name: string
- Tool namearguments: Record<string, any>
- Tool argumentsparse?: boolean
- Parse JSON responses (default: true)error?: boolean
- Throw on errors (default: true)filter?: string
- JSONata filter expression (optional)Returns: Promise that resolves to the tool's response, optionally filtered and parsed.
Throws: Error
when the tool call fails and error
is true.
beforeRequest(): BeforeRequestMiddleware
Returns middleware for handling authentication in API requests.
Returns: Middleware function that injects Bearer tokens into request headers.
listTools(params?: { cursor?: string }): Promise<{ tools: Tool[]; cursor: string }>
Lists available MCP tools with pagination support.
listAllTools(): Promise<Tool[]>
Lists all available MCP tools by automatically handling pagination.
getTool(name: string): Promise<Tool | undefined>
Retrieves a specific MCP tool by name.
getServerVersion(): Promise<ServerVersion>
Gets the MCP server version and metadata.
authorizeUrl(z: ZObject, bundle: Bundle): Promise<string>
- Gets OAuth authorization URLgetAccessToken(z: ZObject, bundle: Bundle): Promise<GetAccessTokenResult>
- Exchanges code for tokensrefreshAccessToken(z: ZObject, bundle: Bundle): Promise<{}>
- Refreshes expired tokenstest(): () => Promise<ServerVersion>
- Connection test function for ZapierconnectionLabel(): (z: ZObject, bundle: Bundle) => Promise<string>
- Connection label generatorclose(): Promise<void>
- Closes the MCP client connectionconvertInputSchemaToFields(schema: Tool['inputSchema']): PlainInputField[]
Converts MCP tool input schemas to Zapier input field format.
Parameters:
schema: Tool['inputSchema']
- The MCP tool's input schemaReturns: Array of Zapier PlainInputField objects for form generation.
This package is written in TypeScript and includes comprehensive type definitions. All types are automatically available when using TypeScript:
import { Proxy, convertInputSchemaToFields } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'my-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL!,
transport: 'sse',
});
// Convert MCP tool schema to Zapier fields
const zapierFields = convertInputSchemaToFields(tool.inputSchema);
The package provides comprehensive TypeScript support with internal type definitions. All necessary typing is handled automatically when using the exported classes and functions.
import { Proxy } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'weather-integration',
version: '1.0.0',
serverUrl: 'https://weather-mcp-server.com',
transport: 'sse',
});
// Call a weather tool
const weather = await mcp.callTool({
name: 'get_weather',
arguments: {
location: 'San Francisco',
units: 'metric',
},
});
console.log(weather);
// Get only temperature from weather data
const temperature = await mcp.callTool({
name: 'get_weather',
arguments: { location: 'San Francisco' },
filter: 'content[0].json.temperature',
});
import { Proxy } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'my-oauth-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL,
transport: 'sse',
});
export default defineApp({
...mcp.app(),
authentication: {
type: 'oauth2',
oauth2Config: {
authorizeUrl: mcp.authorizeUrl.bind(mcp),
getAccessToken: mcp.getAccessToken.bind(mcp),
refreshAccessToken: mcp.refreshAccessToken.bind(mcp),
},
test: mcp.test(),
connectionLabel: mcp.connectionLabel(),
},
});
import { convertInputSchemaToFields } from '@zapier/mcp-integration';
// Get a tool and convert its schema
const tool = await mcp.getTool('my_tool');
if (tool) {
const zapierFields = convertInputSchemaToFields(tool.inputSchema);
// Use zapierFields in your action's inputFields
const myAction = {
// ...other config
operation: {
inputFields: zapierFields,
perform: async (z, bundle) => {
return await mcp.callTool({
name: 'my_tool',
arguments: bundle.inputData,
});
},
},
};
}
This package is part of the Zapier MCP integration project. For issues and contributions, please visit the GitLab repository.
MIT © Zapier
FAQs
SDK for using remote Model Context Protocol (MCP) servers in/as Zapier integrations
We found that @zapier/mcp-integration demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 306 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.