Zoho Crm Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Zoho Crm Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server and optional FastAPI wrapper for live Zoho CRM data access.
This project does not sync CRM data into a database or knowledge graph. Zoho remains the source of truth. The server discovers your Zoho modules, fields, and related lists, then exposes generic tools that can query standard modules, custom modules, subforms, and linking modules through Zoho's API names.
/docs UI for manual testing./query endpoint for simple natural-language CRM lookups.These files are intentionally ignored and should not be committed:
.envzoho_metadata.jsonknowledge_graph.db__pycache__/zoho_metadata.json contains schema metadata from your Zoho org. It does not contain synced CRM records, but it can still reveal internal module and field names, so keep it local.
Create a local .env:
ZOHO_CLIENT_ID=...
ZOHO_CLIENT_SECRET=...
ZOHO_REFRESH_TOKEN=...
OPENAI_API_KEY=...Optional, depending on your Zoho data center:
ZOHO_ACCOUNTS_URL=https://accounts.zoho.in
ZOHO_API_DOMAIN=https://www.zohoapis.in
OPENAI_MODEL=gpt-4o-miniInstall dependencies:
python3 -m pip install -r requirements.txtDiscover modules, fields, and related lists:
python3 discover_zoho.pyThis creates local zoho_metadata.json.
python3 zoho_mcp_server.pyExample MCP client config:
{
"mcpServers": {
"zoho-crm": {
"command": "python3",
"args": [
"/absolute/path/to/zoho_mcp_server.py"
]
}
}
}refresh_metadatalist_modulesget_module_fieldsget_related_listssearch_recordsget_recordsget_recordget_related_recordsquery_coqlNote: query_coql requires a Zoho refresh token with the correct COQL scope. If the token does not include that scope, normal record tools still work.
Start FastAPI:
uvicorn api:app --host 127.0.0.1 --port 8000Open:
http://127.0.0.1:8000/docsUseful endpoints:
POST /queryGET /queryGET /modulesGET /modules/{module}/fieldsGET /modules/{module}/related-listsGET /records/{module}POST /recordsGET /records/{module}/searchPOST /records/searchGET /record/{module}/{record_id}POST /related-recordsPOST /coqlPOST /query takes a raw text body and returns plain text. By default it uses the LLM agent wrapper above the MCP tools.
Example body:
latest contactsOther examples:
find contacts matching Amit
top 5 revenue accounts
deals closing this month
what fields are in Accounts
what related lists are in Contacts
latest invoicesThe /query endpoint is intentionally pragmatic. It handles common CRM lookups and a few analytical shortcuts. For deep analytics, add COQL scope or later add a materialized analytical store such as Postgres or DuckDB.
Use the deterministic rule-based fallback if needed:
POST /query?mode=rulesUse the LLM tool-calling agent:
POST /query?mode=agent~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.