Zoho Projects Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Zoho Projects Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An enhanced Model Context Protocol (MCP) server for Zoho Projects API integration. This server enables AI assistants to interact with Zoho Projects for managing projects, tasks, issues, milestones, comments, attachments, and more.
Note: This is an enhanced fork with additional features for task lookup by prefix, tasklist management, comments, attachments, and inline image handling. Based on qpiai/zoho-projects-mcp.
CA6-T282) ⭐#### Step 1: Create a Zoho Developer Application
http://localhost for testinghttp://localhost:8080/callback (or your preferred redirect URL)1000.XXXXXXXXXX)#### Step 2: Generate Authorization Code
https://accounts.zoho.{REGION}/oauth/v2/auth?
scope=ZohoProjects.portals.ALL,ZohoProjects.projects.ALL,ZohoProjects.tasks.ALL,ZohoProjects.bugs.ALL,ZohoProjects.milestones.ALL,ZohoProjects.users.READ,ZohoSearch.securesearch.READ
&client_id=YOUR_CLIENT_ID
&response_type=code
&access_type=offline
&redirect_uri=YOUR_REDIRECT_URIReplace {REGION} with your region:
comeuincom.aucom.cn http://localhost:8080/callback?code=1000.XXXXX.XXXXX&location=in&accounts-server=https://accounts.zoho.incode value (valid for ~2 minutes, use it immediately!)#### Step 3: Exchange Code for Tokens
Use this curl command to get your access and refresh tokens:
curl -X POST https://accounts.zoho.{REGION}/oauth/v2/token \
-d "code=YOUR_AUTHORIZATION_CODE" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "redirect_uri=YOUR_REDIRECT_URI" \
-d "grant_type=authorization_code"Response will contain:
{
"access_token": "1000.xxxx.yyyy",
"refresh_token": "1000.zzzz.aaaa",
"expires_in": 3600,
"api_domain": "https://www.zohoapis.in",
"token_type": "Bearer"
}Important: Save both tokens:
#### Step 4: Find Your Portal ID
Method 1: From URL
https://projects.zoho.{REGION}/portal/{PORTAL_ID}/.../portal/ is your Portal ID (e.g., 60028147039)Method 2: Using API
curl -X GET https://projectsapi.zoho.{REGION}/api/v3/portals \
-H "Authorization: Zoho-oauthtoken YOUR_ACCESS_TOKEN"Response will list all your portals with their IDs.
#### Step 5: Verify Credentials
Test your setup with this API call:
curl -X GET https://projectsapi.zoho.{REGION}/api/v3/portal/YOUR_PORTAL_ID/projects \
-H "Authorization: Zoho-oauthtoken YOUR_ACCESS_TOKEN"Expected: JSON response with your projects list If error: Check token, portal ID, and API domain match your region
#### Required Scopes Summary
Make sure your OAuth token has these scopes:
ZohoProjects.portals.ALL - Portal operationsZohoProjects.projects.ALL - Project managementZohoProjects.tasks.ALL - Task managementZohoProjects.bugs.ALL - Issue/bug managementZohoProjects.milestones.ALL - Milestone/phase managementZohoProjects.users.READ - User informationZohoSearch.securesearch.READ - Search functionality<!-- #### Docker Setup (NOT CURRENTLY WORKING - DISABLED)
Docker support is currently disabled due to npm package installation issues in containerized environments. If you need Docker support, please open an issue on GitHub and we can work on a solution.
#### Option A: Docker Setup (Recommended - Easiest) 🐳
Prerequisites:
Steps:
git clone <repository-url>
cd zoho-mcp.env file with your credentials:cp .env.example .env
# Edit .env with your credentialsFor HTTP Server (remote access):
docker-compose --profile http up -dFor Stdio Server (local/Claude Desktop):
docker-compose --profile stdio up# For HTTP server
curl http://localhost:3001/health
# View logs
docker-compose logs -f-->
#### Node.js Setup
Prerequisites:
Steps:
git clone <repository-url>
cd zoho-mcp
npm install
npm run build.env file with your credentials (see Configuration section below)# Stdio server (for local MCP clients)
npm start
# HTTP server (for remote access)
npm run start:httpCreate a .env file in the project root with the following variables:
# OAuth credentials (required)
ZOHO_ACCESS_TOKEN=your_access_token_here
ZOHO_REFRESH_TOKEN=your_refresh_token_here
ZOHO_CLIENT_ID=your_client_id_here
ZOHO_CLIENT_SECRET=your_client_secret_here
# Portal configuration (required)
ZOHO_PORTAL_ID=your_portal_id_here
# API domain (optional, choose based on your region)
ZOHO_API_DOMAIN=https://projectsapi.zoho.com
ZOHO_ACCOUNTS_DOMAIN=https://accounts.zoho.com
# HTTP Server configuration (optional, for remote access)
HTTP_PORT=3001
ALLOWED_ORIGINS=http://localhost:3000
ALLOWED_HOSTS=127.0.0.1,localhostRegion-specific domains:
projectsapi.zoho.com / accounts.zoho.comprojectsapi.zoho.eu / accounts.zoho.euprojectsapi.zoho.in / accounts.zoho.inprojectsapi.zoho.com.au / accounts.zoho.com.auprojectsapi.zoho.com.cn / accounts.zoho.com.cnAdd to your Claude Desktop configuration file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json
#### For Node.js Setup:
{
"mcpServers": {
"zoho-projects": {
"command": "node",
"args": ["/absolute/path/to/zoho-mcp/dist/index.js"],
"env": {
"ZOHO_ACCESS_TOKEN": "your_access_token_here",
"ZOHO_REFRESH_TOKEN": "your_refresh_token_here",
"ZOHO_CLIENT_ID": "your_client_id_here",
"ZOHO_CLIENT_SECRET": "your_client_secret_here",
"ZOHO_PORTAL_ID": "your_portal_id_here",
"ZOHO_API_DOMAIN": "https://projectsapi.zoho.in",
"ZOHO_ACCOUNTS_DOMAIN": "https://accounts.zoho.in"
}
}
}
}<!-- #### For Docker Setup (NOT CURRENTLY WORKING - DISABLED):
{
"mcpServers": {
"zoho-projects": {
"command": "docker",
"args": ["run", "-i", "--rm", "--env-file", "/absolute/path/to/zoho-mcp/.env", "zoho-mcp-stdio"],
"env": {}
}
}
}Note: For Docker setup, first build the image:
cd /path/to/zoho-mcp
docker build -t zoho-mcp-stdio .-->
Once configured, you can use Claude to interact with Zoho Projects:
Can you list all my Zoho Projects?Create a new project called "Website Redesign" with description "Redesign company website" starting on 2025-01-15 and ending on 2025-03-31Show me all tasks in project ID 1234567890Create a high priority task called "Design homepage mockup" in project 1234567890, due on 2025-02-15Search for "bug fix" in all modulesShow me all issues in project 1234567890Get the task CA6-T282Add a comment "Work in progress - will complete by EOD" to task 12345 in project 1234567890Upload /path/to/screenshot.png to task 12345 in project 1234567890Move task 12345 to tasklist 67890 in project 1234567890Download all images from task CA6-T282 to /tmp/task-images/zoho-projects-mcp/
├── src/
│ └── index.ts # Main server implementation
├── dist/ # Compiled JavaScript (generated)
├── package.json
├── tsconfig.json
├── FORMATTING.md # Guide for Zoho HTML formatting
├── CLAUDE.md # Instructions for Claude Code
└── README.mdThe server provides the following MCP tools:
| Tool | Description |
|---|---|
list_portals | Get all portals |
get_portal | Get portal details |
list_projects | List all projects |
get_project | Get project details |
create_project | Create a new project |
update_project | Update a project |
delete_project | Delete a project (move to trash) |
| Tool | Description |
|---|---|
list_tasks | List tasks (portal or project level) |
get_task | Get task details by ID |
get_task_by_prefix | Find task by prefix (e.g., CA6-T282) ⭐ |
create_task | Create a task |
update_task | Update a task (supports status_id, tasklist_id) |
delete_task | Delete a task |
| Tool | Description |
|---|---|
create_tasklist | Create a new tasklist in a project |
move_task | Move a task to a different tasklist |
delete_tasklist | Delete a tasklist |
| Tool | Description |
|---|---|
list_task_comments | List comments on a task |
add_task_comment | Add a comment to a task |
edit_task_comment | Edit an existing comment |
| Tool | Description |
|---|---|
upload_task_attachment | Upload a file attachment to a task |
list_task_attachments | List attachments on a task |
download_inline_image | Download an inline image from task description |
extract_inline_images | Extract image URLs from HTML |
download_task_images | Download all images from a task description |
| Tool | Description |
|---|---|
list_issues | List issues (portal or project level) |
get_issue | Get issue details |
create_issue | Create an issue |
update_issue | Update an issue |
| Tool | Description |
|---|---|
list_phases | List phases/milestones |
create_phase | Create a phase |
list_statuses | List available task statuses for a project ⭐ |
search | Search portal or project |
list_users | List users in portal or project |
Access tokens expire after 1 hour (3600 seconds). This MCP server automatically refreshes tokens using the refresh token.
If you need to manually refresh your access token:
# For India region (accounts.zoho.in)
curl -X POST https://accounts.zoho.in/oauth/v2/token \
-d "refresh_token=YOUR_REFRESH_TOKEN" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "grant_type=refresh_token"
# For other regions, use the appropriate accounts domain:
# US: https://accounts.zoho.com/oauth/v2/token
# EU: https://accounts.zoho.eu/oauth/v2/token
# AU: https://accounts.zoho.com.au/oauth/v2/token
# CN: https://accounts.zoho.com.cn/oauth/v2/tokenResponse example:
{
"access_token": "1000.xxx.yyy",
"scope": "ZohoProjects.portals.ALL ZohoProjects.projects.ALL...",
"api_domain": "https://www.zohoapis.in",
"token_type": "Bearer",
"expires_in": 3600
}The MCP server automatically handles token refresh. Configure the following environment variables:
ZOHO_REFRESH_TOKEN=your_refresh_token_here
ZOHO_CLIENT_ID=your_client_id_here
ZOHO_CLIENT_SECRET=your_client_secret_here
ZOHO_ACCOUNTS_DOMAIN=https://accounts.zoho.in # Match your regionThe server will automatically refresh the access token before it expires.
For detailed API documentation, visit: https://projects.zoho.com/api-docs
MIT
Contributions are welcome! Please feel free to submit issues or pull requests.
For issues related to:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.