letsauth

Server

Zoom

Endpoint
https://mcp.zoom.us/mcp/zoom/streamable
Transport
Streamable HTTP
Authentication as listed
oauth2.1 (the source's own label, not an observation)
Why it is listed
Listed because it appears in a public directory of MCP servers. Source
Homepage
https://zoom.us
  • Supported 1
  • Partial 2
  • Unsupported 2
  • Unknown 18

Contribute a correctionWithdraw this serverJSON

Status against MCP Authorization 2026-07-28 (current revision). Older revisions: 2025-11-25

MCP server features

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknown (no observation)no observation yet
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknown (no observation)no observation yet
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYUnknown (no observation)no observation yet
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnknown (no observation)no observation yet
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnknown (no observation)no observation yet
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown (no observation)no observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnknown (no observation)no observation yet
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDUnknown (no observation)no observation yet
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTUnknown (no observation)no observation yet
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown (no observation)no observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTPartialVendor claim · jbspeakr (documentation pass with Claude Code)source— "Once you have the access token, your MCP client must include it as a Bearer token in the Authorization header for all requests to the Zoom MCP server." (Docs require the Authorization header; they do not say whether tokens in the query string are rejected.)
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown (no observation)no observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown (no observation)no observation yet

Authorization server features

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknown (no observation)no observation yet
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknown (no observation)no observation yet
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDUnsupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Zoom remote MCP servers only support manual client registration through app creation and do not support other client registration methods such as Dynamic Client Registration (DCR) or Client ID Metadata Documents (CIMD)."
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYUnsupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Zoom remote MCP servers only support manual client registration through app creation and do not support other client registration methods such as Dynamic Client Registration (DCR) or Client ID Metadata Documents (CIMD)."
1 earlier observation
  1. Unknown · Vendor claim · jbspeakr · evidence
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "Zoom remote MCP servers require manual client registration. [...] Get from your Zoom app's configuration page on the Zoom App Marketplace." (Client developer creates an app in the Zoom App Marketplace, takes the OAuth Client ID and Client Secret from the app's Basic information page, and enters the MCP client's callback in the OAuth redirect URL field (examples given for Claude and ChatGPT).)
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnknown (no observation)no observation yet
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTPartialVendor claim · jbspeakr (documentation pass with Claude Code)source— "While Zoom uses traditional OAuth 2.0, the MCP specification mandates OAuth 2.1 compliance, so ensure your client includes the required code_verifier (PKCE) during the exchange." (PKCE is stated as required; the S256 challenge method is not named.)
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTUnknown (no observation)no observation yet
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown (no observation)no observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTUnknown (no observation)no observation yet