Zorro MCP Server

Overview

The Zorro MCP server exposes the Zorro platform over the Model Context Protocol, an open standard for connecting AI assistants to external tools and data. It works with Claude (claude.ai, Claude Desktop, Claude Code), ChatGPT, and any other MCP-compatible client.

Getting started

Add Zorro as a custom connector in your MCP client and point it at the server URL. On first use you'll be taken through a standard OAuth sign-in with your Zorro account; no API keys to copy.

Claude (claude.ai / Claude Desktop)

Go to Settings → Connectors → Add custom connector and enter https://mcp.getzorro.ai/mcp.

Claude Code

claude mcp add zorro --transport http https://mcp.getzorro.ai/mcp

Generic MCP configuration

{
  "mcpServers": {
    "zorro": {
      "url": "https://mcp.getzorro.ai/mcp",
      "transport": "streamable-http"
    }
  }
}

Authentication

The server implements OAuth 2.1. PKCE is required for every client, and dynamic client registration (RFC 7591) is supported, so compatible clients can connect without pre-registration.

• Access tokens are valid for 1 hour.
• Refresh tokens do not rotate: the same refresh token is reused for the life of the connection, which is bounded at 90 days from the initial sign-in. You can end a connection at any time from Disconnect in your Zorro account.
• Scopes: mcp:read and mcp:write are defined, each with its own consent description. The connector requests both, and both are granted when you connect. Every write tool declares mcp:write and the server checks that scope on each call; because every current connection is granted both scopes, that check does not restrict any caller today.

Discovery metadata is published at the standard well-known locations: protected-resource metadata (RFC 9728) at https://mcp.getzorro.ai/.well-known/oauth-protected-resource/mcp and authorization-server metadata (RFC 8414) at https://api.getzorro.ai/.well-known/oauth-authorization-server.

Capabilities

Once connected, your assistant can:

• Search & size UK companies — query the full Companies House universe of UK companies with live filters across firmographics, financials, ownership, and signals; count and preview before pulling lists.
• Build & qualify lead lists — create collections, run qualification and analysis over them, and manage prospects.
• Enrich contacts — find decision-makers and retrieve verified business email addresses and phone numbers.
• Analyse outreach — monitor campaigns, classify replies, and diagnose performance. Campaign launch happens in the Zorro app.
• Use saved agents & ICPs — run your saved research agents and ideal-customer-profile filters directly from the conversation.

A pricing tool (price_contact_enrichment) returns the cost of an enrichment before you run it, and bulk email enrichment requires an explicit confirm flag before it spends credits. AI analysis defaults to a 10-record sample so you can check quality before scaling.

Safety design

The server is built so your assistant can't take irreversible actions on its own:

• Preview-first writes — many bulk and mutating operations accept a dry_run or confirm flag that returns a preview instead of acting. It is not universal: check the tool's own parameters.
• No outreach from the connector — no tool sends a marketing email or a LinkedIn message. Campaign enrolment, sending and LinkedIn outreach are all done in the Zorro app. One tool does send email: send_report_now emails a Zorro report to an address you specify.
• Spend gating — price_contact_enrichment returns the cost of a request before it runs, and bulk email enrichment requires an explicit confirmation flag. Some single-record lookups spend credits without a separate confirmation, so check the pricing tool first. AI analysis defaults to a 10-record sample.
• No hard deletes — removals are scoped and reported, and archival actions are reversible.

Data sources & enrichment

Company intelligence is built from public registers and licensed providers:

• Companies House and other official registers — filings, accounts, officers, and persons with significant control (PSCs).
• HM Land Registry — commercial and corporate property ownership, refreshed from a monthly snapshot.
• Zorro modelled & enriched data — financial estimates, scores, web traffic, and live signals.

Contact discovery runs Snov.io and Apollo in parallel and merges the results, preferring Snov.io. Email enrichment then runs Snov.io first and FullEnrich as the fallback; FullEnrich is the only source of phone numbers. We independently verify email deliverability using Reoon.

Rate limits

Rate limits are applied per authenticated user on a rolling 60-second window. The per-operation limits below apply in addition to the overall per-user ceiling, not instead of it.

Dynamic client registration is separately limited for unauthenticated callers.

Requests over the limit receive a 429 response; back off and retry. A Retry-After header gives the wait in seconds. If your workflow needs sustained higher throughput, contact support.

Known limitations

• UK companies — the connector covers the Companies House universe. Other geographies are not available through the MCP server.
• No FCA-register data — the server never asserts a company's regulated status; verify manually at register.fca.org.uk.
• Revenue is modelled — turnover figures are predictions disclosed as such, not filed accounts.
• CSV import only — XLSX files aren't supported for list imports.

Privacy & data protection

Zorro processes personal data relating to individuals in their professional or corporate capacity only, on the basis of legitimate interests (UK GDPR Article 6(1)(f)):

• Director and PSC information, including approximate age, is derived from data Companies House makes public by law. Companies House publishes only the month and year of birth for directors and PSCs, and that partial date is all we take from the register.
• Enriched business contact details are obtained from the licensed providers above on the same basis. Opt-outs are honoured and suppressed from future processing.

Full details, including how individuals can object, are in our Privacy Policy.

Availability & support

• Availability: the service runs on Google Cloud Run with automated health checks. We do not currently publish a contractual uptime commitment.
• Incidents: material service incidents affecting your account are communicated by email to the account address.