Secure Zoom access for AI agents

Through Zoom, agents can search meetings, pull recordings and transcripts, and read or create Zoom Docs – every call runs through your policies and is logged for audit.

Server URL: https://mcp.zoom.us/mcp/zoom/streamable

Credential modes

Zoom supports bring your own app only. It does not support dynamic client registration, so your organization registers its own app in the Zoom App Marketplace and supplies the client ID and secret. See Credential modes for how the modes compare.

Before you begin

• A Zoom account that can build apps in the Zoom App Marketplace.
• A Zoom account owner or admin, if your account requires marketplace apps to be pre-approved before other users can connect.
• Administrator access to your Agent Authority workspace, to add the resource.

Setup moves between two consoles. You copy a redirect URI in the Agent Authority console, build an app in the Zoom App Marketplace, then return to the console and paste the credentials. Keep both tabs open as you work.

Setup

1. Copy the redirect URI

In the Agent Authority console, go to Resources → Add Resource and select Zoom. Zoom is bring-your-own-app only, so the credentials form opens as soon as you select it, with no mode to pick.

Copy the Redirect URI shown on the form. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.

Leave this page open. You come back to it in step 3.

2. Register a General app in Zoom

Sign in to the Zoom App Marketplace. In the lower-left navigation pane click Developer, then on the Created apps page click Develop and select Build an app. Choose General app and click Create.

Set the app to User-managed, so each user authorizes with their own Zoom account.

On the app's Basic Info page, under OAuth Information:

• Set OAuth redirect URL to the Redirect URI from the form in the Agent Authority console, using the Copy button next to it.
• Add the same URL to OAuth allow lists.
• Copy the Client ID and Client Secret.

Under Scopes, add every scope listed under Required scopes.

3. Finish in the console

Back on the Zoom form in the Agent Authority console, paste the Client ID and Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.

The gateway sends you to Zoom to sign in, through your SSO if configured, and authorize the app. Review the requested access and click Allow. You return to the console with your Zoom account connected.

Verify the connection

The gateway syncs the Zoom tools automatically. To check the connection end to end, ask your agent to run a request:

List my Zoom cloud recordings

If your recordings come back, the connection is working.

How users connect

Access is per user. Each additional user connects their own Zoom account the first time their agent calls a Zoom tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.

Zoom's own account role and licensing control what each user can reach. The gateway does not widen access beyond what the authenticated user could already do in Zoom.

Available tools

Zoom's server supplies this list, so agents can see tools that this table does not include. Check the Available Tools card on the resource's Overview tab in the Agent Authority console for the authoritative list of what your install actually exposes.

Required scopes

Add all of these in the app's Scopes section. The gateway requests exactly this list when a user authorizes. Zoom rejects the authorization if your app is missing any of them.

• meeting:read:search – search the user's meetings
• meeting:read:assets – read meeting summaries, notes, and assets
• cloud_recording:read:list_user_recordings – list cloud recordings
• cloud_recording:read:content – read recording transcripts and summaries
• ai_companion:read:search – search AI Companion content
• docs:read:export – read Zoom Docs content
• docs:write:import – create Zoom Docs
• agentic_search:read:search – search across meetings, chat, Zoom Docs, and My Notes
• agentic_search:read:ask – answer questions from workspace content
• hub:read:content – read Zoom Hub files
• hub:write:content – create Zoom Hub files
• my_notes:read:content – read My Notes content and transcripts

Policy examples

Rules are evaluated first-match-wins from the top of the list, and every org starts with a seeded Allow all rule sitting at the bottom – so a recipe made only of allow rules restricts nothing. Deny-based examples like these work by adding denies above it.

• Read-only access: deny create_new_file_with_markdown and hub_create_file_from_content, the two tools above that write
• Meetings without transcripts or playback: deny recordings_list and get_recording_resource, which are what surface transcripts, topic summaries, and playback URLs. Note that get_meeting_assets still returns the meeting's recording among its assets, so this narrows recording access rather than walling it off – deny get_meeting_assets too if agents shouldn't reach recordings at all. Deny my_notes_get_note_content and ask as well. The first returns a meeting's transcript, and the second reasons over recording transcripts.
• Docs workflows only: allow search_zoom, get_file_content, and create_new_file_with_markdown. Deny the meeting and recording tools (search_meetings, get_meeting_assets, recordings_list, get_recording_resource). Deny search and ask, which reach meetings as well as docs. Deny the Zoom Hub and My Notes tools (hub_get_file_content, hub_create_file_from_content, my_notes_get_note_content), which sit on surfaces separate from Zoom Docs.

Next steps

• Create a policy – start from the read-only pattern in Policy examples above.
• Connections – manage the Zoom accounts your users have linked.