MCP ZAP Server

Name: MCP ZAP Server
Author: dtkmn

@dtkmn

MCP ZAP Server について

A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

#java #spring-boot #zap #mcp #owasp #llm #spring-ai #mcp-server

基本情報

カテゴリ

AI とエージェント

ライセンス

MIT license

ランタイム

java

トランスポート

stdio

公開者

dtkmn

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "zap-mcp-server": {
      "type": "http",
      "url": "http://localhost:7456/sse"
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is MCP ZAP Server?

A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

How to use MCP ZAP Server?

Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.

Key features of MCP ZAP Server

Exposes ZAP actions as MCP tools
OpenAPI integration for spec import and scanning
HTML and JSON report generation
Dockerized with orchestration via docker-compose
Secure configuration with API keys for ZAP and MCP server

Use cases of MCP ZAP Server

Automate security scanning through an AI agent conversation
Import a remote OpenAPI spec and trigger an active scan
Generate HTML or JSON security reports programmatically
Run spider scans and retrieve found alerts
Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)

FAQ from MCP ZAP Server

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at http://localhost:7456/sse).

How can I secure the server?

Configure API keys by setting environment variables ZAP_API_KEY for OWASP ZAP and MCP_API_KEY for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

「AI とエージェント」の他のコンテンツ

Model Context Protocol for Unreal Engine

chongdashu

Enable AI assistant clients like Cursor, Windsurf and Claude Desktop to control Unreal Engine through natural language using the Model Context Protocol (MCP).

2.0K

Just Prompt - A lightweight MCP server for LLM providers

disler

just-prompt is an MCP server that provides a unified interface to top LLM providers (OpenAI, Anthropic, Google Gemini, Groq, DeepSeek, and Ollama)

733

欢迎来到智言平台

Shy2593666979

AgentChat 是一个基于 LLM 的智能体交流平台，内置默认 Agent 并支持用户自定义 Agent。通过多轮对话和任务协作，Agent 可以理解并协助完成复杂任务。项目集成 LangChain、Function Call、MCP 协议、RAG、Memory、HITL、Skill、Milvus 和 ElasticSearch 等技术，实现高效的知识检索与工具调用，使用 FastAPI 构建高性能后端服务。

797

1Panel

1Panel-dev

🔥 1Panel is a modern, open-source VPS control panel — and the only one with native AI agent support. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface.

36.1K

LinkedIn MCP Server

stickerdaniel

Open-source MCP server for LinkedIn. Give Claude and any MCP-compatible AI agent access to profiles, companies, jobs, and messages.

2.7K