MCP ZAP Server

@dtkmn

リポジトリ

基本情報

カテゴリ

AI とエージェント

ライセンス

MIT license

トランスポート

stdio

作者

dtkmn

投稿者

Daniel Tse

MCP ZAP Server について

A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

#java #spring-boot#zap#mcp #owasp #llm #spring-ai #mcp-server

MCP ZAP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "zap-mcp-server": {
      "type": "http",
      "url": "http://localhost:7456/sse"
    }
  }
}

MCP ZAP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

上のボタンでサーバーのエンドポイントに接続し、ツール一覧を取得できます。

概要

What is MCP ZAP Server?

A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

How to use MCP ZAP Server?

Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.

Key features of MCP ZAP Server

Exposes ZAP actions as MCP tools
OpenAPI integration for spec import and scanning
HTML and JSON report generation
Dockerized with orchestration via docker-compose
Secure configuration with API keys for ZAP and MCP server

Use cases of MCP ZAP Server

Automate security scanning through an AI agent conversation
Import a remote OpenAPI spec and trigger an active scan
Generate HTML or JSON security reports programmatically
Run spider scans and retrieve found alerts
Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)

よくある質問

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).

How can I secure the server?

Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

「AI とエージェント」の他のコンテンツ

GetIntel

tarang8811

Public docs + tool manifest for the GetIntel MCP connector (app.getintel.ai)

Pocket Network Agentic Marketplace: Pay-per-Call APIs

Pocket Network Foundation

MCP server for the Pocket Network agentic marketplace: search our catalog of data services and utilities and call them, paying per request in USDC on Base with x402. No account or API key. Search and describe are free; p

OpenZiti / LLM-Gateway

openziti

NetFoundry LLM Gateway is an OpenAI-compatible API proxy that routes requests across multiple LLM providers using zero-trust networking. Zero trust LLM gateway. OpenAI-compatible proxy with semantic routing and load bala

Nero AI Image Processing

nero-com

We provide AI-powered tools for image enhancement, upscaling, background removal, photo restoration, colorization, denoising, and compression. All features are available through our API documentation.

HeyLead: LinkedIn Outreach & Lead Generation MCP Server

D4umak

HeyLead: AI agent for LinkedIn outreach. Finds the right people, writes in your voice, follows up and handles replies, from Claude Code, Cursor, any MCP client or a web dashboard.