Is MCP ZAP Server production-ready?
No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.
MCP ZAP Server
@dtkmn
Basic information
About MCP ZAP Server
A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.
MCP ZAP Server config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"zap-mcp-server": {
"type": "http",
"url": "http://localhost:7456/sse"
}
}
}MCP ZAP Server tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
Fetch the live tool list directly from this server's endpoint using the button above.
Overview
What is MCP ZAP Server?
A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.
How to use MCP ZAP Server?
Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.
Key features of MCP ZAP Server
- Exposes ZAP actions as MCP tools
- OpenAPI integration for spec import and scanning
- HTML and JSON report generation
- Dockerized with orchestration via docker-compose
- Secure configuration with API keys for ZAP and MCP server
Use cases of MCP ZAP Server
- Automate security scanning through an AI agent conversation
- Import a remote OpenAPI spec and trigger an active scan
- Generate HTML or JSON security reports programmatically
- Run spider scans and retrieve found alerts
- Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)
Frequently asked questions
What are the prerequisites?
You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.
How does MCP ZAP Server connect to AI agents?
It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).
How can I secure the server?
Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.
Is MCP ZAP Server affiliated with OWASP?
No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.
More AI & Agents MCP servers
BlazingCDN MCP - Content Delivery for Video, Software & Static Files
BlazingCDNOfficial MCP server for BlazingCDN - AI agents (Claude, Cursor, Windsurf) manage CDN resources, purge cache, query metrics, domains, Anycast CDN, Video CDN and Media CDN
1
L
Legion MCP
faulkjMCP-native LLM councils for debates, juries, blind panels, voting, refinement, and custom multi-model deliberation.
1
Hostinger
hostingerModel Context Protocol (MCP) server for Hostinger API. If you don't want to install or run anything locally, connect directly to Hostinger's hosted MCP server: This opens a browser window to authorize via OAuth. Once app
148
Reach MCP
KanboxOperate a real LinkedIn account from your AI agent. 52 tools for the inbox, invitations, network, profiles, Sales Navigator search in plain language, posts and engagement; six playbooks served as MCP prompts that preview
OpenZiti MCP Gateway
openzitiNetFoundry MCP Gateway enables secure, isolated access to Model Context Protocol (MCP) tools across distributed systems without exposing public endpoints. Zero trust gateway for MCP servers. Aggregate, filter, and secure
48
Comments