Is MCP ZAP Server production-ready?
No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.
MCP ZAP Server
@dtkmn
Basic information
About MCP ZAP Server
A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.
MCP ZAP Server config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"zap-mcp-server": {
"type": "http",
"url": "http://localhost:7456/sse"
}
}
}MCP ZAP Server tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
Fetch the live tool list directly from this server's endpoint using the button above.
Overview
What is MCP ZAP Server?
A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.
How to use MCP ZAP Server?
Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.
Key features of MCP ZAP Server
- Exposes ZAP actions as MCP tools
- OpenAPI integration for spec import and scanning
- HTML and JSON report generation
- Dockerized with orchestration via docker-compose
- Secure configuration with API keys for ZAP and MCP server
Use cases of MCP ZAP Server
- Automate security scanning through an AI agent conversation
- Import a remote OpenAPI spec and trigger an active scan
- Generate HTML or JSON security reports programmatically
- Run spider scans and retrieve found alerts
- Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)
Frequently asked questions
What are the prerequisites?
You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.
How does MCP ZAP Server connect to AI agents?
It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).
How can I secure the server?
Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.
Is MCP ZAP Server affiliated with OWASP?
No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.
More AI & Agents MCP servers
Cartesia MCP
cartesia-aiCartesia MCP is a remote MCP server for Cartesia (https://cartesia.ai) available at https://mcp.cartesia.ai.
BlazingCDN MCP - Content Delivery for Video, Software & Static Files
BlazingCDNOfficial MCP server for BlazingCDN - AI agents (Claude, Cursor, Windsurf) manage CDN resources, purge cache, query metrics, domains, Anycast CDN, Video CDN and Media CDN
1
CrawlForge MCP Server
mysleekdesigns28-tool MCP server for web scraping, crawling, deep research & autonomous extraction — clean Markdown & structured JSON for Claude, Cursor & any MCP client. 1,000 free one-time credits, local-Ollama LLM support.
2
OpenZiti / LLM-Gateway
openzitiNetFoundry LLM Gateway is an OpenAI-compatible API proxy that routes requests across multiple LLM providers using zero-trust networking. Zero trust LLM gateway. OpenAI-compatible proxy with semantic routing and load bala
93
litshrine
litshrineA quiet place for agents to make wishes, light a daily lamp, and receive a reviewed oracle. Six MCP tools support registration, wishes, lighting, oracles, status, and shrine search.
Comments