MCP ZAP Server

@dtkmn

代码仓库

基本信息

分类

AI 与智能体

许可证

MIT license

传输方式

stdio

作者

dtkmn

提交者

Daniel Tse

关于 MCP ZAP Server

A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

#java #spring-boot#zap#mcp #owasp #llm #spring-ai #mcp-server

MCP ZAP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "zap-mcp-server": {
      "type": "http",
      "url": "http://localhost:7456/sse"
    }
  }
}

MCP ZAP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,直接连接服务器端点实时获取工具列表。

概览

What is MCP ZAP Server?

A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

How to use MCP ZAP Server?

Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.

Key features of MCP ZAP Server

Exposes ZAP actions as MCP tools
OpenAPI integration for spec import and scanning
HTML and JSON report generation
Dockerized with orchestration via docker-compose
Secure configuration with API keys for ZAP and MCP server

Use cases of MCP ZAP Server

Automate security scanning through an AI agent conversation
Import a remote OpenAPI spec and trigger an active scan
Generate HTML or JSON security reports programmatically
Run spider scans and retrieve found alerts
Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)

常见问题

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).

How can I secure the server?

Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

AI 与智能体分类下的更多 MCP 服务器

scvd.store

seancrecord

scvd.store is an evidence observatory for agentic commerce. Independent signed observation of what other people's endpoints, artifacts and payments actually did among other things. USDC on Base, Arbitrum One, World Chain

Quest: Hire a Human

Quest (hireahuman.quest)

Hire a verified local human for small real-world tasks your AI agent can't do: errands, queues, pickups, in-person checks and on-site photos. Your agent posts a quest, local humans send offers, and your user picks one an

Plainpaper

The AI marketing canvas for Claude and MCP agents. Your agent drafts campaigns as cards on a shared board, briefed by your brand rules, approved by you.

Agentery

ntlgnc

Free MCP for live and historical pricing for 13,000+ agents and MCPs. Never knowingly pay too much... or charge too little. Know the going rate. https://agentery.com.

Legion MCP

faulkj

MCP-native LLM councils for debates, juries, blind panels, voting, refinement, and custom multi-model deliberation.