MCP.so
登录

MCP ZAP Server

@dtkmn

代码仓库

关于 MCP ZAP Server

A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

#java#spring-boot#zap#mcp#owasp#llm#spring-ai#mcp-server

基本信息

分类

AI 与智能体

许可证

MIT license

运行时

java

传输方式

stdio

发布者

dtkmn

配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "zap-mcp-server": {
      "type": "http",
      "url": "http://localhost:7456/sse"
    }
  }
}

工具

未检测到工具

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is MCP ZAP Server?

A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

How to use MCP ZAP Server?

Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.

Key features of MCP ZAP Server

  • Exposes ZAP actions as MCP tools
  • OpenAPI integration for spec import and scanning
  • HTML and JSON report generation
  • Dockerized with orchestration via docker-compose
  • Secure configuration with API keys for ZAP and MCP server

Use cases of MCP ZAP Server

  • Automate security scanning through an AI agent conversation
  • Import a remote OpenAPI spec and trigger an active scan
  • Generate HTML or JSON security reports programmatically
  • Run spider scans and retrieve found alerts
  • Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)

FAQ from MCP ZAP Server

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at http://localhost:7456/sse).

How can I secure the server?

Configure API keys by setting environment variables ZAP_API_KEY for OWASP ZAP and MCP_API_KEY for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

评论

AI 与智能体 分类下的更多 MCP 服务器

Solon Ai

opensolon

Java AI application development framework (supports LLM-tool,skill; RAG; MCP; Agent-ReAct,Team-Agent). Compatible with java8 ~ java25. It can also be embedded in SpringBoot, jFinal, Vert.x, Quarkus, and other frameworks.

416

21st.dev Magic AI Agent

21st-dev

It's like v0 but in your Cursor/WindSurf/Cline. 21st dev Magic MCP server for working with your frontend like Magic

5.3K

LinkedIn MCP Server

stickerdaniel

Open-source MCP server for LinkedIn. Give Claude and any MCP-compatible AI agent access to profiles, companies, jobs, and messages.

2.7K

1Panel

1Panel-dev

🔥 1Panel is a modern, open-source VPS control panel — and the only one with native AI agent support. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface.

36.1K

MCP Claude Code

SDGLBL

MCP implementation of Claude Code capabilities and more

302