MCP ZAP Server

@dtkmn

代码仓库

基本信息

分类

AI 与智能体

许可证

MIT license

传输方式

stdio

作者

dtkmn

提交者

Daniel Tse

关于 MCP ZAP Server

A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

#java #spring-boot#zap#mcp #owasp #llm #spring-ai #mcp-server

MCP ZAP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "zap-mcp-server": {
      "type": "http",
      "url": "http://localhost:7456/sse"
    }
  }
}

MCP ZAP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,直接连接服务器端点实时获取工具列表。

概览

What is MCP ZAP Server?

A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

How to use MCP ZAP Server?

Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.

Key features of MCP ZAP Server

Exposes ZAP actions as MCP tools
OpenAPI integration for spec import and scanning
HTML and JSON report generation
Dockerized with orchestration via docker-compose
Secure configuration with API keys for ZAP and MCP server

Use cases of MCP ZAP Server

Automate security scanning through an AI agent conversation
Import a remote OpenAPI spec and trigger an active scan
Generate HTML or JSON security reports programmatically
Run spider scans and retrieve found alerts
Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)

常见问题

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).

How can I secure the server?

Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

AI 与智能体分类下的更多 MCP 服务器

InsumerAPI

Wallet auth for AI agents: send a blockchain wallet and conditions, get a signed yes or no across 37 chains, never the balance. Hosted at https://api.insumermodel.com/mcp with no key (10 tools), or run locally with npx -

HeyLead: LinkedIn Outreach & Lead Generation MCP Server

D4umak

HeyLead: AI agent for LinkedIn outreach. Finds the right people, writes in your voice, follows up and handles replies, from Claude Code, Cursor, any MCP client or a web dashboard.

fhirHydrant

faulkj

Open-source Node.js FHIR MCP server with SMART Backend Services, metadata-aware search/CRUD tools, compact responses, FHIRPath filtering, safe pagination, audit events, and terminology lookup.

Nero AI Image Processing

nero-com

We provide AI-powered tools for image enhancement, upscaling, background removal, photo restoration, colorization, denoising, and compression. All features are available through our API documentation.

AON — Agent Offer Network

AON

AON MCP connects AI agents to real, buyable products and services with live pricing and tracked links—enabling builders to earn developer revenue share from attributed clicks and conversions.