MCP ZAP Server
@dtkmn
About MCP ZAP Server
A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"zap-mcp-server": {
"type": "http",
"url": "http://localhost:7456/sse"
}
}
}Tools
No tools detected
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is MCP ZAP Server?
A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.
How to use MCP ZAP Server?
Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.
Key features of MCP ZAP Server
- Exposes ZAP actions as MCP tools
- OpenAPI integration for spec import and scanning
- HTML and JSON report generation
- Dockerized with orchestration via docker-compose
- Secure configuration with API keys for ZAP and MCP server
Use cases of MCP ZAP Server
- Automate security scanning through an AI agent conversation
- Import a remote OpenAPI spec and trigger an active scan
- Generate HTML or JSON security reports programmatically
- Run spider scans and retrieve found alerts
- Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)
FAQ from MCP ZAP Server
Is MCP ZAP Server production-ready?
No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.
What are the prerequisites?
You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.
How does MCP ZAP Server connect to AI agents?
It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at http://localhost:7456/sse).
How can I secure the server?
Configure API keys by setting environment variables ZAP_API_KEY for OWASP ZAP and MCP_API_KEY for the MCP server.
Is MCP ZAP Server affiliated with OWASP?
No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.
Frequently asked questions
Is MCP ZAP Server production-ready?
No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.
What are the prerequisites?
You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.
How does MCP ZAP Server connect to AI agents?
It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).
How can I secure the server?
Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.
Is MCP ZAP Server affiliated with OWASP?
No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.
Basic information
More AI & Agents MCP servers
Hass-MCP
voskaControl and query Home Assistant from Claude and other LLMs — a Model Context Protocol (MCP) server.
Lumify Sports Intelligence
LumifyAgent-ready sports intelligence API: live scores, odds, line movement, public betting splits, and explainable bet confidence — via 16 MCP tools at https://lumify.ai/mcp. Get a free key instantly — no signup, email, or ca
Solon Ai
opensolonJava AI application development framework (supports LLM-tool,skill; RAG; MCP; Agent-ReAct,Team-Agent). Compatible with java8 ~ java25. It can also be embedded in SpringBoot, jFinal, Vert.x, Quarkus, and other frameworks.
Open Multi-Agent Canvas
CopilotKitThe open-source multi-agent chat interface that lets you manage multiple agents in one dynamic conversation and add MCP servers for deep research
🛡️ A.I.G（AI-Infra-Guard）
TencentA full-stack AI Red Teaming platform securing AI ecosystems via OpenClaw Security Scan, Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.
Comments