MCP.so
Sign In

MCP ZAP Server

@dtkmn

Repository

About MCP ZAP Server

A Spring Boot application exposing OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP‑compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

#java#spring-boot#zap#mcp#owasp#llm#spring-ai#mcp-server

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "zap-mcp-server": {
      "type": "http",
      "url": "http://localhost:7456/sse"
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is MCP ZAP Server?

A Spring Boot application that exposes OWASP ZAP as an MCP (Model Context Protocol) server. It lets any MCP-compatible AI agent (e.g., Claude Desktop, Cursor) orchestrate ZAP actions—spider, active scan, import OpenAPI specs, and generate reports.

How to use MCP ZAP Server?

Clone the repository, set the environment variable LOCAL_ZAP_WORKPLACE_FOLDER, and run docker-compose up -d. Open http://localhost:3000 for the Open Web-UI interface. Alternatively, configure it with Claude Desktop, Cursor, or Windsurf by adding a JSON definition using either STDIO or SSE transport mode.

Key features of MCP ZAP Server

  • Exposes ZAP actions as MCP tools
  • OpenAPI integration for spec import and scanning
  • HTML and JSON report generation
  • Dockerized with orchestration via docker-compose
  • Secure configuration with API keys for ZAP and MCP server

Use cases of MCP ZAP Server

  • Automate security scanning through an AI agent conversation
  • Import a remote OpenAPI spec and trigger an active scan
  • Generate HTML or JSON security reports programmatically
  • Run spider scans and retrieve found alerts
  • Test ZAP’s capabilities with deliberately vulnerable apps (Juice Shop, Petstore)

FAQ from MCP ZAP Server

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at http://localhost:7456/sse).

How can I secure the server?

Configure API keys by setting environment variables ZAP_API_KEY for OWASP ZAP and MCP_API_KEY for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

Frequently asked questions

Is MCP ZAP Server production-ready?

No, it is a work in progress and intended for educational purposes to demonstrate the capabilities of MCP with OWASP ZAP.

What are the prerequisites?

You need Docker >= 20.10, Docker Compose >= 1.29, and an LLM that supports tool calling (e.g., gpt-4o, Claude 3, Llama 3, mistral, phi3). For manual builds, Java 21+ is required.

How does MCP ZAP Server connect to AI agents?

It supports both STDIO mode (running the JAR with specific system properties) and SSE mode (exposing an HTTP endpoint at `http://localhost:7456/sse`).

How can I secure the server?

Configure API keys by setting environment variables `ZAP_API_KEY` for OWASP ZAP and `MCP_API_KEY` for the MCP server.

Is MCP ZAP Server affiliated with OWASP?

No, it is an independent implementation and not affiliated with or endorsed by OWASP or the OWASP ZAP project.

Comments

Basic information

Category

AI & Agents

License

MIT license

Transports

stdio

Author

dtkmn

More AI & Agents MCP servers

L

Legion MCP

faulkj

MCP-native LLM councils for debates, juries, blind panels, voting, refinement, and custom multi-model deliberation.

1

1Panel

1Panel-dev

🔥 1Panel is a modern, open-source VPS control panel — and the only one with native AI agent support. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface.

36.1K

bsv.cx

Andy Rowe

Timestamp and verify evidence on-chain. Let your agent prove what it saw and when. bsv.cx gives an AI agent verifiable memory. Timestamp a hash of any output, archive a web page as it looked, or fetch a URL with a recei

Magic Hour

Magic Hour MCP lets AI agents create and edit images, videos, and audio using Magic Hour’s hosted generation tools.

F

fhirHydrant

faulkj

Open-source Node.js FHIR MCP server with SMART Backend Services, metadata-aware search/CRUD tools, compact responses, FHIRPath filtering, safe pagination, audit events, and terminology lookup.

14