MCP ZAP Server

MCP ZAP Server is an MCP server that bridges AI agents and MCP clients with OWASP ZAP to conduct automated, operator-controlled web application security scans. It allows security engineers, developers, and autonomous agent workflows to interact with an underlying OWASP ZAP instance over streamable HTTP. By presenting guided and expert-level tool sets, the server enables language models to trigger spidering, run active and passive scans, import OpenAPI definitions, fetch findings, and generate security reports. Built with safety defaults, MCP ZAP Server enforces strict guardrails including API-key or JWT-based authentication, request body size limits, rate limiting, and target URL validation that blocks scans against localhost or private networks by default. Scan targets and operations are handled without exposing raw scanner instances directly to untrusted prompts, allowing teams to integrate dynamic security assessments into continuous workflows or developer environments while retaining granular operational control and audit logging.

Category: Developer Tools & Code Intelligence

Tags: owasp, penetration-testing, security-scanning, vulnerability, zap

Visit MCP ZAP Server

How to install and configure MCP ZAP Server

1. Clone the repository locally: bash git clone https://github.com/dtkmn/mcp-zap-server.git cd mcp-zap-server 2. Run the bootstrap and development startup scripts: bash ./bin/bootstrap-local.sh ./dev.sh ./bin/self-serve-doctor.sh 3. Locate the generated API key in the .env file created during bootstrap. 4. Connect your MCP client (such as Cursor or Open WebUI) to the streamable HTTP endpoint at http://localhost:7456/mcp, authenticating with the configured API key header as shown in the repository documentation.

What you can do with MCP ZAP Server

• Running automated spidering and active vulnerability scans on authorized web applications directly via natural language prompts. - Importing OpenAPI and API specifications into OWASP ZAP to inspect endpoints for security misconfigurations. - Generating comprehensive vulnerability reports and structured finding summaries for engineering teams after automated test runs. - Enforcing safe scanning practices using server-side URL validation, rate limits, and audit logs within agentic workflows.

Key facts

• Open Source
• https://github.com/dtkmn/mcp-zap-server
• Developer Tools & Code Intelligence, Security & Compliance
• owasp, penetration-testing, security-scanning, vulnerability, zap

Part of MCP Servers

How do I install MCP ZAP Server?

To run MCP ZAP Server locally, clone the repository from GitHub, ensure Docker Compose is running, and execute the bootstrap-local.sh script followed by dev.sh. This spins up the Java-based MCP server alongside OWASP ZAP and generates your local API keys. You can verify the installation by running the self-serve-doctor.sh script.

What can MCP ZAP Server do?

MCP ZAP Server enables MCP clients and AI agents to orchestrate OWASP ZAP operations. Supported capabilities include intent-driven spiders, passive and active scanning, importing OpenAPI specifications, exporting vulnerability findings, generating formal security reports, and executing low-level ZAP context controls under strict rate limits and policy bundles.

Which MCP clients work with MCP ZAP Server?

It functions over streamable HTTP with any client supporting the Model Context Protocol, including Cursor and Open WebUI. Host-side clients point to the local HTTP endpoint and authenticate via an API key or JWT token generated during server setup.

Is MCP ZAP Server open source?

Yes, MCP ZAP Server is an open-source project hosted on GitHub under an open-source license. It is an independent implementation and is not officially affiliated with or endorsed by OWASP or the OWASP ZAP project.