MCP ZAP Server

What MCP ZAP Server does

MCP ZAP Server gives MCP clients an operator-controlled interface to OWASP ZAP for guided web security workflows. It is designed for self-hosted deployments and uses streamable HTTP rather than a local stdio connection. Agents can request crawls, active or passive scans, API imports, findings summaries, reports, and scan-history information through one curated tool catalog.

The project is an independent implementation and is not affiliated with or endorsed by the ZAP project. Its security category is relevant for teams that want AI-assisted testing while retaining control over targets, permissions, scan modes, and operational access.

How it works

The standard deployment runs the MCP server alongside ZAP, with Docker Compose providing the simplest installation path. Kubernetes deployment is also supported through Helm, and published JVM container images are available for deployment scenarios where ZAP is already running and reachable from the MCP container.

MCP clients connect to the streamable HTTP endpoint at http://localhost:7456/mcp. Authentication uses the MCP_API_KEY value from the environment file in the X-API-Key request header. The default stack binds published ports to loopback. A client can then invoke guided tools to start and monitor work, inspect findings, generate reports, and read report content back through MCP.

Scan operations are queue-managed and include active scans, traditional spider jobs, AJAX Spider jobs, and Client Spider jobs. Durable Postgres state supports scan history and claim-based recovery. Guided workflows also expose status and stop controls, while runtime policy bundles can provide dry-run or enforcement behavior for tool calls.

Setup and configuration

The quick-start path requires Docker 20.10 or newer and Docker Compose v2 or newer with support for --wait and --wait-timeout. Clone the repository and run:

git clone https://github.com/dtkmn/mcp-zap-server.git
cd mcp-zap-server
./bin/bootstrap-local.sh --start

The bootstrap script creates missing settings, preserves existing keys and workspace data, starts the release image, and checks container health and authenticated MCP connectivity. Set IMAGE_TAG deliberately when selecting an image during an upgrade. Review the project’s quick-start security guidance before changing network exposure or scan-target settings.

The repository also describes client-specific setup paths for Codex, Cursor Desktop, Claude Code, and Claude Desktop. An optional MCP ZAP Connect plugin can guide setup in Codex, while a macOS MCPB preview provides setup tools for Claude Desktop. The Apple Silicon package is experimental, locally maintained, unsigned, and not publicly downloadable.

Tools and capabilities

• Guided traditional spider, AJAX Spider, Client Spider, active-scan, and passive-scan workflows.
• API imports, findings summaries and baselines, scan history, evidence export, and report generation.
• Queue status, stop controls, claim-based recovery, and explicit operator recovery actions.
• API-key authentication by default, with optional JWT authentication including refresh and revocation support.
• Tool-scope authorization, runtime policy bundles, request-body limits, rate limits, workspace quotas, structured logs, metrics, and audit events.
• Experimental extension contracts for policy, protection, evidence metadata, and extension metadata APIs.