dtkmn/mcp-zap-server

Give AI agents a safe, self-hosted ZAP operator for guided web security scans, findings, reports, and production guardrails.
> **Note** This project is not affiliated with or endorsed by the ZAP project. It is an independent implementation.
mcp-zap-server exposes ZAP through MCP over streamable HTTP so agentic tools can run operator-controlled security workflows without brittle glue scripts or unsafe scanner access.
Use it when you want:
- **safe agentic scanning** with guided defaults for spider, active scan, passive scan, API imports, findings, and reports
- **operator control** through API-key or JWT auth, tool scopes, runtime policy bundles, rate limits, and audit events
- **self-hosted deployment** with Docker Compose for local adoption and Helm for Kubernetes
- **expert ZAP access** when you intentionally need lower-level ZAP context, user, scan, and report controls
Full documentation: danieltse.org/mcp-zap-server
An experimental headless Apple Silicon package
bundles Java and ZAP for HTTP workflows. It is a maintainer-built local preview;
public signing/notarization and fresh-Mac installation remain separate gates.
The private ChatGPT connection guide
explains Secure MCP Tunnel prerequisites and the current verification boundary.
Watch the demo: browser demo or YouTube
Quick Start
Prerequisites:
- Docker 20.10+
- Docker Compose v2 or newer (docker compose) with --wait and --wait-timeout support
- your own MCP client with Streamable HTTP and custom-header support
The default v0.16.0 image is published on Docker Hub and GHCR for Linux AMD64
and ARM64. See the release and upgrade guide
for the verified image digest and upgrade requirements. Existing settings and
selected versions are preserved; set IMAGE_TAG in .env deliberately when
upgrading an existing installation.
Prefer to ask Codex to handle setup? Manually install the optional
MCP ZAP Connect plugin,
then ask it to check prerequisites, start the Docker stack, configure your private
MCP connection and verify status. This workflow has been tested locally in
Codex. The skill can help install missing prerequisites with your approval,
then recheck and continue setup. Scanning is a separate request. The commands
below remain available without the plugin.
This creates missing settings, preserves existing keys and workspace data,
and starts a versioned release image. It reports ready after container health
and authenticated MCP checks pass.
Use Self-Serve First Run for
version selection, configuration, stopping/restarting, startup timeouts,
and recovery. For source builds, use the
contributor setup.
Connect your MCP client:
- MCP endpoint for host-side clients: http://localhost:7456/mcp
- Authentication: send MCP_API_KEY from .env in the X-API-Key header
- MCP client setup and authentication
The stack runs the MCP server, ZAP, and demo targets. Install and configure
your preferred MCP client separately.
After connecting, try this first prompt:
Expect a completed crawl, a findings summary, and a report the client can
read. Use the container URL http://juice-shop:3000 for this scan; the host
preview http://localhost:3001 is for your browser. Finding counts vary;
a connection or scan error is not a clean result.
The default stack binds published ports to loopback. Review
Quick Start Security before changing access or
scan-target settings. Agent install notes cover setup
permissions and standalone OCI use.
Discovery Metadata
This repository includes MCP Registry metadata in .mcp/server.json.
Version 0.16.0 is published as active/latest in the
MCP Registry
with versioned GHCR and Docker Hub images. Use metadata from the same version as
the image you deploy. The image includes the MCP server name expected by
registry and catalog tooling. The release and upgrade guide
records the publication evidence and immutable image digest.
Docker Compose remains the easiest installation path because the MCP server is designed to operate with a ZAP sidecar and explicit auth keys. The OCI package metadata is for advanced standalone installs where ZAP is already running and reachable from the MCP container.