ZAP

You can run and manage an MCP server that connects OWASP ZAP scans with MCP clients. This server automates ZAP startup, session handling, and an MCP endpoint so you can trigger scans, monitor progress, and retrieve results from compatible AI assistants or MCP clients.

How to use

Start the MCP server to expose an endpoint at http://localhost:8082/mcp. Use an MCP client to send tool commands such as starting active, complete, passive, or AJAX scans, check status, or create new sessions. The server handles ZAP startup automatically if it is not already running and creates a session for you. You can connect your MCP client by configuring it to point to http://localhost:8082/mcp and then issue scan commands through the MCP protocol.

How to install

# 1) Prerequisites
# - Python 3.8+
# - OWASP ZAP installed and accessible via PATH
# - Java (required by ZAP)
# - Docker or Podman (optional, for containerized deployment)
# - Firefox ESR (needed for AJAX scans in containers)

# 2) Local installation (recommended)
# - Install Python dependencies
pip install -r requirements.txt

# - Start the MCP server directly
python -m zap_custom_mcp

Configuration and startup notes

The server uses environment variables to configure ports and endpoints. By default, the ZAP API port is http://127.0.0.1:8080, and the MCP endpoint is served on port 8082. The server can auto-detect container environments and automatically transform localhost URLs to the correct host gateway when running inside containers.

Additional setup options

# Optional: customize ports via a .env file
cp env.example .env
# Edit .env to set:
# ZAP_PORT=8081
# ZAP_MCP_PORT=8083
# ZAP_BASE=http://127.0.0.1:8081

# Then start containers (if using Docker/Podman)
./start.sh

Connecting your MCP client

Point your MCP client to the MCP URL http://localhost:8082/mcp to issue scan commands such as start_active_scan, start_complete_scan, start_passive_scan, start_ajax_scan, or to manage sessions.

Available tools

start_active_scan

Initiates an active security scan including spider and active tests against the target URL.

start_complete_scan

Runs a complete scan including AJAX spider, spider, active, and passive tests to produce comprehensive results.

start_passive_scan

Performs passive security analysis on the target without active probing.

start_ajax_scan

Executes an AJAX spider to crawl modern web apps that heavily use JavaScript.

get_scan_status

Retrieves real-time status and progress for ongoing scans.

cancel_scan

Cancels a currently running scan.

list_scans

Lists all active or past scans managed by the MCP server.

create_new_session

Creates a new ZAP session for isolated scanning context.