OWASP ZAP MCP Server
Wraps OWASP ZAP's API with 45 tools that let Claude drive vulnerability scanning end to end. You get spider crawling, active and passive scanning, alert retrieval, and HTML/JSON/XML report generation. It includes Docker Compose management that auto-provisions a ZAP container with API keys and persistent volumes for scan data. The context and authentication tools handle multi-user scenarios, letting you configure form-based or JSON-based auth and run scans as specific users. Reach for this when you want an AI agent to orchestrate security testing workflows instead of clicking through ZAP's UI or writing Python scripts against the raw API.
- GitHub stars
- 3
- tools
- 46
- transport
- STDIO
- env vars
- 2
- last updated
- Mar 31, 2026
Tools
46 toolsPublic tool metadata for what this MCP can expose to an agent.
DockerComposeUpStart the ZAP container and wait for healthy
Start the ZAP container and wait for healthy
No parameter schema in public metadata yet.
DockerComposeDownStop and remove the ZAP container
Stop and remove the ZAP container
No parameter schema in public metadata yet.
DockerComposeStatusCheck container status
Check container status
No parameter schema in public metadata yet.
DockerComposeLogsGet recent container logs
Get recent container logs
No parameter schema in public metadata yet.
GetVersionVerify ZAP connectivity
Verify ZAP connectivity
No parameter schema in public metadata yet.
GetHostsList recorded hosts
List recorded hosts
No parameter schema in public metadata yet.
GetSitesList recorded sites
List recorded sites
No parameter schema in public metadata yet.
GetUrlsList recorded URLs for a base URL
List recorded URLs for a base URL
No parameter schema in public metadata yet.
StartSpiderStart a spider scan to crawl and discover pages
Start a spider scan to crawl and discover pages
No parameter schema in public metadata yet.
GetSpiderStatusCheck spider progress (0-100%)
Check spider progress (0-100%)
No parameter schema in public metadata yet.
GetSpiderResultsGet URLs discovered by spider
Get URLs discovered by spider
No parameter schema in public metadata yet.
StopSpiderStop a running spider scan
Stop a running spider scan
No parameter schema in public metadata yet.
StartActiveScanStart an active vulnerability scan
Start an active vulnerability scan
No parameter schema in public metadata yet.
GetActiveScanStatusCheck active scan progress (0-100%)
Check active scan progress (0-100%)
No parameter schema in public metadata yet.
StopActiveScanStop a running active scan
Stop a running active scan
No parameter schema in public metadata yet.
GetPassiveScanStatusCheck passive scan progress (records remaining)
Check passive scan progress (records remaining)
No parameter schema in public metadata yet.
GetAlertsSummaryAlert counts by risk level
Alert counts by risk level
No parameter schema in public metadata yet.
GetAlertsDetailed alert list with pagination and risk filter
Detailed alert list with pagination and risk filter
No parameter schema in public metadata yet.
GetHtmlReportGenerate HTML scan report
Generate HTML scan report
No parameter schema in public metadata yet.
GetJsonReportGenerate JSON scan report
Generate JSON scan report
No parameter schema in public metadata yet.
GetXmlReportGenerate XML scan report
Generate XML scan report
No parameter schema in public metadata yet.
GetContextListList all contexts defined in ZAP
List all contexts defined in ZAP
No parameter schema in public metadata yet.
GetContextGet context details (scope patterns, etc.)
Get context details (scope patterns, etc.)
No parameter schema in public metadata yet.
CreateContextCreate a new context
Create a new context
No parameter schema in public metadata yet.
RemoveContextDelete a context
Delete a context
No parameter schema in public metadata yet.
IncludeInContextAdd URL include pattern to context scope
Add URL include pattern to context scope
No parameter schema in public metadata yet.
ExcludeFromContextAdd URL exclude pattern to context scope
Add URL exclude pattern to context scope
No parameter schema in public metadata yet.
ImportContextImport a context file into ZAP
Import a context file into ZAP
No parameter schema in public metadata yet.
ExportContextExport a context to file
Export a context to file
No parameter schema in public metadata yet.
GetAuthenticationMethodGet the authentication method configured for a context
Get the authentication method configured for a context
No parameter schema in public metadata yet.
SetAuthenticationMethodSet authentication method (form-based, JSON-based, script-based, HTTP)
Set authentication method (form-based, JSON-based, script-based, HTTP)
No parameter schema in public metadata yet.
SetLoggedInIndicatorSet regex pattern indicating logged-in state
Set regex pattern indicating logged-in state
No parameter schema in public metadata yet.
SetLoggedOutIndicatorSet regex pattern indicating logged-out state
Set regex pattern indicating logged-out state
No parameter schema in public metadata yet.
GetUsersListList all users for a context
List all users for a context
No parameter schema in public metadata yet.
CreateUserCreate a new user
Create a new user
No parameter schema in public metadata yet.
RemoveUserRemove a user
Remove a user
No parameter schema in public metadata yet.
SetAuthenticationCredentialsSet user credentials (username/password)
Set user credentials (username/password)
No parameter schema in public metadata yet.
SetUserEnabledEnable or disable a user
Enable or disable a user
No parameter schema in public metadata yet.
SetForcedUserSet the forced user for a context
Set the forced user for a context
No parameter schema in public metadata yet.
SetForcedUserModeEnabledEnable or disable forced user mode globally
Enable or disable forced user mode globally
No parameter schema in public metadata yet.
GetForcedUserStatusGet forced user mode status and current forced user
Get forced user mode status and current forced user
No parameter schema in public metadata yet.
StartAjaxSpiderStart the Ajax Spider for JavaScript-heavy apps
Start the Ajax Spider for JavaScript-heavy apps
No parameter schema in public metadata yet.
StartAjaxSpiderAsUserStart the Ajax Spider as a specific user
Start the Ajax Spider as a specific user
No parameter schema in public metadata yet.
GetAjaxSpiderStatusGet Ajax Spider status (running/stopped)
Get Ajax Spider status (running/stopped)
No parameter schema in public metadata yet.
GetAjaxSpiderResultsGet Ajax Spider results summary
Get Ajax Spider results summary
No parameter schema in public metadata yet.
StopAjaxSpiderStop the Ajax Spider
Stop the Ajax Spider
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
ZAP_BASE_URLZAP API base URL (default: http://localhost:8090)
ZAP_API_KEYZAP API key. Auto-generated if not set and DockerComposeUp is used.
Readme
dotnet-zap-mcp
MCP (Model Context Protocol) server for OWASP ZAP. Enables AI agents (Claude, GitHub Copilot, etc.) to drive ZAP vulnerability scanning via MCP.
Features
- 45 MCP tools for controlling OWASP ZAP (scanning, alerts, spider, ajax spider, context, authentication, reports, etc.)
- Built-in Docker Compose management (start/stop ZAP with a single tool call)
- Zero-config setup: auto-generates API keys and extracts Docker assets
- Works with any MCP-compatible client (Claude Desktop, VS Code, etc.)
Installation
dotnet tool install -g dotnet-zap-mcp
Prerequisites
Details
- Repository
- github.com/pierre3/dotnet-zap-mcp
- Website
- github.com/pierre3/dotnet-zap-mcp
- Categories
- Cloud & Infrastructure, Security & Pentesting
- Package
dotnet-zap-mcp- Transport
- STDIO
- Registry
- MCP registry, active
More from pierre3
Related Cloud & Infrastructure MCP servers
View all
Dokploy Mcp Serversapientsai/dokploy-mcp-serverDokploy MCP server: manage apps, Docker Compose, databases, domains, backups, and servers.3stars
Kitsune Mcpkaiser-data/kitsune-mcpHot-reload for MCP servers + mount any community server mid-session, Docker optional. No restarts.3stars
Better Unraid MCPmswdev/better-unraid-mcpMonitor and manage an Unraid server from any MCP client: array, Docker, VMs, ZFS, logs, and UPS.3stars
OpenClaw MCP Ecosystemyedanyagamiai-cmd/openclaw-mcp-servers9 remote MCP servers on Cloudflare Workers for AI agents. Free tier + Pro API keys.3stars
DaedalMap CIA World Factbookxyver/daedal-mapCIA World Factbook country indicators: infrastructure, energy, demographics, economy, 2002-2026.2stars
Agent Readymlava/agent-ready-mcpScan any URL for AI agent readability — Vercel Spec, llmstxt.org, and agent-protocol manifests.2stars