MCP ZAP Server — Claude Code MCP server: setup and scans
Connect ZAP to an AI agent for guided web scans, findings, and reports. The server runs locally with Docker Compose.
Open on GitHubWhat MCP ZAP Server does
MCP ZAP Server exposes ZAP tools over Streamable HTTP. An agent can crawl a site, run passive or active scans, import API definitions, inspect findings, and create reports. Lower-level tools provide access to ZAP context, users, scans, and report controls.
Access controls include API-key or JWT authentication, tool scopes, runtime policies, rate limits, and audit events. Local setup requires Docker 20.10+ and Docker Compose v2 or newer with --wait and --wait-timeout support; configure your MCP client separately. Published ports bind to loopback by default. Active scans run only when requested, so keep that distinction in mind before connecting an agent to a project.
Clone the repository, enter its directory, then run ./bin/bootstrap-local.sh --start. Connect a client to http://localhost:7456/mcp and send MCP_API_KEY from .env in the X-API-Key header. Review QUICK_START_SECURITY.md before changing access or scan-target settings.
What it helps with
- crawl a web app and collect passive analysis results
- import an API definition for ZAP testing
- inspect security findings from a scan
- create an HTML report and read it through MCP
- restrict an agent's access to scanner tools
Example prompts for the agent
- Crawl
http://juice-shop:3000, wait for passive analysis, then show me the findings summary. - Create an HTML report from the crawl results and read it back through MCP.
- Import the API definition and run a ZAP check without starting an active scan.
How to install MCP ZAP Server
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about MCP ZAP Server
How do I install MCP ZAP Server for Claude Code?
You need Docker 20.10+ and Docker Compose v2 or newer with --wait and --wait-timeout support. Run git clone https://github.com/dtkmn/mcp-zap-server.git, then cd mcp-zap-server and ./bin/bootstrap-local.sh --start. Configure your MCP client separately.
What does MCP ZAP Server do?
It gives an AI agent MCP access to ZAP workflows for crawling, scanning, reviewing findings, and generating reports. Active scans run only on request.
What does an MCP client need to connect?
The client must support Streamable HTTP and custom headers. Send MCP_API_KEY from .env as the X-API-Key header when connecting to http://localhost:7456/mcp.
