# MCP ZAP Server

Connect ZAP to an AI agent for guided web scans, findings, and reports. The server runs locally with Docker Compose.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 67
- Author: dtkmn
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/dtkmn/mcp-zap-server
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-zap-server

## What it does

MCP ZAP Server exposes ZAP tools over Streamable HTTP. An agent can crawl a site, run passive or active scans, import API definitions, inspect findings, and create reports. Lower-level tools provide access to ZAP context, users, scans, and report controls.

Access controls include API-key or JWT authentication, tool scopes, runtime policies, rate limits, and audit events. Local setup requires Docker 20.10+ and Docker Compose v2 or newer with `--wait` and `--wait-timeout` support; configure your MCP client separately. Published ports bind to loopback by default. Active scans run only when requested, so keep that distinction in mind before connecting an agent to a project.

Clone the repository, enter its directory, then run `./bin/bootstrap-local.sh --start`. Connect a client to `http://localhost:7456/mcp` and send `MCP_API_KEY` from `.env` in the `X-API-Key` header. Review `QUICK_START_SECURITY.md` before changing access or scan-target settings.

## Requirements
- Needs: Docker
- Environment variables: `ZAP_API_URL`, `ZAP_API_PORT`, `ZAP_API_KEY`, `MCP_API_KEY`, `MCP_SERVER_TOOLS_SURFACE`, `MCP_SECURITY_MODE`, `MCP_SECURITY_ENABLED`, `MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- crawl a web app and collect passive analysis results
- import an API definition for ZAP testing
- inspect security findings from a scan
- create an HTML report and read it through MCP
- restrict an agent's access to scanner tools

## Example prompts
- Crawl `http://juice-shop:3000`, wait for passive analysis, then show me the findings summary.
- Create an HTML report from the crawl results and read it back through MCP.
- Import the API definition and run a ZAP check without starting an active scan.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md