Zscaler Zero Trust Exchange — Claude Code MCP server setup
Connects coding agents to Zscaler ZPA, ZIA, and ZDX. It exposes 402 tools to inspect network rules, segments, and posture directly from chat.
claude mcp add zscaler-mcp-server -e ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> -e ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> -e ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> -e ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> -- uvx zscaler-mcpWhat Zscaler Zero Trust Exchange does
This MCP server links your assistant with the Zscaler Zero Trust Exchange platform. It bundles 402 tools covering services such as ZPA, ZIA, ZDX, ZCC, and ZMS. By default, it operates strictly in read-only mode. Commands like list_* and get_* work out of the box, preventing accidental infrastructure modifications.
Any write action (create_*, update_*, delete_*) stays locked until you pass --enable-write-tools or set ZSCALER_MCP_WRITE_ENABLED=true. The server runs via uvx zscaler-mcp. Authentication requires four environment values: client ID, client secret, customer ID, and the vanity domain.
What it helps with
- Inspect ZIA firewall rules straight from the assistant
- List ZPA application segments and segment groups
- Retrieve ZIA rule labels without browsing admin panels
- Audit Zscaler security settings across multiple modules
Example prompts for the agent
- List my ZPA application segments
- Show ZIA firewall rules
- List my ZPA segment groups
How to install Zscaler Zero Trust Exchange
Platform CLI
claude mcp add zscaler-mcp-server -e ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> -e ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> -e ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> -e ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> -- uvx zscaler-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>
Platform CLI
codex mcp add zscaler-zero-trust-exchange --env ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> --env ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> --env ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> --env ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> -- uvx zscaler-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>
Config file
{
"mcpServers": {
"zscaler-zero-trust-exchange": {
"command": "uvx",
"args": [
"zscaler-mcp"
],
"env": {
"ZSCALER_CLIENT_ID": "<ZSCALER_CLIENT_ID>",
"ZSCALER_CLIENT_SECRET": "<ZSCALER_CLIENT_SECRET>",
"ZSCALER_CUSTOMER_ID": "<ZSCALER_CUSTOMER_ID>",
"ZSCALER_VANITY_DOMAIN": "<ZSCALER_VANITY_DOMAIN>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>
Config file
{
"servers": {
"zscaler-zero-trust-exchange": {
"type": "stdio",
"command": "uvx",
"args": [
"zscaler-mcp"
],
"env": {
"ZSCALER_CLIENT_ID": "<ZSCALER_CLIENT_ID>",
"ZSCALER_CLIENT_SECRET": "<ZSCALER_CLIENT_SECRET>",
"ZSCALER_CUSTOMER_ID": "<ZSCALER_CUSTOMER_ID>",
"ZSCALER_VANITY_DOMAIN": "<ZSCALER_VANITY_DOMAIN>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>
Platform CLI
gemini mcp add -e ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> -e ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> -e ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> -e ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> zscaler-zero-trust-exchange uvx zscaler-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Zscaler Zero Trust Exchange
How do I install Zscaler Zero Trust Exchange in Claude Code?
Run `claude mcp add zscaler-mcp-server -e ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> -e ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> -e ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> -e ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> -- uvx zscaler-mcp` with your actual Zscaler API credentials.
What does the Zscaler Zero Trust Exchange MCP server do?
It provides tools for AI agents to query and manage Zscaler network security services, including ZPA and ZIA.
Can the agent accidentally alter Zscaler policies?
No, because the server defaults to read-only operation. Modifying or deleting resources requires starting with --enable-write-tools or configuring ZSCALER_MCP_WRITE_ENABLED=true.
