# Zscaler Zero Trust Exchange

Connects coding agents to Zscaler ZPA, ZIA, and ZDX. It exposes 402 tools to inspect network rules, segments, and posture directly from chat.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 51
- Author: zscaler
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/zscaler/zscaler-mcp-server
- Updated: 2026-10-12
- HTML: https://affpapa.org/en/nevibecode/mcp/zscaler-zero-trust-exchange

## What it does

This MCP server links your assistant with the Zscaler Zero Trust Exchange platform. It bundles 402 tools covering services such as ZPA, ZIA, ZDX, ZCC, and ZMS. By default, it operates strictly in read-only mode. Commands like `list_*` and `get_*` work out of the box, preventing accidental infrastructure modifications.

Any write action (`create_*`, `update_*`, `delete_*`) stays locked until you pass `--enable-write-tools` or set `ZSCALER_MCP_WRITE_ENABLED=true`. The server runs via `uvx zscaler-mcp`. Authentication requires four environment values: client ID, client secret, customer ID, and the vanity domain.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `ZSCALER_CLIENT_ID`, `ZSCALER_CLIENT_SECRET`, `ZSCALER_CUSTOMER_ID`, `ZSCALER_VANITY_DOMAIN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add zscaler-mcp-server -e ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> -e ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> -e ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> -e ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> -- uvx zscaler-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add zscaler-zero-trust-exchange --env ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> --env ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> --env ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> --env ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> -- uvx zscaler-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "zscaler-zero-trust-exchange": {
            "command": "uvx",
            "args": [
                "zscaler-mcp"
            ],
            "env": {
                "ZSCALER_CLIENT_ID": "<ZSCALER_CLIENT_ID>",
                "ZSCALER_CLIENT_SECRET": "<ZSCALER_CLIENT_SECRET>",
                "ZSCALER_CUSTOMER_ID": "<ZSCALER_CUSTOMER_ID>",
                "ZSCALER_VANITY_DOMAIN": "<ZSCALER_VANITY_DOMAIN>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "zscaler-zero-trust-exchange": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "zscaler-mcp"
            ],
            "env": {
                "ZSCALER_CLIENT_ID": "<ZSCALER_CLIENT_ID>",
                "ZSCALER_CLIENT_SECRET": "<ZSCALER_CLIENT_SECRET>",
                "ZSCALER_CUSTOMER_ID": "<ZSCALER_CUSTOMER_ID>",
                "ZSCALER_VANITY_DOMAIN": "<ZSCALER_VANITY_DOMAIN>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e ZSCALER_CLIENT_ID=<ZSCALER_CLIENT_ID> -e ZSCALER_CLIENT_SECRET=<ZSCALER_CLIENT_SECRET> -e ZSCALER_CUSTOMER_ID=<ZSCALER_CUSTOMER_ID> -e ZSCALER_VANITY_DOMAIN=<ZSCALER_VANITY_DOMAIN> zscaler-zero-trust-exchange uvx zscaler-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from zscaler-mcp <command>

## When to use it
- Inspect ZIA firewall rules straight from the assistant
- List ZPA application segments and segment groups
- Retrieve ZIA rule labels without browsing admin panels
- Audit Zscaler security settings across multiple modules

## Example prompts
- List my ZPA application segments
- Show ZIA firewall rules
- List my ZPA segment groups

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md