MCP ZAP Server

Overview

MCP ZAP Server is a Model Context Protocol server that brings OWASP ZAP security scanning into any MCP-compatible AI assistant. It enables guided AI security scans and generates reports in a safe, self-hosted environment, letting AI models decide when to invoke scanning tools during conversations or agent workflows.

The server runs locally via Docker using the image ghcr.io/dtkmn/mcp-zap-server:v0.11.0, communicating over stdio on your machine. You'll need to provide ZAP_API_KEY and MCP_API_KEY environment variables for authentication. The project is maintained at dtkmn/mcp-zap-server on GitHub under the Apache-2.0 license, currently at v0.11.0 with 64 stars.

MCP ZAP Server belongs in the AI & Agents category and integrates with MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others. If you maintain this server, claim this listing to verify ownership and keep information up to date.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "mcp_zap_server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.11.0"
      ],
      "env": {
        "ZAP_API_KEY": "<zap-api-key>",
        "MCP_API_KEY": "<mcp-api-key>"
      }
    }
  }
}

Requires ZAP_API_KEY, MCP_API_KEY