MCP ZAP Server

MCP ZAP Server is an open-source, Apache-2.0-licensed project by Daniel Tse that exposes ZAP through MCP over streamable HTTP. AI agents and operators can run spider, active scan, passive scan, API import, findings, and report workflows without custom glue scripts. The latest release listed is v0.16.0, with Linux AMD64 and ARM64 images published on GHCR and Docker Hub. The project states it is independent and not affiliated with or endorsed by the ZAP project.

What It Is

The server is a bridge between an MCP client (one that supports Streamable HTTP and custom headers) and a ZAP instance that scans an authorized target application. It runs alongside ZAP in a Docker Compose stack that also includes demo targets, and the client connects at an MCP endpoint authenticated with an API key sent in the X-API-Key header. Findings, reports, and scan history are returned through MCP so the client can read them back.

Guided and Expert Workflows

Guided tools are intent-first: the server chooses direct or queued execution for crawl and attack steps. Expert tools optionally expose lower-level ZAP context, user, scan, queue, policy, and report controls. Queued jobs cover active scans, traditional spider, AJAX Spider, and Client Spider, with claim-based recovery, durable Postgres state, and evidence export. Optional target form-login lets ZAP authenticate to a target without exposing the password to the AI client.

Guardrails and Deployment

API-key mode is the default, with optional JWT mode supporting refresh and revocation. Operators can apply tool-scope authorization, runtime policy bundles with dry-run and enforcement, rate limits, request body limits, workspace quotas, structured logs, metrics, and audit events. URL validation blocks localhost, private networks, and link-local targets by default. Deployment paths include local Docker Compose and Helm charts for Kubernetes, plus AWS EC2 and EKS starter examples.

Recent Release: v0.16.0

The v0.16.0 release adds scanner-aware findings and CI baselines, whole-plan Automation Framework duration and capability validation, filesystem containment for plans and artifacts, and target-scoped reports that keep root alert evidence. MCP Registry 0.16.0 is listed as active/latest. An extension API offers experimental contracts for policy, protection, evidence, and metadata, and an optional MCP ZAP Connect plugin can guide setup in Codex.