mcp-zap-server: guided OWASP ZAP scans for agents

Development and security teams that test their own web applications and APIs.

Use it now Want it running at your company?

Recommendedour rating
67gitHub stars
Apache-2.0licence
todaylast update

Use it now

git clone https://github.com/dtkmn/mcp-zap-server.git

Open the original ↗

Third party software. By copying, downloading or installing it you accept the Academy legal notice: you are responsible for reviewing its code and permissions before use.

README.md

Loading the file...

What it does

A self-hosted MCP server that gives AI agents access to OWASP ZAP for web security scans. It offers guided spider, active and passive scans, API imports, findings summaries and report generation. An operator controls access with API keys or JWT, tool scopes, runtime policies, rate limits and audit events. It is an independent implementation, not part of the ZAP project.

Use cases

01Run a passive scan on a staging website
02Import an API definition and scan its endpoints
03Generate a findings report for a security review

Questions about
mcp-zap-server: guided OWASP ZAP scans for agents.

What is mcp-zap-server: guided OWASP ZAP scans for agents used for?

Development and security teams that test their own web applications and APIs. A self-hosted MCP server that gives AI agents access to OWASP ZAP for web security scans. It offers guided spider, active and passive scans, API imports, findings summaries and report generation. An operator controls access with API keys or JWT, tool scopes, runtime policies, rate limits and audit events. It is an independent implementation, not part of the ZAP project.

How do I install mcp-zap-server: guided OWASP ZAP scans for agents?

Run this in your terminal: git clone https://github.com/dtkmn/mcp-zap-server.git

Is mcp-zap-server: guided OWASP ZAP scans for agents open source?

Yes. The code is on GitHub (dtkmn/mcp-zap-server) under the Apache-2.0 licence.

Is mcp-zap-server: guided OWASP ZAP scans for agents safe to use?

It passed our automatic scan for credential theft, hidden instructions and risky install commands. Third party open source software. Sabemos AI does not maintain it. Check the code and permissions before you connect it to company data.

Related resources

Read the guide: Private AI on your company documents ↗