MCP ZAP Server
Run guided OWASP ZAP security scans and reports through MCP while keeping ZAP self-hosted and separated from the MCP container for safer agent-driven testing.
Overview
MCP ZAP Server is a Ship-phase MCP server for security that operates a self-hosted OWASP ZAP instance for guided AI-driven scans and reports.
What is this MCP server?
- Safe, self-hosted OWASP ZAP operator with guided AI scan flows and report retrieval
- Registry v0.8.0 with streamable-http on localhost:7456 and required X-API-Key header
- Docker Compose documented as easiest path; ZAP runs as external daemon on shared network volume
- Publisher notes: mount mcp-zap-wrk:/zap/wrk so MCP can read ZAP-generated reports (UID/GID 1000:1000)
- Server registry version 0.8.0
- Default MCP URL: http://localhost:7456/mcp (streamable-http)
- OWASP ZAP is an external dependency—not bundled in the MCP image
Community signal: 55 GitHub stars.
What problem does it solve?
Solo devs know they should run ZAP before launch but stall on Docker networking, volumes, and safe agent access to the scanner.
Who is it for?
Indie builders self-hosting OWASP ZAP who want agent-guided DAST with separated MCP and ZAP containers before shipping.
Skip if: Teams wanting fully managed cloud pentest, or anyone unwilling to run and maintain an external ZAP daemon and shared wrk volume.
What do I get? / Deliverables
After Compose setup, API key config, and linked ZAP daemon, your agent can request guided scans and read reports via MCP instead of manual ZAP UI-only workflows.
- Agent-triggered guided OWASP ZAP scans
- Security reports readable via MCP from ZAP wrk volume
- Keyed streamable-http MCP surface on port 7456
Recommended MCP Servers
Journey fit
How it compares
Self-hosted OWASP ZAP MCP operator, not a passive secure-coding linter skill.
Common Questions / FAQ
Who is MCP ZAP Server for?
It is for developers who run OWASP ZAP locally or in Docker and want Claude Code or similar agents to trigger guided scans and fetch reports through MCP.
When should I use MCP ZAP Server?
Use it in ship and security workflows before launch or after major API changes when you need DAST evidence, not during initial product ideation.
How do I add MCP ZAP Server to my agent?
Follow the repo docker-compose and llms-install.md path, start ZAP separately on the configured network, set X-API-Key on http://localhost:7456/mcp, mount the shared /zap/wrk volume, then register the HTTP MCP server in your client.