Give AI agents a safe, self-hosted OWASP ZAP operator for guided web security scans, findings, reports, and production guardrails.
MCP Zap Server MCP server is a hosted integration for AI assistants that speak the Model Context Protocol. Give AI agents a safe, self-hosted OWASP ZAP operator for guided web security scans, findings, reports, and production guardrails.
Once MCP Zap Server is connected, these are the calls the assistant has available:
self — hosted deployment** with Docker Compose for local adoption and Helm for Kubernetesbootstrap — local.sh creates .env, generates local API keys, and prepares the ZAP workspaceself-serve — doctor.sh checks Docker, auth, MCP initialize, tools/list, guided tools, and a harmless tool callAuthentication — API key mode by default, optional JWT mode with refresh and revocation supportgateway — core and its WebFlux adapter move to 0.8.0, with application data binding migrated to Jackson 3 and managed by the Jackson 3.2.1 BOMapi — key mode is the base runtime defaultmcp-zap-extension — api packages selected policy, protection, evidence, andBeing a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
This sits in the cloud and infrastructure group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. MCP Zap Server's toolset — self, bootstrap, self-serve and 4 more — is a fair guide to whether it matches your workflow. It is maintained by dtkmn; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against MCP Zap Server's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| self | hosted deployment** with Docker Compose for local adoption and Helm for Kubernetes |
| bootstrap | local.sh creates .env, generates local API keys, and prepares the ZAP workspace. |
| self-serve | doctor.sh checks Docker, auth, MCP initialize, tools/list, guided tools, and a harmless tool call. |
| Authentication | API key mode by default, optional JWT mode with refresh and revocation support. |
| gateway | core and its WebFlux adapter move to 0.8.0, with application data binding migrated to Jackson 3 and managed by the Jackson 3.2.1 BOM |
| api | key mode is the base runtime default. |
| mcp-zap-extension | api packages selected policy, protection, evidence, and |
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.