OWASP ZAP MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_BIND | No | Host interface the MCP port binds to. | 127.0.0.1 |
| ZAP_API_KEY | Yes | Must match the ZAP daemon's API key. Required unless ZAP_ALLOW_INSECURE=true. | |
| ZAP_BASE_URL | No | ZAP API base URL. | http://zap:8080 |
| ZAP_REPORT_DIR | No | Report output directory. Must be on the volume shared with ZAP. | /zap/wrk |
| CONNECT_TIMEOUT | No | HTTP connect timeout in seconds. | 10 |
| REQUEST_TIMEOUT | No | HTTP request timeout in seconds. | 60 |
| ZAP_MAX_RETRIES | No | ZAP retry policy: maximum number of retries. | 2 |
| ZAP_RETRY_BACKOFF | No | ZAP retry policy: backoff in seconds. | 0.5 |
| ZAP_ALLOW_INSECURE | No | Development override that allows the server to start without ZAP_API_KEY. | false |
| ZAP_STARTUP_TIMEOUT | No | All-in-one only: seconds to wait for ZAP's API before failing the container. | 300 |
| ZAP_TARGET_ALLOWLIST | No | Comma-separated allowed host suffixes for attackable targets. | |
| ZAP_MAX_RESPONSE_ITEMS | No | Cap on returned list items. | 500 |
| ZAP_BLOCK_PRIVATE_TARGETS | No | Refuse private/loopback targets when true. | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityStale
ResponsivenessNo recent community issues