Skip to main content
Glama
dtkmn

MCP ZAP Server

by dtkmn
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Hybrid

Related Servers

Alternatives to MCP ZAP Server

No user-submitted related servers found.

    Related Servers

    • OWASP ZAP MCP Server

      Neeraj829784
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables AI assistants to drive OWASP ZAP for authorized penetration testing and bug-bounty workflows, including authenticated scans and vulnerability triage through 67 curated safety-gated tools.
      1
      MIT

    • ZAP MCP Server

      LisBerndt
      A
      license
      Not graded
      quality
      D
      maintenance
      Integrates OWASP ZAP security testing with AI assistants through MCP, enabling automated vulnerability scanning and AI-powered security analysis during development. Supports multiple scan types including active, passive, and AJAX spider scans with real-time status updates.
      5
      MIT

    • ZAP MCP Proxy

      madmystic
      F
      license
      Not graded
      quality
      D
      maintenance
      A lightweight MCP server that wraps OWASP ZAP's REST API as Model Context Protocol tools, enabling AI agents to perform automated security scanning.
      -

    • middleBrick

      middleBrick
      A
      license
      Not graded
      quality
      D
      maintenance
      Scan APIs for security vulnerabilities and get OWASP risk scores. Detects auth bypass, BOLA/IDOR, data exposure, prompt injection, and 12+ security categories.
      96 npm
      Apache 2.0
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.8/5.0

    Scored across 21 tools

    Disambiguation4/5

    Crawl, attack, passive scan, auth, report, findings, and history operations are generally well separated by distinct resource+action names. The main overlap is within scan history (list/get/export/release_evidence/customer_handoff) and report_read vs report_read_chunk, but descriptions clarify their roles. A few boundary cases remain, such as choosing among history export variants, which adds mild confusion.

    Naming Consistency5/5

    All tools consistently use the zap_ prefix followed by snake_case resource/action naming (e.g., zap_crawl_start, zap_attack_stop, zap_findings_summary). Verb and resource ordering is predictable throughout, with no mixed casing or style deviations.

    Tool Count4/5

    At 21 tools, the count is on the heavy side but reasonable for a security scanning domain that must cover crawl, attack, auth, reports, findings, import, and history workflows. Each tool appears to serve a distinct lifecycle operation, though the history surface is somewhat expansive.

    Completeness4/5

    The surface covers the core lifecycle well: crawl/attack start-stop-status, passive scan wait/status, auth prepare/validate, target import, findings summary/details, report generation/reading, and history inspection/export. Minor gaps exist, such as no explicit alert disposition/false-positive management or session cleanup/configuration tools, but core workflows are covered.

    Maintenance

    ActivityActive
    ResponsivenessWithin a week

    Resources