List recent scan history and release-evidence entries, including queued scans, direct scan starts, and generated report artifacts.

Read currently recorded alerts, including while scan work is in progress, as a concise grouped risk summary for fast triage. Alert counts do not establish scan completion, coverage, or safety. Requires a nonblank target baseUrl covered by scan evidence visible to the caller.

Get status for a guided active-scan operation.

Prepare a guided auth session from an operator-managed profile. Use a kind=browser profile for Client Spider, or kind=form for HTTP spider and active scans. The requested target must remain on the profile's authorized origin.

Export a release or pilot handoff evidence bundle with summary counts, target coverage, warnings, and bounded ledger entries.

Start a guided active scan for a specific target host or base URL after crawl/import setup. The server decides direct versus queued execution from deployment topology. When authSessionId is supplied, guided attack currently accepts prepared form-login sessions only.

Import an OpenAPI/Swagger definition, GraphQL schema, or SOAP WSDL to prepare API endpoints for testing. Use when you have an API definition; use zap_crawl_start to discover ordinary web pages. Requires a reachable, configured ZAP instance with the matching OpenAPI, GraphQL, or SOAP add-on. Import changes the current ZAP session and may send requests to the definition source and API targets; use only authorized targets. It does not start an active scan: after reviewing import messages, call zap_attack_start with the API target URL only when active testing is permitted and approved. Content mode accepts actual OpenAPI JSON/YAML text with a required full HTTP(S) hostOverride and an explicitly enabled shared filesystem; it cannot read chat attachments automatically. Returns plain text containing definition type, source kind, and import status. URL/file mode also includes source and engine messages; content mode withholds contents, internal paths, and raw engine warning text. Review warnings before proceeding. Invalid inputs, blocked URLs, and ZAP API failures raise errors.

Preview a generated report artifact through MCP after zap_report_generate. If truncated, use zap_report_read_chunk to retrieve the complete artifact in bounded pages.

Generate a human-shareable report artifact using guided defaults. Use this after passive scan backlog drains when you want an export or handoff artifact; use findings summary/details for interactive triage.

Stop a guided active-scan operation.

Read one scan history or release-evidence entry by ID.

Get passive scan backlog and completion status.

Stop a guided crawl operation.

Retrieve a generated UTF-8 report in bounded JSON pages. Append content in order, follow nextOffset until endOfFile=true, and supply the first page's artifactSha256 as expectedSha256 on later pages. Offsets and maxChars count Unicode code points. Artifacts are limited to 50 MiB; the SHA-256 identifies the full original UTF-8 file.

Validate a prepared guided auth session before authenticated crawl or attack flows.

Start a guided crawl for a target host or root URL. The server decides direct versus queued execution from deployment topology. Use strategy=http for traditional server-rendered sites, strategy=client for JavaScript-driven apps using Client Spider, or strategy=browser for the existing AJAX Spider API. strategy=auto starts with HTTP Spider; only an unauthenticated direct HTTP start failure triggers AJAX fallback. Auto does not detect JavaScript coverage. Client Spider requires the Client Side Integration add-on and headless Firefox. Prepared browser authentication sessions require strategy=client; prepared HTTP form-login sessions require http or auto.

Wait for the passive scan backlog to drain before reading findings or generating reports.

Export scan history as inline JSON text for internal evidence processing; no export file is created. Use zap_scan_history_list for a readable listing, zap_scan_history_release_evidence for a summary bundle, or zap_scan_history_customer_handoff for a customer-facing summary. Returns version, generatedAt, retentionDays, entryCount, and entries containing scan/job/artifact records, including internal IDs, paths, and metadata; review before sharing. Only records accessible to the caller in the current workspace are included, newest first. Omitted or blank filters select all accessible records; supplied filters combine with AND. The snapshot is capped by limit, has no pagination, and returns an empty entries array when nothing matches. It does not start scans or contact targets. Querying may delete expired stored ledger entries under the configured retention policy; it does not refresh scan outcomes from ZAP.

Get status for a guided crawl operation.

Generate a customer-safe Markdown handoff summary from scan history without raw internal IDs, backend references, workspace IDs, or metadata.

Drill into findings after reading the summary. Requires a nonblank target baseUrl covered by scan evidence visible to the caller. By default this returns grouped details for matching alerts. Set includeInstances=true when you need bounded raw alert occurrences with concrete URLs, params, evidence, or attack samples.