Skip to main content
Glama
dtkmn

MCP ZAP Server

zap_crawl_start

Start a guided web crawl on a target URL, selecting auto, HTTP, or browser strategy for JavaScript-heavy or login-protected sites. Optionally use a prepared auth session for form-login access.

Instructions

Start a guided crawl for a target host or root URL. The server decides direct versus queued execution from deployment topology. Use strategy=http for traditional server-rendered sites, strategy=browser for SPAs, login-heavy flows, or JavaScript-driven apps, and strategy=auto when you want the service to pick the default crawl engine. When authSessionId is supplied, guided crawl currently supports prepared form-login sessions on the HTTP spider path only.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
strategyNoOptional crawl strategy. Use auto to prefer the default guided engine, http for traditional pages and simple link discovery, or browser for SPAs, authenticated flows, and JavaScript-heavy navigation.
targetUrlYesTarget host or root URL to crawl, for example https://app.example.com or https://app.example.com/admin
authSessionIdNoOptional prepared auth session ID from zap_auth_session_prepare. Guided crawl currently accepts form-login sessions only and rejects browser strategy when auth is supplied.
idempotencyKeyNoOptional idempotency key used only when guided execution selects queued mode; ignored in direct mode.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it discloses important traits: the server decides direct versus queued execution from deployment topology, and auth support is limited to prepared form-login sessions on the HTTP spider path. It does not, however, describe what the call returns or how to track the resulting crawl, which would be useful for a start operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three focused sentences with the action front-loaded and each subsequent sentence earning its place: strategy selection, auto fallback, and auth limitation. No filler or redundant restatement of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The definition is complete enough for invocation: it tells the agent what URL to provide, how to choose a strategy, and the auth limitation. The main gap is that with no output schema it does not specify the response shape or how to obtain the crawl ID needed for sibling status/stop tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds value by explaining the direct/queued execution model that gives idempotencyKey meaning and extends the authSessionId constraint to 'HTTP spider path only.' This is contextual information beyond the schema property descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Start a guided crawl for a target host or root URL.' It clearly identifies the tool's function and scope, and the guided-crawl framing distinguishes it from sibling operations like zap_attack_start or zap_auth_session_prepare.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit if-then guidance: 'Use strategy=http for traditional server-rendered sites, strategy=browser for SPAs, login-heavy flows...' and 'strategy=auto when you want the service to pick the default crawl engine.' It also gives a clear exclusion for auth: supported only on the HTTP spider path, so an agent knows when not to supply authSessionId with browser strategy.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.