Skip to main content
Glama
dtkmn

MCP ZAP Server

by dtkmn
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Hybrid

zap_findings_details

Drill into OWASP ZAP scan findings after the summary: retrieve grouped alert details for a base URL, or include bounded raw instances with URLs, params, and evidence.

Instructions

Drill into findings after reading the summary. Requires a nonblank target baseUrl covered by scan evidence visible to the caller. By default this returns grouped details for matching alerts. Set includeInstances=true when you need bounded raw alert occurrences with concrete URLs, params, evidence, or attack samples.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoOptional instance limit used only when includeInstances is true
baseUrlYesRequired nonblank target base URL covered by scan evidence visible to the caller
pluginIdNoOptional plugin ID filter when you already know the ZAP alert/plugin identifier to inspect
alertNameNoOptional alert name filter when you want one alert family only
includeInstancesNoOptional true to include bounded raw instances with concrete URLs and evidence; false returns grouped detail blocks

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv0.14.0
    • changedInput schema / properties / baseUrl / description
      Previous value: -"Optional base URL filter to scope findings to one host or path"New value: +"Required nonblank target base URL covered by scan evidence visible to the caller"
    • changedInput schema / required
      Previous value: -[]New value: +[
+  "baseUrl"
+]
  2. First observed

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the default behavior (grouped details), the opt-in mode and what it yields (bounded raw occurrences with URLs/params/evidence/attack samples), and an access prerequisite (baseUrl must be covered by scan evidence visible to the caller). It stops short of return-format or pagination/limit behavior detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the purpose and prerequisite, then the default behavior, then the opt-in flag. No filler or repetition of schema text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must convey returns and does so at a useful level (grouped blocks vs. bounded raw instances). It is nearly complete for a 5-parameter, single-required read tool, though the shape of a 'grouped detail block' remains unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description goes beyond the schema by clarifying that includeInstances switches between grouped and raw-instance output and that results are bounded, and by framing baseUrl as an evidence-coverage requirement rather than just a string.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('drill into findings') and explicitly positions itself relative to a sibling ('after reading the summary'), so an agent can distinguish it from zap_findings_summary without opening either schema. The two operating modes (grouped vs. instances) are also named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear sequencing rule ('after reading the summary') and an explicit trigger for the includeInstances flag. It does not spell out when NOT to use this tool or name the alternative in a negative form, so it falls short of the 5-level 'when/when-not/alternatives' standard.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools