Which integrations are available for this server?

Provides tools for interacting with OWASP ZAP's REST API, enabling automated security scanning including spider scans, active scans, alert management, and report generation.

How do I use ZAP MCP Proxy?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ZAP MCP Proxy start an active scan on https://example.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

ZAP MCP Proxy

by madmystic

Overview Schema Related Servers Score Discussions

Python

Local

ZAP MCP Proxy

A lightweight MCP server that wraps OWASP ZAP's REST API as Model Context Protocol tools. Connect your AI agent to OWASP ZAP for automated security scanning.

Prerequisites

OWASP ZAP running in daemon mode (or the mcp-zap-server Docker stack)
Python 3.10+

Related MCP server: OWASP Agentic MCP

Quick Start

# Install dependencies
pip install -r requirements.txt

# Start ZAP in daemon mode (one time)
/Applications/ZAP.app/Contents/MacOS/ZAP.sh -daemon -port 8090 -host 127.0.0.1 -config api.key=changeme

# Start the MCP proxy
python3 zap_mcp_proxy.py

Tools

Tool	Description
`zap_health`	Check connection to ZAP daemon
`zap_version`	Get ZAP version info
`zap_api_info`	List available ZAP API endpoints
`zap_list_scan_policies`	List scan policies (Default, API, Pen Test, etc.)
`zap_list_contexts`	List contexts
`zap_create_context`	Create a new context with URL regex patterns
`zap_delete_context`	Delete a context
`zap_list_sites`	List discovered sites/URLs
`zap_spider_scan`	Start a traditional spider scan
`zap_spider_status`	Check spider scan progress
`zap_ajax_spider_scan`	Start an AJAX spider scan (JS-heavy sites)
`zap_ajax_spider_status`	Check AJAX spider status
`zap_start_active_scan`	Start an active scan with policy selection
`zap_list_active_scans`	List all active scans
`zap_active_scan_progress`	Check active scan progress
`zap_alert_summary`	Alert counts by risk level
`zap_alert_count`	Total alert count
`zap_list_alerts`	List alerts with risk/context filtering
`zap_generate_html_report`	Generate HTML report
`zap_generate_xml_report`	Generate XML report
`zap_generate_markdown_report`	Generate Markdown report

Configuration

Environment variables:

ZAP_HOST — ZAP daemon host (default: 127.0.0.1)
ZAP_PORT — ZAP daemon port (default: 8090)
ZAP_API_KEY — ZAP API key (default: changeme)

Adding to Hermes

hermes mcp add zap -- python3 /path/to/zap_mcp_proxy.py

Or add to ~/.hermes/config.yaml:

mcp_servers:
  zap:
    enabled: true
    command: python3
    args:
      - /path/to/zap_mcp_proxy.py

This server cannot be installed

license - not found

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly
Lightport: Open-Sourcing Glama's AI Gateway
By punkpeye on April 27, 2026.
OpenAI
open source
Tool Definition Quality Score (TDQS)
By punkpeye on April 3, 2026.
mcp

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/madmystic/zap-mcp-proxy'

If you have feedback or need assistance with the MCP directory API, please join our Discord server