A
licenseA
qualityD
maintenanceEnables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.
11
10 npm
MIT
Best ZAP MCP Servers
Zap (OWASP ZAP) is an open-source web application security scanner that helps find vulnerabilities in web applications during development and testing.
Why this server?
Integrates OWASP ZAP for dynamic application security testing (DAST) with support for multiple authentication modes and parallel scanning.
Why this server?
Enables creation and validation of workflow diagrams using FlowZap's visual diagramming tool and FlowZap Code DSL, generating shareable playground URLs for workflow visualizations.
AlicenseAqualityDmaintenanceEnables AI assistants to create and validate workflow diagrams using FlowZap's text-based DSL. Generates shareable playground URLs for visualizing flowcharts, process diagrams, and CI/CD pipelines through natural language descriptions.7168 npm5MITWhy this server?
Offers full integration with OWASP ZAP proxy for processing requests, conducting spider scans, performing active security scanning, and managing vulnerability alerts.
AlicenseBqualityCmaintenanceAI-powered bug bounty hunting platform that integrates security tools (OWASP ZAP, Caido, Burp Suite) for automated reconnaissance, vulnerability testing, JavaScript analysis, and finding management with PostgreSQL storage.4749MITWhy this server?
Integrates with OWASP ZAP for automated web application security scanning, including active and passive scanning.
Why this server?
Provides tools for managing and executing web security scans using OWASP ZAP, including spidering, active scanning, passive scanning, API imports, findings, and reports.
AlicenseAqualityBmaintenanceSafe, self-hosted OWASP ZAP operator for guided AI security scans, findings, and reports. Requires a separately running OWASP ZAP daemon.2168Apache 2.0Why this server?
Provides tools for dynamic application security testing (DAST) using OWASP ZAP to identify vulnerabilities in running web applications.
AlicenseBqualityDmaintenanceAn MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.6MITWhy this server?
Leverages OWASP ZAP for web application penetration testing including SQL injection, XSS, and CSRF vulnerability detection
AlicenseBqualityDmaintenanceEnables security auditing, penetration testing, and compliance validation with tools like Semgrep, Trivy, Gitleaks, and OWASP ZAP. Features strict project boundary enforcement and supports OWASP, CIS, and NIST compliance frameworks.7ISCWhy this server?
Accepts ZAP (Zed Attack Proxy) DAST scan report files and uploads their findings to TestChimp via the report-scan-findings tool, tagging them with the scanner type and scan id.
TestChimp MCP Serverofficial
AlicenseNot gradedqualityBmaintenanceEnables coding agents to run QA using coverage signals, in-repo test plans, and release governance, and to call backend API endpoints through MCP tools.849 npmMITWhy this server?
Integrates OWASP ZAP as the dynamic web application scanner for testing running apps (roadmap).
Break Anythingofficial
AlicenseNot gradedqualityBmaintenanceConnects AI coding agents to security tooling so they can inspect authorized code, dependencies, container images, and infrastructure, confirm exploitability, and receive evidence-backed remediation plans.3,839 npmMIT