Best ZAP MCP Servers
Zap (OWASP ZAP) is an open-source web application security scanner that helps find vulnerabilities in web applications during development and testing.
Why this server?
Offers full integration with OWASP ZAP proxy for processing requests, conducting spider scans, performing active security scanning, and managing vulnerability alerts.
AlicenseBqualityCmaintenanceAI-powered bug bounty hunting platform that integrates security tools (OWASP ZAP, Caido, Burp Suite) for automated reconnaissance, vulnerability testing, JavaScript analysis, and finding management with PostgreSQL storage.Last updated4728MITWhy this server?
Enables creation and validation of workflow diagrams using FlowZap's visual diagramming tool and FlowZap Code DSL, generating shareable playground URLs for workflow visualizations.
AlicenseAqualityCmaintenanceEnables AI assistants to create and validate workflow diagrams using FlowZap's text-based DSL. Generates shareable playground URLs for visualizing flowcharts, process diagrams, and CI/CD pipelines through natural language descriptions.Last updated7353MITWhy this server?
Provides tools for dynamic application security testing (DAST) using OWASP ZAP to identify vulnerabilities in running web applications.
AlicenseBqualityCmaintenanceAn MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.Last updated6MITWhy this server?
Leverages OWASP ZAP for web application penetration testing including SQL injection, XSS, and CSRF vulnerability detection
FlicenseBqualityCmaintenanceEnables security auditing, penetration testing, and compliance validation with tools like Semgrep, Trivy, Gitleaks, and OWASP ZAP. Features strict project boundary enforcement and supports OWASP, CIS, and NIST compliance frameworks.Last updated7Why this server?
Imports vulnerability data from OWASP ZAP scans, enabling automated processing of web application security testing results into pentest findings.
Alicense-qualityCmaintenanceAn MCP server that exposes the pentest reporting and automation features of SysReptor as programmable tools for AI agents and automated workflows. It enables users to manage findings, projects, and templates through a standardized interface by wrapping the reptor CLI.Last updated6MITWhy this server?
Integrates with OWASP ZAP to perform dynamic application security testing (DAST) against running web components to identify potential security exposures.
Alicense-qualityDmaintenanceAn automated security engineer that integrates with AI coding assistants to perform vulnerability scanning, static analysis, and AI-driven remediation. It also provides tools for recording and executing self-healing web tests using Playwright, including visual regression and test discovery.Last updated67Why this server?
Integrates with OWASP ZAP (Zed Attack Proxy) to provide AI-powered security testing capabilities including active scans, passive analysis, AJAX spider scans, vulnerability reporting, and session management for web application security assessment.
Alicense-qualityCmaintenanceIntegrates OWASP ZAP security testing with AI assistants through MCP, enabling automated vulnerability scanning and AI-powered security analysis during development. Supports multiple scan types including active, passive, and AJAX spider scans with real-time status updates.Last updated5MITWhy this server?
Conducts Dynamic Application Security Testing (DAST) to identify security vulnerabilities in running web applications through automated scanning.
Alicense-qualityCmaintenanceEnables security scanning of codebases through integrated tools for secret detection, SCA, SAST, and DAST vulnerabilities, with AI-powered remediation suggestions based on findings.Last updatedMITWhy this server?
Integrates OWASP ZAP for automated web application security scanning and vulnerability detection.
Alicense-qualityCmaintenanceProfessional security testing server with 50+ integrated tools for web application vulnerability scanning, reconnaissance, fuzzing, and API testing. Enables comprehensive bug bounty hunting workflows including subdomain enumeration, XSS/SQLi detection, and automated security assessments.Last updatedMIT