"ZAP" matching MCP servers:

Safe, self-hosted OWASP ZAP operator for guided AI security scans, findings, and reports. Requires a separately running OWASP ZAP daemon.

Integrates OWASP ZAP security testing with AI assistants through MCP, enabling automated vulnerability scanning and AI-powered security analysis during development. Supports multiple scan types including active, passive, and AJAX spider scans with real-time status updates.

Enables AI agents to drive OWASP ZAP vulnerability scanning via the Model Context Protocol.

A lightweight MCP server that wraps OWASP ZAP's REST API as Model Context Protocol tools, enabling AI agents to perform automated security scanning.

A WebSocket-based MCP server for OWASP ZAP security scanning, enabling real-time control and monitoring of security assessments.

Enables AI agents to securely read and write SAP ABAP development objects via the ADT REST API, enforcing policy-based guardrails such as package/namespace allow-lists, read-only mode, human approvals, and audit logging.

Enables coding agents to send files and notes into approved Zas channels and read items back, with content encrypted before leaving the machine and scoped, revocable agent access.

Connects Claude to SAP Cloud Platform Integration (CPI) to diagnose failed messages, review iFlows, deploy artifacts, and check credentials directly from your conversation.

An MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.

AI-powered bug bounty hunting platform that integrates security tools (OWASP ZAP, Caido, Burp Suite) for automated reconnaissance, vulnerability testing, JavaScript analysis, and finding management with PostgreSQL storage.

Enables security auditing, penetration testing, and compliance validation with tools like Semgrep, Trivy, Gitleaks, and OWASP ZAP. Features strict project boundary enforcement and supports OWASP, CIS, and NIST compliance frameworks.

Enables querying SAP Security Note metadata including Patch Day releases, CVSS scores, CVEs, affected components, and actively-exploited status via the Model Context Protocol.

Enables agents to inspect pot balances, deposits, deposit addresses, and spend approvals, and to pay for PaidResources on spark/USDB or send to allowlisted Spark addresses within a per-spend cap. Transactions above the cap become human approval tickets, and the pot key remains in the OS keychain so nothing is signed until approval.

Enables AI assistants to perform real-time SAP security audits and risk assessments by analyzing user roles, system parameters, and segregation of duties via RFC integration. It provides 17 specialized tools for monitoring security compliance and generating comprehensive audit reports directly from SAP systems.

Enables auditing an MCP server's declared capabilities, sealing them into a commit-able lock file, and verifying later versions for changes or escalated risk, without invoking any tools and with minimal environment exposure.

Exposes the SAI Verified Agent Protocol as MCP tools so clients acting in agent, verifier, or executor scopes can prepare and submit actions and proposals, submit attestations, and execute approved payments, with status and receipt lookups. Scope selection limits which tools are available per session.

Enables MCP clients to perform administrator-approved, read-only SAP WebGUI lookups of DDIC table fields, data elements, domains, and displayed source over BTP principal propagation. Live reads are disabled by default and require each exact object to be approved and each verified principal mapped to an expected SAP user.

An MCP server that exposes over 20 standard penetration testing utilities, such as Nmap, SQLMap, and OWASP ZAP, as callable tools for AI agents. It enables natural language control over complex security workflows for automated and interactive penetration testing.

Enables users to run AI-assisted security reviews across bug hunting, application security, and infrastructure security by orchestrating tools such as Semgrep, CodeQL, Trivy, Gitleaks, OSV-Scanner, and OWASP ZAP. It produces local JSON and HTML reports with findings, evidence, and unperformed check status for further investigation.

An MCP server over Streamable HTTP that exposes two SAP help-desk operations to an AI agent: sap_reset_password and sap_unlock_users.