dtkmn/mcp-zap-server

Overview

A self-hosted MCP server that lets AI agents operate OWASP ZAP for web security scanning. It provides guided scans, retrieves findings and reports, and enforces production guardrails. Written in Java.

Best for

Best for
Teams wanting AI-assisted web security scanning with self-hosted control.

Use cases

• Run guided security scans on web applications
• Fetch and analyze ZAP findings and reports
• Enforce security guardrails in production environments

How to use

Tools exposed

• zap_policy_dry_run

Tested with

Cursor

Notes

A self-hosted MCP server that lets AI agents operate OWASP ZAP for web security scanning. It provides guided scans, retrieves findings and reports, and enforces production guardrails. Written in Java.

65 stars on GitHub. Last updated 2026-09-16. Licensed Apache-2.0.

Use cases

• Run guided security scans on web applications
• Fetch and analyze ZAP findings and reports
• Enforce security guardrails in production environments

Pros

• Self-hosted, keeps scan data in your control
• Provides structured access to ZAP for AI agents
• Guided scans reduce misconfiguration risk

Cons

• Requires Java runtime and ZAP setup
• Limited to ZAP capabilities, not a full security suite
• Small community with 65 stars

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.