dtkmn/mcp-zap-server
by Various
Give AI agents a safe, self-hosted ZAP operator for guided web security scans, findings, reports, and production guardrails.
MCP
dtkmn/mcp-zap-server
Added 16 Sept 2026
Overview
A self-hosted MCP server that lets AI agents operate OWASP ZAP for web security scanning. It provides guided scans, retrieves findings and reports, and enforces production guardrails. Written in Java.
Best for
Best for
Teams wanting AI-assisted web security scanning with self-hosted control.
Use cases
- Run guided security scans on web applications
- Fetch and analyze ZAP findings and reports
- Enforce security guardrails in production environments
How to use
Tools exposed
zap_policy_dry_run
Clients listed in this record (not verified here)
Cursor
Notes
65 stars on GitHub. Last updated 2026-09-16. Licensed Apache-2.0.
Pros
- Self-hosted, keeps scan data in your control
- Provides structured access to ZAP for AI agents
- Guided scans reduce misconfiguration risk
Cons
- Requires Java runtime and ZAP setup
- Limited to ZAP capabilities, not a full security suite
- Small community with 65 stars
Pairs with
Other entries in the index that connect to this one. Click through to see the chain.
executeautomation/playwright-mcp-server
Various
Playwright Model Context Protocol Server - Tool to automate Browsers and APIs in Claude Desktop, Cline, Cursor IDE and More 🔌
seleniumbase/SeleniumBase
Various
Browser automation, web scraping, and testing. CDP Mode provides a Stealthy Chromium instance that bypasses bot-detection systems. Includes an MCP server.
semgrep/semgrep
Various
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.