MCP Hub › Developer Tools › MCP ZAP Server

MCP ZAP Server MCP server

by dtkmn · io.github.dtkmn/mcp-zap-server

Safe, self-hosted ZAP operator for guided AI security scans and reports.

🛠 Developer ToolsDockerv0.17.1
Open in MCP HubGitHub repository ↗Website ↗

How to install MCP ZAP Server

Docker

claude mcp add -e ZAP_API_KEY=<your-zap-api-key> -e MCP_API_KEY=<your-mcp-api-key> mcp-zap-server -- docker run -i --rm ghcr.io/dtkmn/mcp-zap-server:v0.17.1

Or add it to your MCP config (Claude Desktop, Cursor, VS Code):

{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
      ],
      "env": {
        "ZAP_API_KEY": "<your-zap-api-key>",
        "MCP_API_KEY": "<your-mcp-api-key>"
      }
    }
  }
}

Environment variables:
ZAP_API_URL – Hostname or URL of a separately running ZAP daemon reachable from this container.
ZAP_API_PORT – ZAP API port.
ZAP_API_KEY (required) – API key configured on the ZAP daemon.
MCP_API_KEY (required) – API key clients must send as X-API-Key.
MCP_SERVER_TOOLS_SURFACE – Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.
MCP_SECURITY_MODE
MCP_SECURITY_ENABLED
MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY

Docker

claude mcp add -e ZAP_API_KEY=<your-zap-api-key> -e MCP_API_KEY=<your-mcp-api-key> mcp-zap-server -- docker run -i --rm docker.io/dtkmn/mcp-zap-server:v0.17.1

Or add it to your MCP config (Claude Desktop, Cursor, VS Code):

{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "docker.io/dtkmn/mcp-zap-server:v0.17.1"
      ],
      "env": {
        "ZAP_API_KEY": "<your-zap-api-key>",
        "MCP_API_KEY": "<your-mcp-api-key>"
      }
    }
  }
}

Environment variables:
ZAP_API_URL – Hostname or URL of a separately running ZAP daemon reachable from this container.
ZAP_API_PORT – ZAP API port.
ZAP_API_KEY (required) – API key configured on the ZAP daemon.
MCP_API_KEY (required) – API key clients must send as X-API-Key.
MCP_SERVER_TOOLS_SURFACE – Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.
MCP_SECURITY_MODE
MCP_SECURITY_ENABLED
MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY

Replace placeholders in <angle brackets> with your own values. Review what a server can access before you enable it.

Details

Version
0.17.1
Published
2026-10-22
Updated
2026-10-22
Namespace
io.github.dtkmn
Source
dtkmn/mcp-zap-server

Similar developer tools servers