{
"mcpServers": {
"owasp-zap-mcp-server-demo": {
"command": "<see-readme>",
"args": []
}
}
}No install config available. Check the server's README for setup instructions.
Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Is it safe?
No package registry to scan.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 367 days ago. 15 stars.
Will it work with my client?
Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
No automated test available for this server. Check the GitHub README for setup instructions.
No known vulnerabilities.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationHave you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Persistent memory using a knowledge graph
Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.
Pre-build reality check. Scans GitHub, HN, npm, PyPI, Product Hunt — returns 0-100 signal.
Monitor browser logs directly from Cursor and other MCP compatible IDEs.
MCP Security Weekly
Get CVE alerts and security updates for Owasp Zap MCP Server Demo and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
A WebSocket-based Mission Control Protocol (MCP) server for OWASP ZAP security scanning, enabling real-time control and monitoring of security assessments.
| Feature | MCP Server | ZAP UI | ZAP API | |---------|------------|---------|---------| | Automation | ✅ Full | ❌ Limited | ✅ Basic | | Real-time Updates | ✅ WebSocket | ✅ Visual | ❌ Polling | | CI/CD Integration | ✅ Native | ❌ Manual | ✅ Complex | | Batch Processing | ✅ Yes | ❌ No | ✅ Limited | | Learning Curve | 🟡 Medium | 🟢 Easy | 🔴 Hard | | Progress Tracking | ✅ Real-time | ✅ Visual | ❌ Manual | | Multiple Domains | ✅ Concurrent | ❌ Sequential | 🟡 Limited | | Error Handling | ✅ Robust | ✅ Basic | ❌ Manual |
mcp_server.py - The engine that powers everything. Start this first - it's your security scanning powerhouse that connects to OWASP ZAP.
mcp_client.py - The brains behind the operation. A powerful SDK that other components use to talk to the server (you won't use this directly).
mcp_cli.py - Your go-to command line tool for scanning. Think of it as your Swiss Army knife for security scanning - simple to use, yet powerful.
test_client.py - A learning tool that shows you the ropes. Perfect for understanding how everything works or testing your setup.
Install OWASP ZAP: Download from https://www.zaproxy.org/download/
Setup Project:
git clone https://github.com/shadsidd/Owasp-Zap-MCP-Server-Demo.git
cd Owasp-Zap-MCP-Server-Demo
python -m venv venv
source venv/bin/activate # Windows: .\venv\Scripts\activate
pip install -r requirements.txt
Start ZAP (requires sudo/admin privileges):
# macOS/Linux
sudo /Applications/ZAP.app/Contents/Java/zap.sh -daemon -port 8080
# Windows (as Administrator)
"C:\Program Files\OWASP\Zed Attack Proxy\zap.bat" -daemon -port 8080
Start MCP Server:
python mcp_server.py
Use the CLI:
# Quick spider scan (passive)
python mcp_cli.py scan example.com
# Full active scan (comprehensive)
python mcp_cli.py fullscan example.com
# Specific scan type with HTML report
python mcp_cli.py scan --scan-type=active --output=html example.com
# Multiple domains scan
python mcp_cli.py scan domain1.com domain2.com
# Scan from file
python mcp_cli.py scan -f domains.txt
The examples/ directory contains scripts demonstrating key features:
basic_scan.py - Core scanning with error handlingauthenticated_scan.py - Form-based and other authentication methodsscan_domains.py - Concurrent scanning of multiple domainscustom_scan_policy.py - Custom rules and thresholdsci_cd_integration.py - CI/CD pipeline integrationreal_time_monitor.py - Live progress and alert monitoringteam_notifications.py - Email, Slack, and Teams notificationscustom_rules.py - Specialized security rulesSudo Requirements:
Port Configuration:
Common Issues:
# Check what's using port 8080
sudo lsof -i :8080
# Kill the process if needed
sudo kill -9 <PID>
# Clear any existing ZAP processes
pkill -f zap
The MCP Server supports multiple scan types: