MCP ZAP Server MCP Server

Name: MCP ZAP Server MCP Server
Author: io.github.dtkmn

io.github.dtkmn/mcp-zap-server

Repository Registry

What is the MCP ZAP Server MCP server?

Safe, self-hosted OWASP ZAP operator for guided AI security scans and reports.

How to install MCP ZAP Server

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

ZAP_API_URL
Hostname or URL of a separately running OWASP ZAP daemon reachable from this container.
ZAP_API_PORT
OWASP ZAP API port.
ZAP_API_KEY
required
secret
API key configured on the OWASP ZAP daemon.
MCP_API_KEY
required
secret
API key clients must send as X-API-Key.
MCP_SERVER_TOOLS_SURFACE
Tool surface to expose. Use guided for the safer default workflow, or expert when clients need raw ZAP tools such as zap_report_read.
MCP_SECURITY_MODE
MCP_SECURITY_ENABLED
MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.8.0",
        "--network",
        "mcp-zap-network",
        "--user",
        "1000:1000",
        "-p",
        "127.0.0.1:7456:7456",
        "-v",
        "mcp-zap-wrk:/zap/wrk"
      ],
      "env": {
        "ZAP_API_URL": "<YOUR_ZAP_API_URL>",
        "ZAP_API_PORT": "<YOUR_ZAP_API_PORT>",
        "ZAP_API_KEY": "<YOUR_ZAP_API_KEY>",
        "MCP_API_KEY": "<YOUR_MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<YOUR_MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<YOUR_MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<YOUR_MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<YOUR_MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.8.0",
        "--network",
        "mcp-zap-network",
        "--user",
        "1000:1000",
        "-p",
        "127.0.0.1:7456:7456",
        "-v",
        "mcp-zap-wrk:/zap/wrk"
      ],
      "env": {
        "ZAP_API_URL": "<YOUR_ZAP_API_URL>",
        "ZAP_API_PORT": "<YOUR_ZAP_API_PORT>",
        "ZAP_API_KEY": "<YOUR_ZAP_API_KEY>",
        "MCP_API_KEY": "<YOUR_MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<YOUR_MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<YOUR_MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<YOUR_MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<YOUR_MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.8.0",
        "--network",
        "mcp-zap-network",
        "--user",
        "1000:1000",
        "-p",
        "127.0.0.1:7456:7456",
        "-v",
        "mcp-zap-wrk:/zap/wrk"
      ],
      "env": {
        "ZAP_API_URL": "<YOUR_ZAP_API_URL>",
        "ZAP_API_PORT": "<YOUR_ZAP_API_PORT>",
        "ZAP_API_KEY": "<YOUR_ZAP_API_KEY>",
        "MCP_API_KEY": "<YOUR_MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<YOUR_MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<YOUR_MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<YOUR_MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<YOUR_MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}

VS Code

.vscode/mcp.json

{
  "servers": {
    "mcp-zap-server": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.8.0",
        "--network",
        "mcp-zap-network",
        "--user",
        "1000:1000",
        "-p",
        "127.0.0.1:7456:7456",
        "-v",
        "mcp-zap-wrk:/zap/wrk"
      ],
      "env": {
        "ZAP_API_URL": "<YOUR_ZAP_API_URL>",
        "ZAP_API_PORT": "<YOUR_ZAP_API_PORT>",
        "ZAP_API_KEY": "<YOUR_ZAP_API_KEY>",
        "MCP_API_KEY": "<YOUR_MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<YOUR_MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<YOUR_MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<YOUR_MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<YOUR_MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}

Claude Code

claude mcp add mcp-zap-server --env ZAP_API_URL=<YOUR_ZAP_API_URL> --env ZAP_API_PORT=<YOUR_ZAP_API_PORT> --env ZAP_API_KEY=<YOUR_ZAP_API_KEY> --env MCP_API_KEY=<YOUR_MCP_API_KEY> --env MCP_SERVER_TOOLS_SURFACE=<YOUR_MCP_SERVER_TOOLS_SURFACE> --env MCP_SECURITY_MODE=<YOUR_MCP_SECURITY_MODE> --env MCP_SECURITY_ENABLED=<YOUR_MCP_SECURITY_ENABLED> --env MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY=<YOUR_MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY> -- docker run -i --rm ghcr.io/dtkmn/mcp-zap-server:v0.8.0 --network mcp-zap-network --user 1000:1000 -p 127.0.0.1:7456:7456 -v mcp-zap-wrk:/zap/wrk