dotnet-zap-mcp

MCP (Model Context Protocol) server for OWASP ZAP. Enables AI agents (Claude, GitHub Copilot, etc.) to drive ZAP vulnerability scanning via MCP.

Features

14 MCP tools for controlling OWASP ZAP (scanning, alerts, spider, etc.)
Built-in Docker Compose management (start/stop ZAP with a single tool call)
Zero-config setup: auto-generates API keys and extracts Docker assets
Works with any MCP-compatible client (Claude Desktop, VS Code, etc.)

Installation

dotnet tool install -g dotnet-zap-mcp

Prerequisites

.NET 10 SDK
Docker Desktop (for built-in ZAP container management)

Configuration

Zero-config (recommended)

No configuration needed. The agent calls DockerComposeUp which automatically:

Extracts Docker assets to ~/.zap-mcp/docker/
Generates a random API key
Starts the ZAP container on localhost:8090
Waits for ZAP to become healthy

Claude Desktop / Claude Code

Add to your MCP configuration:

{
  "mcpServers": {
    "zap": {
      "command": "zap-mcp"
    }
  }
}

VS Code (Copilot)

Add to .vscode/mcp.json:

{
  "servers": {
    "zap": {
      "command": "zap-mcp"
    }
  }
}

With existing ZAP instance

If you already have a ZAP instance running, pass connection details via environment variables:

{
  "mcpServers": {
    "zap": {
      "command": "zap-mcp",
      "env": {
        "ZAP_BASE_URL": "http://localhost:8090",
        "ZAP_API_KEY": "your-api-key"
      }
    }
  }
}

Available Tools

Docker Management

Tool	Description
`DockerComposeUp`	Start the ZAP container and wait for healthy
`DockerComposeDown`	Stop and remove the ZAP container
`DockerComposeStatus`	Check container status
`DockerComposeLogs`	Get recent container logs

ZAP Scanning

Tool	Description
`GetVersion`	Verify ZAP connectivity
`GetHosts`	List recorded hosts
`GetSites`	List recorded sites
`GetUrls`	List recorded URLs for a base URL
`GetPassiveScanStatus`	Check passive scan progress
`GetAlertsSummary`	Alert counts by risk level
`GetAlerts`	Detailed alert list with pagination
`StartSpider`	Start a spider scan
`GetSpiderStatus`	Check spider progress
`StartActiveScan`	Start an active vulnerability scan
`GetActiveScanStatus`	Check active scan progress
`StopActiveScan`	Stop a running active scan

Typical Workflow

Agent calls DockerComposeUp to start ZAP
Configure browser/Playwright to use ZAP as proxy (http://127.0.0.1:8090)
Browse the target application through the proxy
Agent calls GetPassiveScanStatus to wait for passive scan completion
Agent calls StartActiveScan on key pages
Agent calls GetAlerts to retrieve vulnerability findings
Agent calls DockerComposeDown when done

License

MIT

OWASP ZAP MCP Server