MCP server for OWASP ZAP vulnerability scanning with Docker management
{
"ZAP_BASE_URL": "YOUR_VALUE_HERE",
"ZAP_API_KEY": "YOUR_VALUE_HERE"
}Add this server entry to the mcpServers object in your Claude Desktop config, then restart the app.
{
"mcpServers": {
"io-github-pierre3-zap-mcp": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-io-github-pierre3-zap-mcp"
],
"env": {
"ZAP_BASE_URL": "YOUR_VALUE_HERE",
"ZAP_API_KEY": "YOUR_VALUE_HERE"
}
}
}
}~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonNo remote HTTP endpoint is advertised. Use the package or stdio setup shown in Install.
OWASP ZAP MCP Server is an MCP server for MCP server for OWASP ZAP vulnerability scanning with Docker management. It supports STDIO transport.
Use the client-specific config in Install and add it to your MCP-compatible client.
Choose the Claude Desktop tab in Install and copy the config into Claude Desktop's MCP server settings.
Choose the Claude Code tab in Install and copy the config into Claude Code's MCP server settings.
Choose the Codex tab in Install and copy the config into Codex's MCP server settings.
Choose the Cursor or VS Code tab in Install and copy the config into Cursor or VS Code's MCP server settings.
OWASP ZAP MCP Server uses STDIO transport. Use the package or command config in Install.
OWASP ZAP MCP Server inventory is listed when the MCP endpoint exposes tools, resources, or prompts. Some servers require auth first.
OWASP ZAP MCP Server does not advertise a verified auth requirement. If discovery fails, it may still need provider login, an API key, a bearer token, or a session header.
| Package | Registry | Version | Inputs |
|---|---|---|---|
dotnet-zap-mcpstdio | nuget | 1.1.0 | Env: ZAP_BASE_URL Env: ZAP_API_KEY |