MCP ZAP Server MCP Setup & Guide

{
  "id": "io.github.dtkmn/mcp-zap-server",
  "type": "mcp-server",
  "version": "0.14.0",
  "displayName": "MCP ZAP Server",
  "description": "Safe, self-hosted ZAP operator for guided AI security scans and reports.",
  "repository": {
    "url": "https://github.com/dtkmn/mcp-zap-server",
    "source": "github"
  },
  "homepage": "https://danieltse.org/mcp-zap-server/",
  "distribution": {
    "packages": [
      {
        "registryType": "oci",
        "identifier": "ghcr.io/dtkmn/mcp-zap-server:v0.14.0",
        "runtimeHint": "docker",
        "transport": "streamable-http",
        "environmentVariables": [
          {
            "name": "ZAP_API_URL",
            "description": "Hostname or URL of a separately running ZAP daemon reachable from this container."
          },
          {
            "name": "ZAP_API_PORT",
            "description": "ZAP API port."
          },
          {
            "name": "ZAP_API_KEY",
            "description": "API key configured on the ZAP daemon.",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "MCP_API_KEY",
            "description": "API key clients must send as X-API-Key.",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "MCP_SERVER_TOOLS_SURFACE",
            "description": "Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface."
          },
          {
            "name": "MCP_SECURITY_MODE"
          },
          {
            "name": "MCP_SECURITY_ENABLED"
          },
          {
            "name": "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY"
          }
        ]
      },
      {
        "registryType": "oci",
        "identifier": "docker.io/dtkmn/mcp-zap-server:v0.14.0",
        "runtimeHint": "docker",
        "transport": "streamable-http",
        "environmentVariables": [
          {
            "name": "ZAP_API_URL",
            "description": "Hostname or URL of a separately running ZAP daemon reachable from this container."
          },
          {
            "name": "ZAP_API_PORT",
            "description": "ZAP API port."
          },
          {
            "name": "ZAP_API_KEY",
            "description": "API key configured on the ZAP daemon.",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "MCP_API_KEY",
            "description": "API key clients must send as X-API-Key.",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "MCP_SERVER_TOOLS_SURFACE",
            "description": "Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface."
          },
          {
            "name": "MCP_SECURITY_MODE"
          },
          {
            "name": "MCP_SECURITY_ENABLED"
          },
          {
            "name": "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY"
          }
        ]
      }
    ],
    "remotes": []
  },
  "dependencies": [],
  "installTargets": [
    "claude-code",
    "claude-desktop",
    "cursor",
    "vscode",
    "trae",
    "cherry-studio",
    "lingma",
    "windsurf",
    "cline",
    "workbuddy"
  ],
  "keywords": [],
  "provenance": {
    "origin": "official-mcp-registry",
    "originalId": "io.github.dtkmn/mcp-zap-server",
    "originalUrl": "https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dtkmn%2Fmcp-zap-server/versions/latest",
    "isOfficial": true,
    "status": "active"
  }
}