OWASP ZAP

Exposes OWASP ZAP web security scanning capabilities to AI agents via MCP for guided security assessments.

dtkmn 64
Claude CodeClaude DesktopGeneric
View source ↗

This MCP server wraps OWASP ZAP (Zed Attack Proxy) to enable AI agents to perform guided web security scans, retrieve findings, generate reports, and apply production guardrails. Built with Java and Spring Boot, it communicates over HTTP and supports multi-replica deployments with PostgreSQL for durable state. It includes a bundled Open WebUI interface and Docker deployment support.

Source

Repository: https://github.com/dtkmn/mcp-zap-server

Maintain OWASP ZAP?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[OWASP ZAP on getagentictools](https://getagentictools.com/mcp/dtkmn-mcp-zap-server?ref=badge)