How do I install MCP ZAP Server?

Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.

Is MCP ZAP Server official?

No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.

How is the trust score calculated?

This listing scores 29 (Limited). The formula is published on the methodology page.

MCPpedia

MCP ZAP Server MCP Server | MCPpedia

MCP ZAP Server MCP Server

Name: MCP ZAP Server MCP Server
Author: dtkmn

Safe, self-hosted ZAP operator for guided AI security scans and reports.

Tools Versions Alternatives

Registrydtkmn

29Limited

Install

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "dtkmn-mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.16.0"
      ],
      "env": {
        "ZAP_API_URL": "mcp-zap-zap",
        "ZAP_API_PORT": "8090",
        "ZAP_API_KEY": "YOUR_ZAP_API_KEY",
        "MCP_API_KEY": "YOUR_MCP_API_KEY",
        "MCP_SERVER_TOOLS_SURFACE": "guided",
        "MCP_SECURITY_MODE": "",
        "MCP_SECURITY_ENABLED": "",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": ""
      }
    }
  }
}

Install guide

Related servers

XposedOrNot Breach Intelligence

68Good

Real-time data-breach lookup and analytics for emails and domains from XposedOrNot.

RegistryRemotexposedornot99 stars

NativeKeel

Environment

Name	Required	Notes
ZAP_API_URL	No	Hostname or URL of a separately running ZAP daemon reachable from this container.
ZAP_API_PORT	No	ZAP API port.
ZAP_API_KEY	Yes	API key configured on the ZAP daemon. Secret.
MCP_API_KEY	Yes	API key clients must send as X-API-Key. Secret.
MCP_SERVER_TOOLS_SURFACE	No	Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.
MCP_SECURITY_MODE	No
MCP_SECURITY_ENABLED	No
MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY	No
ZAP_API_URL	No	Hostname or URL of a separately running ZAP daemon reachable from this container.
ZAP_API_PORT	No	ZAP API port.
ZAP_API_KEY	Yes	API key configured on the ZAP daemon. Secret.
MCP_API_KEY	Yes	API key clients must send as X-API-Key. Secret.
MCP_SERVER_TOOLS_SURFACE	No	Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.
MCP_SECURITY_MODE	No
MCP_SECURITY_ENABLED	No
MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY	No

MCP ZAP Server MCP Server

Install

Related servers

XposedOrNot Breach Intelligence

NativeKeel

Environment

Tools

About

FAQ

Reviews

fmsg

SkillTotal

mcp-abap-adt

Edgar