AI Plugin Index
MCP ZAP Server
CommunityMCP server by dtkmn · updated · ★ 67
Safe, self-hosted ZAP operator for guided AI security scans and reports. MCP ZAP Server is a community project by dtkmn, not verified by a company domain.
Install MCP ZAP Server
Built from the published package, never by AIclaude mcp add mcp-zap-server -e ZAP_API_KEY=YOUR_ZAP_API_KEY -e MCP_API_KEY=YOUR_MCP_API_KEY -- docker run -i --rm -e ZAP_API_KEY -e MCP_API_KEY ghcr.io/dtkmn/mcp-zap-server:v0.17.1Run in your terminal. Add --scope user to use it in every project.
{
"mcpServers": {
"mcp-zap-server": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ZAP_API_KEY",
"-e",
"MCP_API_KEY",
"ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
],
"env": {
"ZAP_API_KEY": "YOUR_ZAP_API_KEY",
"MCP_API_KEY": "YOUR_MCP_API_KEY"
}
}
}
}Settings, Developer, Edit config. Paste into claude_desktop_config.json and restart.
{
"mcpServers": {
"mcp-zap-server": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ZAP_API_KEY",
"-e",
"MCP_API_KEY",
"ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
],
"env": {
"ZAP_API_KEY": "YOUR_ZAP_API_KEY",
"MCP_API_KEY": "YOUR_MCP_API_KEY"
}
}
}
}Add to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project).
{
"servers": {
"mcp-zap-server": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ZAP_API_KEY",
"-e",
"MCP_API_KEY",
"ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
],
"env": {
"ZAP_API_KEY": "YOUR_ZAP_API_KEY",
"MCP_API_KEY": "YOUR_MCP_API_KEY"
}
}
}
}Add to .vscode/mcp.json. VS Code uses "servers", not "mcpServers".
codex mcp add mcp-zap-server --env ZAP_API_KEY=YOUR_ZAP_API_KEY --env MCP_API_KEY=YOUR_MCP_API_KEY -- docker run -i --rm -e ZAP_API_KEY -e MCP_API_KEY ghcr.io/dtkmn/mcp-zap-server:v0.17.1{
"mcpServers": {
"mcp-zap-server": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ZAP_API_KEY",
"-e",
"MCP_API_KEY",
"ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
],
"env": {
"ZAP_API_KEY": "YOUR_ZAP_API_KEY",
"MCP_API_KEY": "YOUR_MCP_API_KEY"
}
}
}
}Add to ~/.gemini/config/mcp_config.json (all projects) or .agents/mcp_config.json (this project).
gemini mcp add mcp-zap-server docker run -i --rm -e ZAP_API_KEY -e MCP_API_KEY ghcr.io/dtkmn/mcp-zap-server:v0.17.1Gemini CLI was replaced by Antigravity CLI in June 2026 and remains only for enterprise licences and paid API keys.
MCP servers run with your permissions and can read what you give them access to. Some need an API key: check the README and add it under env in the mcp-zap-server block.
Last commit 6 days ago
Apache-2.0: permissive, fine for commercial use
Clear description, published package or server URL, 67 stars, original repository
No risky patterns in the files we checked
What you need
| Setting | Needed | What it is |
|---|---|---|
ZAP_Environment variable, secret | Required | API key configured on the ZAP daemon. |
MCP_Environment variable, secret | Required | API key clients must send as X-API-Key. |
ZAP_Environment variable | Optional | Hostname or URL of a separately running ZAP daemon reachable from this container. Default: mcp-zap-zap |
ZAP_Environment variable | Optional | ZAP API port. Default: 8090 |
MCP_Environment variable | Optional | Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface. Default: guided |
MCP_Environment variable | Optional | Not described |
MCP_Environment variable | Optional | Not described |
MCP_Environment variable | Optional | Not described |
From the publisher's entry in the official MCP Registry. Required settings are already in the install config below as placeholders.
Weekly newsletter
Like MCP ZAP Server? Get the best new MCP servers every week
The best new tools, security warnings before you install something risky, and one practical tip. Free, three minute read.
Security check
ANo download-and-run commands, hidden instructions or signs of sending keys out were found.
Checked automatically: README.md. This looks for known risky patterns and is not a full audit. How grades work
Alternatives to MCP ZAP Server
All alternatives →
Your OpenWork org's skills, plugins, workflows, and connections through one OAuth MCP URL.
Model Context Protocol for TypeScript — public Zod schemas (spec + OAuth/OpenID) (with updated dependencies)
Model Context Protocol registry, transports, and OAuth bridges for Electric Agents
Remote proxy for Model Context Protocol, allowing local-only clients to connect to remote servers using oAuth
Public Preview — Security proxy for MCP servers: The Firewall for Model Context Protocol
OAuth MCP for Google, Meta, X, LinkedIn, Reddit, TikTok, GSC, GA4, WordPress and GHL.
MCP ZAP Server: common questions
How do I install MCP ZAP Server?
In Claude Code run claude mcp add mcp-zap-server -e ZAP_API_KEY=YOUR_ZAP_API_KEY -e MCP_API_KEY=YOUR_MCP_API_KEY -- docker run -i --rm -e ZAP_API_KEY -e MCP_API_KEY ghcr.io/dtkmn/mcp-zap-server:v0.17.1. For Claude Desktop, Cursor and VS Code, paste the config shown above and restart. See the install guides.
Is MCP ZAP Server the official server?
MCP ZAP Server is a community project by dtkmn, not verified by a company domain.
Is MCP ZAP Server free?
The code is published under the Apache-2.0 licence. The service it connects to may have its own pricing.
Is MCP ZAP Server safe to use?
It scores 76 of 100. Grades: maintenance A, licence A, quality B. Security check: grade A, no risky patterns found in the files checked. Review the code before you install. How grades work.
What are alternatives to MCP ZAP Server?
Similar MCP servers: OpenWork MCP Gateway, Modelcontextprotocol Core, Agents MCP, MCP Remote.
Does MCP ZAP Server work with ChatGPT?
Not directly. It runs locally, and ChatGPT only connects to remote servers with a URL. Use it in Claude Code, Claude Desktop, Cursor, VS Code or Codex.