NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

MCP ZAP Server

io.github.dtkmn/mcp-zap-server ยท v0.17.1

Safe, self-hosted ZAP operator for guided AI security scans and reports.

Website Source code Set it up

Connect Runs on your machine

Terminal
claude mcp add mcp-zap-server -e ZAP_API_URL=<ZAP_API_URL> -e ZAP_API_PORT=<ZAP_API_PORT> -e ZAP_API_KEY=<ZAP_API_KEY> -e MCP_API_KEY=<MCP_API_KEY> -e MCP_SERVER_TOOLS_SURFACE=<MCP_SERVER_TOOLS_SURFACE> -e MCP_SECURITY_MODE=<MCP_SECURITY_MODE> -e MCP_SECURITY_ENABLED=<MCP_SECURITY_ENABLED> -e MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY=<MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY> -- docker run -i --rm ghcr.io/dtkmn/mcp-zap-server:v0.17.1
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
      ],
      "env": {
        "ZAP_API_URL": "<ZAP_API_URL>",
        "ZAP_API_PORT": "<ZAP_API_PORT>",
        "ZAP_API_KEY": "<ZAP_API_KEY>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
      ],
      "env": {
        "ZAP_API_URL": "<ZAP_API_URL>",
        "ZAP_API_PORT": "<ZAP_API_PORT>",
        "ZAP_API_KEY": "<ZAP_API_KEY>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "mcp-zap-server": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.17.1"
      ],
      "env": {
        "ZAP_API_URL": "<ZAP_API_URL>",
        "ZAP_API_PORT": "<ZAP_API_PORT>",
        "ZAP_API_KEY": "<ZAP_API_KEY>",
        "MCP_API_KEY": "<MCP_API_KEY>",
        "MCP_SERVER_TOOLS_SURFACE": "<MCP_SERVER_TOOLS_SURFACE>",
        "MCP_SECURITY_MODE": "<MCP_SECURITY_MODE>",
        "MCP_SECURITY_ENABLED": "<MCP_SECURITY_ENABLED>",
        "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "<MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
ZAP_API_URL
Optional		Hostname or URL of a separately running ZAP daemon reachable from this container.
ZAP_API_PORT
Optional		ZAP API port.
ZAP_API_KEY
Required, secret		API key configured on the ZAP daemon.
MCP_API_KEY
Required, secret		API key clients must send as X-API-Key.
MCP_SERVER_TOOLS_SURFACE
Optional		Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.
MCP_SECURITY_MODE
Optional
MCP_SECURITY_ENABLED
Optional
MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY
Optional

Details

Packageghcr.io/dtkmn/mcp-zap-server:v0.17.1 (OCI, streamable-http)
Packagedocker.io/dtkmn/mcp-zap-server:v0.17.1 (OCI, streamable-http)
First published22 Oct 2026
Last updated22 Oct 2026
Registry nameio.github.dtkmn/mcp-zap-server

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.