OWASP ZAP MCP Server

Connect Runs on your machine

claude mcp add zap-mcp -e ZAP_BASE_URL=<ZAP_BASE_URL> -e ZAP_API_KEY=<ZAP_API_KEY> -- dnx dotnet-zap-mcp --yes

{
  "mcpServers": {
    "zap-mcp": {
      "command": "dnx",
      "args": [
        "dotnet-zap-mcp",
        "--yes"
      ],
      "env": {
        "ZAP_BASE_URL": "<ZAP_BASE_URL>",
        "ZAP_API_KEY": "<ZAP_API_KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "zap-mcp": {
      "command": "dnx",
      "args": [
        "dotnet-zap-mcp",
        "--yes"
      ],
      "env": {
        "ZAP_BASE_URL": "<ZAP_BASE_URL>",
        "ZAP_API_KEY": "<ZAP_API_KEY>"
      }
    }
  }
}

{
  "servers": {
    "zap-mcp": {
      "type": "stdio",
      "command": "dnx",
      "args": [
        "dotnet-zap-mcp",
        "--yes"
      ],
      "env": {
        "ZAP_BASE_URL": "<ZAP_BASE_URL>",
        "ZAP_API_KEY": "<ZAP_API_KEY>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Details

More security servers See all

• BlackVeil DNS & Email Security Scanner

  DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

• Forwardsmith buyer desk (read-only)

  Read-only desk for buyers and assistants: offer, prices, fit check, readiness scan, intake draft.

• MakeItSay

  Change the words in a screenshot or photo and keep the original font and layout.

• Kestrova Solidity Security Scan

  Free Slither scan of Solidity contracts for AI coding agents; optional paid report (1 USDC, x402).

• Paragon Boxing & BJJ Gear Advisor

  Read-only boxing and BJJ gear guidance, sizing, product comparison, rules and identity checks.

• Spurvik EU AI Act

  Live URL scan, AI Act risk check, 24-EU-language Art. 50 badge, HMAC receipts & approval gates.