OWASP ZAP MCP Server
NUGET · DOTNET-ZAP-MCP · SCANNED SEP 20
MCP server for OWASP ZAP vulnerability scanning with Docker management
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 172 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability85
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2053 tokens (~44/item across 46 items; 46 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "remove_user" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 46 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the OWASP ZAP MCP Server server?
OWASP ZAP MCP Server runs locally as a NuGet package, launched with dnx dotnet-zap-mcp@1.1.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · dotnet-zap-mcp
claude mcp add pierre3-zap-mcp -- dnx dotnet-zap-mcp@1.1.0 --yes
{
"mcpServers": {
"pierre3-zap-mcp": {
"command": "dnx",
"args": [
"dotnet-zap-mcp@1.1.0",
"--yes"
]
}
}
} {
"servers": {
"pierre3-zap-mcp": {
"command": "dnx",
"args": [
"dotnet-zap-mcp@1.1.0",
"--yes"
]
}
}
} codex mcp add pierre3-zap-mcp -- dnx dotnet-zap-mcp@1.1.0 --yes
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"pierre3-zap-mcp": {
"type": "local",
"command": [
"dnx",
"dotnet-zap-mcp@1.1.0",
"--yes"
],
"enabled": true
}
}
} mcp_servers:
pierre3-zap-mcp:
command: "dnx"
args: ["dotnet-zap-mcp@1.1.0", "--yes"] {
"McpServers": {
"pierre3-zap-mcp": {
"Transport": "stdio",
"Command": "dnx",
"Arguments": [
"dotnet-zap-mcp@1.1.0",
"--yes"
]
}
}
} {
"mcpServers": {
"pierre3-zap-mcp": {
"command": "dnx",
"args": [
"dotnet-zap-mcp@1.1.0",
"--yes"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −2
- Stability: pass → 0.83 functional
- 17 Sept 26 0
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
- 11 Sept 26 −3
- Security disclosure: fail → unverified ▼ functional
- Stability: pass → 0.80 functional
- 10 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed nuget/dotnet-zap-mcp@1.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | nuget |
| Reason | Signature present, unreadable |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_context ~34
Create a new context in ZAP. Returns the context ID.
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | yes | Name for the new context |
No output schema declared.
No examples provided.
create_user ~43
Create a new user for a context. Returns the user ID.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
| name | string | yes | Display name for the user |
No output schema declared.
No examples provided.
docker_compose_down ~21
Stop and remove the OWASP ZAP Docker container.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
docker_compose_logs ~39
Get recent logs from the OWASP ZAP Docker container.
| Name | Type | Req | Description |
|---|---|---|---|
| tail | integer | – | Number of log lines to return (default 50) |
No output schema declared.
No examples provided.
docker_compose_status ~22
Check the status of the OWASP ZAP Docker container.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
docker_compose_up ~40
Start the OWASP ZAP Docker container. Extracts Docker assets, generates config, starts the container, and waits for ZAP to be healthy.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
exclude_from_context ~61
Add a URL regex pattern to exclude from a context's scope (e.g. logout page).
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | yes | Context name |
| regex | string | yes | Regex pattern for URLs to exclude (e.g. http://example\.com/logout) |
No output schema declared.
No examples provided.
export_context ~65
Export a context to a file inside the ZAP container for later re-import.
| Name | Type | Req | Description |
|---|---|---|---|
| contextFilePath | string | yes | Destination file path inside the container (e.g. /zap/wrk/data/contexts/mycontext.context) |
| contextName | string | yes | Context name to export |
No output schema declared.
No examples provided.
get_active_scan_status ~31
Get active scan progress (0-100%).
| Name | Type | Req | Description |
|---|---|---|---|
| scanId | string | yes | Active scan ID |
No output schema declared.
No examples provided.
get_ajax_spider_results ~25
Get the number of results found by the Ajax Spider and a summary.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_ajax_spider_status ~24
Get the current status of the Ajax Spider (running or stopped).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_alerts ~110
Get detailed alerts for a base URL. Returns alert name, risk, URL, description, and solution.
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | yes | Base URL to get alerts for |
| count | integer | – | Number of alerts to return (default 100) |
| riskId | string | – | Filter by risk level: 0=Informational, 1=Low, 2=Medium, 3=High (default: all) |
| start | integer | – | Start index (default 0) |
No output schema declared.
No examples provided.
get_alerts_summary ~38
Get alert summary (count by risk level) for a base URL.
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | yes | Base URL to get alerts for |
No output schema declared.
No examples provided.
get_authentication_method ~29
Get the authentication method configured for a context.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
No output schema declared.
No examples provided.
get_context ~34
Get details of a context (included/excluded URL patterns, technologies, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | yes | Context name |
No output schema declared.
No examples provided.
get_context_list ~17
List all contexts defined in ZAP.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_forced_user_status ~35
Get the current forced user mode status and forced user for a context.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
No output schema declared.
No examples provided.
get_hosts ~19
List hosts that ZAP has recorded through the proxy.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_html_report ~22
Generate an HTML scan report containing all alerts found by ZAP.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_json_report ~22
Generate a JSON scan report containing all alerts found by ZAP.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_passive_scan_status ~20
Get number of records remaining for passive scan.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_sites ~19
List sites that ZAP has recorded through the proxy.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_spider_results ~29
Get URLs discovered by a spider scan.
| Name | Type | Req | Description |
|---|---|---|---|
| scanId | string | yes | Spider scan ID |
No output schema declared.
No examples provided.
get_spider_status ~31
Get spider scan progress (0-100%).
| Name | Type | Req | Description |
|---|---|---|---|
| scanId | string | yes | Spider scan ID |
No output schema declared.
No examples provided.
get_urls ~55
List recorded URLs for a given base URL (e.g. http://host.docker.internal:59803).
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | yes | Base URL to filter (e.g. http://host.docker.internal:59803) |
No output schema declared.
No examples provided.
get_users_list ~27
List all users configured for a context.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
No output schema declared.
No examples provided.
get_version ~16
Get ZAP version to verify connectivity.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_xml_report ~22
Generate an XML scan report containing all alerts found by ZAP.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
import_context ~59
Import a previously exported context file into ZAP. The file must be accessible inside the ZAP container.
| Name | Type | Req | Description |
|---|---|---|---|
| contextFilePath | string | yes | Path to context file inside the container (e.g. /zap/wrk/data/contexts/mycontext.context) |
No output schema declared.
No examples provided.
include_in_context ~66
Add a URL regex pattern to include in a context's scope (e.g. 'http://example\.com.*').
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | yes | Context name |
| regex | string | yes | Regex pattern for URLs to include (e.g. http://example\.com.*) |
No output schema declared.
No examples provided.
remove_context ~29
Delete a context from ZAP.
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | yes | Name of the context to remove |
No output schema declared.
No examples provided.
remove_user ~37
Remove a user from a context.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
| userId | string | yes | User ID to remove |
No output schema declared.
No examples provided.
set_authentication_credentials ~69
Set authentication credentials for a user (e.g. username and password).
| Name | Type | Req | Description |
|---|---|---|---|
| authCredentialsConfigParams | string | yes | URL-encoded credentials (e.g. username=admin&password=secret) |
| contextId | string | yes | Context ID |
| userId | string | yes | User ID |
No output schema declared.
No examples provided.
set_authentication_method ~133
Set the authentication method for a context (e.g. formBasedAuthentication, jsonBasedAuthentication, scriptBasedAuthentication).
| Name | Type | Req | Description |
|---|---|---|---|
| authMethodConfigParams | string | – | URL-encoded config params (e.g. loginUrl=http://example.com/login&loginRequestData=username%3D%7B%25username%25%7D%26password%3D%7B%25password%25%7D) |
| authMethodName | string | yes | Auth method name: formBasedAuthentication, jsonBasedAuthentication, httpAuthentication, or scriptBasedAuthentication |
| contextId | string | yes | Context ID |
No output schema declared.
No examples provided.
set_forced_user ~57
Set the forced user for a context. ZAP will re-authenticate as this user when it detects a logged-out state.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
| userId | string | yes | User ID to force |
No output schema declared.
No examples provided.
set_forced_user_mode_enabled ~37
Enable or disable forced user mode globally.
| Name | Type | Req | Description |
|---|---|---|---|
| enabled | boolean | yes | true to enable forced user mode, false to disable |
No output schema declared.
No examples provided.
set_logged_in_indicator ~69
Set the regex pattern that indicates a user is logged in (matched against responses).
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
| loggedInIndicatorRegex | string | yes | Regex pattern matching logged-in responses (e.g. \\Q<a href="logout">Logout</a>\\E) |
No output schema declared.
No examples provided.
set_logged_out_indicator ~52
Set the regex pattern that indicates a user is logged out (matched against responses).
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
| loggedOutIndicatorRegex | string | yes | Regex pattern matching logged-out responses |
No output schema declared.
No examples provided.
set_user_enabled ~52
Enable or disable a user for authenticated scanning.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | yes | Context ID |
| enabled | boolean | yes | true to enable, false to disable |
| userId | string | yes | User ID |
No output schema declared.
No examples provided.
start_active_scan ~105
Start an active scan (attack test) on a URL. This sends actual attack requests.
| Name | Type | Req | Description |
|---|---|---|---|
| contextId | string | – | Context ID to constrain the scan (optional) |
| inScopeOnly | boolean | – | Only scan URLs in scope (default false) |
| recurse | boolean | – | Scan URLs under the given URL recursively (default true) |
| scanPolicyName | string | – | Scan policy name to use (optional) |
| url | string | yes | Target URL to actively scan |
No output schema declared.
No examples provided.
start_ajax_spider ~88
Start the Ajax Spider to crawl a JavaScript-heavy application using a real browser.
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | – | Context name to constrain the crawl (optional) |
| inScope | boolean | – | Only crawl URLs in scope (default false) |
| subtreeOnly | boolean | – | Restrict crawl to subtree of the URL (default false) |
| url | string | yes | Target URL to crawl |
No output schema declared.
No examples provided.
start_ajax_spider_as_user ~77
Start the Ajax Spider as a specific user for authenticated crawling.
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | yes | Context name |
| subtreeOnly | boolean | – | Restrict crawl to subtree of the URL (default false) |
| url | string | yes | Target URL to crawl |
| userId | string | yes | User ID to crawl as |
No output schema declared.
No examples provided.
start_spider ~102
Start a spider scan to crawl a URL and discover pages.
| Name | Type | Req | Description |
|---|---|---|---|
| contextName | string | – | Context name to constrain the spider (optional) |
| maxChildren | integer | – | Max child nodes per node to crawl (0 = unlimited, default 0) |
| recurse | boolean | – | Crawl recursively (default true) |
| subtreeOnly | boolean | – | Restrict crawl to subtree of the URL (default false) |
| url | string | yes | Target URL to spider |
No output schema declared.
No examples provided.
stop_active_scan ~28
Stop a running active scan.
| Name | Type | Req | Description |
|---|---|---|---|
| scanId | string | yes | Active scan ID to stop |
No output schema declared.
No examples provided.
stop_ajax_spider ~15
Stop the Ajax Spider.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
stop_spider ~28
Stop a running spider scan.
| Name | Type | Req | Description |
|---|---|---|---|
| scanId | string | yes | Spider scan ID to stop |
No output schema declared.
No examples provided.
What is the OWASP ZAP MCP Server server?
OWASP ZAP MCP Server is listed in the public MCP registry as io.github.pierre3/zap-mcp. MCP server for OWASP ZAP vulnerability scanning with Docker management. This page covers its NuGet package (dotnet-zap-mcp).
Is the OWASP ZAP MCP Server server safe to use?
OWASP ZAP MCP Server scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the OWASP ZAP MCP Server server expose?
OWASP ZAP MCP Server exposes 46 tools: get_passive_scan_status, get_ajax_spider_results, set_logged_out_indicator, set_forced_user, get_ajax_spider_status, and 41 more. Their descriptions and schemas cost roughly 2,053 tokens of context every time the server is loaded.
Is the OWASP ZAP MCP Server server still maintained?
OWASP ZAP MCP Server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the OWASP ZAP MCP Server server under?
OWASP ZAP MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.