Zscaler Zero Trust Exchange

OCI · DOCKER.IO/ZSCALER/ZSCALER-MCP-SERVER:LATEST · 2 COMPONENTS · SCANNED AUG 4

Manage Zscaler Zero Trust Exchange via 280+ tools — ZPA, ZIA, ZDX, ZCC, EASM, and more.

Available components

oci · docker.io/zscaler/zscaler-mcp-server:latest 39 pypi · zscaler-mcp 10

−3 this week 39 39 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security0

Malware scan not yet available for this package.Unverified
CVE data not yet available for this package.Unverified
Install-script risk not yet assessed.Unverified
Dependency-health data not yet available.Unverified

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 7 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability84

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Context-footprint check failed: tool/resource definitions use about 26215 tokens (~103/item across 254 items; 254 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: two runs of the same published version returned different tool surfaces, so we cannot tell a change in the package from a difference in our own sandbox run.Unverified

Tool Coverage77

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
20% of tool parameters carry a description.Partial
Structured output schemas are declared (4% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 2 categories

Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

oci · docker.io/zscaler/zscaler-mcp-server:latest

Claude Codex opencode Hermes Other

# add to Claude Code

claude mcp add zscaler-zscaler-mcp-server -- docker run --rm -i docker.io/zscaler/zscaler-mcp-server:latest

# add to Codex CLI

codex mcp add zscaler-zscaler-mcp-server -- docker run --rm -i docker.io/zscaler/zscaler-mcp-server:latest

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zscaler-zscaler-mcp-server": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "docker.io/zscaler/zscaler-mcp-server:latest"
      ],
      "enabled": true
    }
  }
}

# ~/.hermes/config.yaml

mcp_servers:
  zscaler-zscaler-mcp-server:
    command: "docker"
    args: ["run", "--rm", "-i", "docker.io/zscaler/zscaler-mcp-server:latest"]

// mcp.json

{
  "mcpServers": {
    "zscaler-zscaler-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/zscaler/zscaler-mcp-server:latest"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 +1
- Stability: Stability not yet verified: two runs of the same published version returned different tool surfaces, so we cannot tell a change in the package from a difference in our own sandbox run. security
- Tool coverage: 100% → 4% ▼ functional
- Schema quality: pass → fail ▼ functional
- Tool coverage: 0% → 20% ▲ functional
31 Jul 26 −4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 +31
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- First check of Schema quality: good functional
- First check of Tool coverage: 0 functional
- First check of Schema quality: fail functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 100 functional
26 Jul 26 11

First indexed and scored.
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed oci/docker.io/zscaler/zscaler-mcp-server:latest

Provenance none

Ecosystem: oci · Outcome: none

Reason: no_attestation

MCP tools — 254 exposed · ~26,215 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

zpa_get_app_protection_rule ~44

Get one ZPA app-protection (inspection) policy rule (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
rule_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_application_segment ~33

Get one ZPA application segment.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
segment_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_application_segment_ba ~37

Get one ZPA browser-access application segment.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
segment_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_application_segment_pra ~39

Get one ZPA privileged-remote-access application segment.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
segment_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_application_server ~36

Get one ZPA application server (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
server_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_ba_certificate ~40

Get one ZPA Browser Access certificate by ID (read-only).

Input Output Examples

Name	Type	Req	Description
certificate_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

zpa_get_forwarding_policy_rule ~40

Get one ZPA client forwarding policy rule (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
rule_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_isolation_policy_rule ~39

Get one ZPA isolation policy rule (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
rule_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_lss_config ~35

Get one ZPA LSS configuration by ID (read-only).

Input Output Examples

Name	Type	Req	Description
lss_config_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_lss_log_format ~45

Get the pre-built LSS log-format templates (csv/json/tsv) for a log type (read-only).

Input Output Examples

Name	Type	Req	Description
log_type	string	yes	—

Name	Type	Req	Description
items	—	yes	The catalog payload as returned by ZPA.
kind	string	yes	Catalog kind (e.g. log_types, log_format, status_codes).

No examples provided.

zpa_get_pra_credential ~45

Get one ZPA PRA credential by ID (read-only). Secrets are never returned.

Input Output Examples

Name	Type	Req	Description
credential_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

zpa_get_pra_portal ~40

Get one ZPA PRA portal by ID (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
portal_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_provisioning_key ~43

Get one ZPA provisioning key by ID and type (read-only).

Input Output Examples

Name	Type	Req	Description
key_id	string	yes	—
key_type	string	yes	—

No output schema declared.

No examples provided.

zpa_get_segment_group ~33

Get one ZPA segment group.

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

zpa_get_server_group ~36

Get one ZPA server group (read-only).

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

zpa_get_service_edge ~39

Get one ZPA Service Edge by ID (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
service_edge_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_service_edge_group ~38

Get one ZPA service edge group (read-only).

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

zpa_get_timeout_policy_rule ~38

Get one ZPA timeout policy rule (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
rule_id	string	yes	—

No output schema declared.

No examples provided.

zpa_list_access_policy_rules ~101

List ZPA access policy rules (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zpa_list_app_connector_groups ~117

List ZPA app connector groups (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_app_connectors ~119

List ZPA app connectors with health/status (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_app_protection_rules ~107

List ZPA app-protection (inspection) policy rules (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zpa_list_application_segments ~139

List ZPA application segments. Each row is the full segment record with normalized highlights on top (ids, member domains/server groups, ports, and behavior toggles).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_application_segments_ba ~120

List ZPA browser-access (clientless) application segments.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_application_segments_pra ~118

List ZPA privileged-remote-access application segments.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_application_servers ~115

List ZPA application servers (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_ba_certificates ~107

List ZPA Browser Access certificates (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_forwarding_policy_rules ~103

List ZPA client forwarding policy rules (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zpa_list_isolation_policy_rules ~102

List ZPA isolation policy rules (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zpa_list_lss_client_types ~29

List ZPA LSS client types for the current customer (read-only catalog).

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
items	—	yes	The catalog payload as returned by ZPA.
kind	string	yes	Catalog kind (e.g. log_types, log_format, status_codes).

No examples provided.

zpa_list_lss_configs ~116

List ZPA LSS configurations — what log feed streams where (read-only).

Input Output Examples

Name	Type	Req	Description
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_lss_log_types ~30

List the human-readable LSS source log types ZPA supports (read-only catalog).

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
items	—	yes	The catalog payload as returned by ZPA.
kind	string	yes	Catalog kind (e.g. log_types, log_format, status_codes).

No examples provided.

zpa_list_lss_status_codes ~36

List ZPA LSS session status codes used in config filters (read-only catalog).

Input Output Examples

Name	Type	Req	Description
log_type	—	—	—

Name	Type	Req	Description
items	—	yes	The catalog payload as returned by ZPA.
kind	string	yes	Catalog kind (e.g. log_types, log_format, status_codes).

No examples provided.

zpa_list_pra_credentials ~110

List ZPA PRA credentials (read-only). Secrets are never returned.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_pra_portals ~106

List ZPA PRA portals (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_provisioning_keys ~118

List ZPA provisioning keys of a given type (read-only).

Input Output Examples

Name	Type	Req	Description
key_type	string	yes	—
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_segment_groups ~141

List ZPA segment groups. Each row is the full segment-group record with normalized highlights (ids, enabled state, application-segment counts/ids, timestamps) on top.

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_server_groups ~115

List ZPA server groups (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_service_edge_groups ~117

List ZPA service edge groups (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_service_edges ~136

List individual ZPA Service Edges with health/status (read-only). Distinct from `zpa_list_service_edge_groups` (the parent group resource).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

zpa_list_timeout_policy_rules ~101

List ZPA timeout policy rules (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

ztw_get_discovery_settings ~37

Get ZTW workload-discovery settings (read-only singleton). Returns the decision-bearing knobs plus the full payload in `settings`.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
discovery_role	—	—	Discovery IAM role, if set.
external_id	—	—	External ID, if set.
settings	object	—	Full discovery-settings payload (curated container).

No examples provided.

ztw_list_admins ~136

List ZTW admin users (read-only).

Input Output Examples

Name	Type	Req	Description
include_admin_users	—	—	—
include_api_roles	—	—	—
include_auditor_users	—	—	—
page	—	—	—
page_size	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—
version	—	—	—

No output schema declared.

No examples provided.

ztw_list_ip_destination_groups ~121

List ZTW IP destination groups. Use `exclude_type` to omit a group type (e.g. exclude DSTN_FQDN). Read-only.

Input Output Examples

Name	Type	Req	Description
exclude_type	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

ztw_list_ip_destination_groups_lite ~123

List ZTW IP destination groups via the lighter SDK endpoint (read-only). Same records as `ztw_list_ip_destination_groups`; uses the lite endpoint.

Input Output Examples

Name	Type	Req	Description
exclude_type	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

ztw_list_ip_groups ~111

List ZTW IP groups. `search` is a server-side substring match on the group name. Read-only.

Input Output Examples

Name	Type	Req	Description
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

ztw_list_ip_groups_lite ~119

List ZTW IP groups via the lighter SDK endpoint (read-only). Same records as `ztw_list_ip_groups`; uses the lite endpoint.

Input Output Examples

Name	Type	Req	Description
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

ztw_list_ip_source_groups ~113

List ZTW IP source groups. `search` is a server-side substring match on the group name. Read-only.

Input Output Examples

Name	Type	Req	Description
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

ztw_list_ip_source_groups_lite ~122

List ZTW IP source groups via the lighter SDK endpoint (read-only). Same records as `ztw_list_ip_source_groups`; uses the lite endpoint.

Input Output Examples

Name	Type	Req	Description
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

ztw_list_network_service_groups ~99

List ZTW network service groups (read-only).

Input Output Examples

Name	Type	Req	Description
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 4 Aug

Day	Score
26 Jul	11
27 Jul	42
28 Jul	42
29 Jul	42
30 Jul	42
31 Jul	38
1 Aug	38
2 Aug	38
3 Aug	38
4 Aug	39