Zscaler Zero Trust Exchange
PYPI · ZSCALER-MCP · 2 COMPONENTS · SCANNED SEP 20
Manage Zscaler Zero Trust Exchange via 400+ tools — ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 8 of 85 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 31 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 37993 tokens (~149/item across 254 items; 254 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage77
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 19% of tool parameters carry a description.Partial
- Structured output schemas are declared (4% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 254 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 254 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the Zscaler Zero Trust Exchange MCP server?
Zscaler Zero Trust Exchange runs locally as a PyPI package, launched with uvx zscaler-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · zscaler-mcp
claude mcp add zscaler-zscaler-mcp-server -- uvx zscaler-mcp
{
"mcpServers": {
"zscaler-zscaler-mcp-server": {
"command": "uvx",
"args": [
"zscaler-mcp"
]
}
}
} {
"servers": {
"zscaler-zscaler-mcp-server": {
"command": "uvx",
"args": [
"zscaler-mcp"
]
}
}
} codex mcp add zscaler-zscaler-mcp-server -- uvx zscaler-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"zscaler-zscaler-mcp-server": {
"type": "local",
"command": [
"uvx",
"zscaler-mcp"
],
"enabled": true
}
}
} openclaw mcp add zscaler-zscaler-mcp-server --command uvx --arg zscaler-mcp
mcp_servers:
zscaler-zscaler-mcp-server:
command: "uvx"
args: ["zscaler-mcp"] {
"McpServers": {
"zscaler-zscaler-mcp-server": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"zscaler-mcp"
]
}
}
} assistant mcp add zscaler-zscaler-mcp-server -t stdio -c uvx -a zscaler-mcp
{
"mcpServers": {
"zscaler-zscaler-mcp-server": {
"command": "uvx",
"args": [
"zscaler-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- 16 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- 14 Sept 26 +13
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.87 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 −3
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/zscaler-mcp@0.15.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 85 packages
| Packages resolved | 85 |
|---|---|
| Stale | 7 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_zia_dlp_dictionaries ~189
Read ZIA DLP dictionaries: list all/lite, or fetch one by ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| dict_id | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zia_dlp_engines ~189
Read ZIA DLP engines: list all/lite, or fetch one by ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| engine_id | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zia_user_departments ~215
Read ZIA user departments: list with filters, or fetch one by ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| department_id | – | – | – |
| limit_search | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
| sort_by | – | – | – |
| sort_order | – | – | – |
No output schema declared.
No examples provided.
get_zia_user_groups ~213
Read ZIA user groups: fetch by ID, find by name, or list (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| defined_by | – | – | – |
| group_id | – | – | – |
| name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
| sort_by | – | – | – |
| sort_order | – | – | – |
No output schema declared.
No examples provided.
get_zia_users ~198
Read ZIA users: list with optional filters, or fetch one by ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| dept | – | – | – |
| group | – | – | – |
| name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| user_id | – | – | – |
No output schema declared.
No examples provided.
get_zpa_app_protection_profile ~184
List ZPA App Protection (inspection) profiles, or filter by name (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
get_zpa_app_segments_by_type ~216
Retrieve ZPA application segments filtered by application type (read-only). `application_type` must be BROWSER_ACCESS, INSPECT, or SECURE_REMOTE_ACCESS.
| Name | Type | Req | Description |
|---|---|---|---|
| application_type | string | yes | – |
| expand_all | boolean | – | – |
| microtenant_id | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zpa_enrollment_certificate ~197
Read ZPA enrollment certificates: list all, or look one up by name or ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| certificate_id | – | – | – |
| name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zpa_isolation_profile ~175
List ZPA Cloud Browser Isolation (CBI) profiles, or filter by exact name (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
get_zpa_posture_profile ~189
List ZPA posture profiles, or look one up by ID or name (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| profile_id | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
get_zpa_saml_attribute ~190
List ZPA SAML attributes, optionally scoped to a named IdP (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| idp_name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zpa_scim_attribute ~201
List ZPA SCIM attributes for a named IdP, or fetch one by ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| attribute_id | – | – | – |
| idp_name | string | yes | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zpa_scim_group ~203
Fetch one ZPA SCIM group by ID, or list all groups under a named IdP (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| idp_name | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| scim_group_id | – | – | – |
| search | – | – | – |
No output schema declared.
No examples provided.
get_zpa_trusted_network ~189
List ZPA trusted networks, or look one up by ID or name (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| network_id | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcc_get_device_otp ~87
Get the OTP bundle for a ZCC device (logout / exit / uninstall / disable OTPs). Read-only (GET, no tenant mutation) but the returned values ARE sensitive short-lived credentials — treat them like passwords. Requires the device's `udid` (from `zcc_list_devices`).
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | – | – | – |
| udid | – | – | – |
No output schema declared.
No examples provided.
zcc_list_devices ~236
List ZCC enrolled devices (read-only). Each row is the full device record — identity, OS, agent version, registration state, assigned `policy_name`, ownership, hardware, VPN/tunnel state, and the enrollment / keep-alive timestamps. Use the returned `udid` with `zcc_get_device_otp`.
| Name | Type | Req | Description |
|---|---|---|---|
| os_type | – | – | – |
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| username | – | – | – |
No output schema declared.
No examples provided.
zcc_list_forwarding_profiles ~177
List ZCC forwarding profiles (by company). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
zcc_list_trusted_networks ~178
List ZCC trusted networks (by company). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| page | – | – | – |
| page_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
No output schema declared.
No examples provided.
zcell_get_customer_data_handling ~73
Get the logged-in Zscaler Cellular customer's profile and SIM totals. Read-only. Returns the customer record: identity, activation state, platform, configured regions, SIM counts, current usage, and the linked ZIA/ZPA cloud and SIM-provider metadata. Scoped by ZCELL_CUSTOMER_ID.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
zcell_get_sim_details ~76
Get the full Zscaler Cellular record for one SIM by ICCID. Read-only. Returns the identifying, status, and device fields for the SIM (ICCID, IMSI/IMEI, status, network status, APN, IP, device, tags, usage).
| Name | Type | Req | Description |
|---|---|---|---|
| icc_id | string | yes | – |
No output schema declared.
No examples provided.
zcell_get_sim_location_group ~61
Get one Zscaler Cellular SIM location group. Read-only. Adds the geo-fence definition, linked anomaly policies, and the inside/outside ICCID membership buckets on top of the summary fields.
| Name | Type | Req | Description |
|---|---|---|---|
| group_id | string | yes | – |
No output schema declared.
No examples provided.
zcell_list_anomaly_policies ~237
List Zscaler Cellular anomaly policies. Read-only. Returns one row per policy (id, name, type, enabled state, run status, applied SIM location groups, violation count) over a `days` lookback window. Use the returned `id` with the anomaly-policy logs and violations tools.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| page | – | – | – |
| policy_type | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
No output schema declared.
No examples provided.
zcell_list_anomaly_policy_logs ~205
List the activity log for one Zscaler Cellular anomaly policy. Read-only. Returns the enable/disable/run history (status + message + timestamp) for the given `policy_id`.
| Name | Type | Req | Description |
|---|---|---|---|
| page | – | – | – |
| policy_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
No output schema declared.
No examples provided.
zcell_list_anomaly_policy_violations ~235
List the ICCIDs that violated a Zscaler Cellular anomaly policy. Read-only. Returns the policy rows carrying violation data over a `days` lookback window. Use `zcell_list_iccid_violations` to drill into the per-event detail for a specific ICCID.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| page | – | – | – |
| policy_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
No output schema declared.
No examples provided.
zcell_list_audit_customers_search ~266
Search Zscaler Cellular audit-log entries over a lookback window. Read-only. Returns curated audit rows (who changed what, when, and the operation) over a `days` window, with optional operation/object/visibility filters. The before/after data blobs are omitted from the row.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| modified_by_user_id | – | – | – |
| object_id | – | – | – |
| object_name | – | – | – |
| object_type | – | – | – |
| operation_type | – | – | – |
| page | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
| visibility | – | – | – |
No output schema declared.
No examples provided.
zcell_list_audit_metadata ~185
List the Zscaler Cellular audit filter vocabulary. Read-only. Returns the valid operation types and object types you can pass to `zcell_list_audit_customers_search`.
| Name | Type | Req | Description |
|---|---|---|---|
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_iccid_violations ~222
List the anomaly-policy violation events for one ICCID. Read-only. Returns the individual violation events (event type, zone, timestamp) attributed to `iccid` under `policy_id`, over a `days` lookback window.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| iccid | string | yes | – |
| policy_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_network_events ~248
Search Zscaler Cellular network/session events over a lookback window. Read-only. Returns curated event rows (timestamp, event, outcome, SIM/ICCID, country, carrier, RAT, IP) over a `days` window, with optional `filter_by` conditions, `sort_by`, and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| exclude_apn_config | – | – | – |
| filter_by | – | – | – |
| page | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
| sort_by | – | – | – |
No output schema declared.
No examples provided.
zcell_list_region_operational_status ~204
List Zscaler Cellular configured regions with their operational status. Read-only. Returns each configured region plus the broker-cluster (BC) and app-connector (AC) status blocks and the MAP A-C / B-C link statuses.
| Name | Type | Req | Description |
|---|---|---|---|
| bc_size | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_regions ~181
List the Zscaler Cellular regions available/configured for the customer. Read-only. Returns each region and whether it is configured.
| Name | Type | Req | Description |
|---|---|---|---|
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| skip_sku_check | – | – | – |
No output schema declared.
No examples provided.
zcell_list_sim_analytics_map ~206
List Zscaler Cellular SIM map points (dashboard lat/lng summary). Read-only. Returns SIM location points with their ICCIDs, IMSIs, and tags — the data that backs the fleet map. Optionally scope to specific ICCIDs.
| Name | Type | Req | Description |
|---|---|---|---|
| icc_ids | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_sim_analytics_summary ~180
List the Zscaler Cellular SIM status summary (total/used/active/inactive). Read-only. Returns the SIM-count breakdown for the tenant.
| Name | Type | Req | Description |
|---|---|---|---|
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_sim_location_groups ~217
List Zscaler Cellular SIM location groups. Read-only. Returns one row per group (id, name, tracked ICCIDs). Use the returned `id` with `zcell_get_sim_location_group` for the geo-fence and linked-policy detail.
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| page | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
No output schema declared.
No examples provided.
zcell_list_sim_usage_by_country ~196
List Zscaler Cellular data usage grouped by country (top countries). Read-only. Returns the top countries by data usage over a `days` lookback window.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| limit | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_sim_usage_by_day ~204
List Zscaler Cellular data usage per day over the window. Read-only. Returns one usage bucket per day over a `days` lookback window, optionally scoped to a single ICCID.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| icc_id | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_sim_usage_by_sim ~197
List Zscaler Cellular data usage grouped by SIM (top SIMs). Read-only. Returns the top SIMs by data usage over a `days` lookback window.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
| limit | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zcell_list_sims ~290
Search the Zscaler Cellular SIM inventory with filters and pagination. Read-only (browses the inventory). Returns a page of curated SIM records plus the aggregate usage/pagination envelope. Filter by ICCID, status, network status, country, tag, device attributes, or IMEI lock status.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_name | – | – | – |
| device_type | – | – | – |
| form_factor | – | – | – |
| iccid | – | – | – |
| imei_status | – | – | – |
| ip_address | – | – | – |
| location_country | – | – | – |
| marketing_name | – | – | – |
| model_name | – | – | – |
| network_status | – | – | – |
| page | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
| status | – | – | – |
| tag | – | – | – |
No output schema declared.
No examples provided.
zcell_list_tags ~205
List the Zscaler Cellular SIM tags defined for the customer. Read-only. Returns one row per tag (id, name, provenance). Use the returned tag `id` when assigning tags to SIMs.
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| page | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| size | – | – | – |
No output schema declared.
No examples provided.
zdx_get_alert ~51
Get one ZDX alert as a curated, agent-facing detail view. Read-only. Adds the impacted department / location / geolocation scope to the summary fields.
| Name | Type | Req | Description |
|---|---|---|---|
| alert_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_analysis ~58
Get the status/result of a ZDX score analysis (full record). Read-only. Returns whether the analysis is still running or its results if complete. Start one with `zdx_start_analysis`.
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_id | – | – | Analysis ID. |
| data | object | – | Analysis result payload, if complete. |
| status | – | – | Analysis status (running/complete). |
No examples provided.
zdx_get_application ~102
Get the ZDX score for one application, with its most-impacted regions. Read-only. Returns the headline ZDX score plus the per-region impact breakdown for the `since` HOURS window (default 2h). Use `app_id` from `zdx_list_applications`.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | – |
| department_id | – | – | – |
| geo_id | – | – | – |
| location_id | – | – | – |
| since | – | – | – |
No output schema declared.
No examples provided.
zdx_get_application_metric ~258
Get ZDX performance metrics for one application (time-series). Read-only. Returns one series per metric (Page Fetch Time, DNS Time, availability), each with its datapoints over the `since` HOURS window (default 2h). Pass `metric_name` to narrow to a single metric. Use `app_id` from `zdx_list_applications`.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | – |
| department_id | – | – | – |
| geo_id | – | – | – |
| location_id | – | – | – |
| metric_name | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| since | – | – | – |
No output schema declared.
No examples provided.
zdx_get_application_score_trend ~113
Get the ZDX score trend (over time) for one application. Read-only. Returns the score-over-time datapoints for the `since` HOURS window (default 2h) so the agent can reason about whether an app's experience is improving or degrading. Use `app_id` from `zdx_list_applications`.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | – |
| department_id | – | – | – |
| geo_id | – | – | – |
| location_id | – | – | – |
| since | – | – | – |
No output schema declared.
No examples provided.
zdx_get_application_user ~100
Get one user's ZDX detail for an application (per-device breakdown). Read-only. Returns the user's score plus the nested per-device metrics for the `since` HOURS window (default 2h). Use `app_id` from `zdx_list_applications` and `user_id` from `zdx_list_application_users`.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | – |
| since | – | – | – |
| user_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_deeptrace_cloudpath ~195
Get the cloud-path (hop-by-hop network path) captured during a ZDX deep trace (curated, nested JSON). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| trace_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_deeptrace_cloudpath_metrics ~191
Get cloud-path metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| trace_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_deeptrace_events ~189
Get the events captured during a ZDX deep trace (curated, nested JSON with ISO timestamps). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| trace_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_deeptrace_health_metrics ~190
Get device health metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| trace_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_deeptrace_webprobe_metrics ~192
Get web-probe metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | string | yes | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| trace_id | string | yes | – |
No output schema declared.
No examples provided.
zdx_get_device ~75
Get one active ZDX device. Read-only. The ZDX SDK returns a single-element list; the device record is unwrapped and shaped to the identifying fields.
| Name | Type | Req | Description |
|---|---|---|---|
| department_id | – | – | – |
| device_id | string | yes | – |
| geo_id | – | – | – |
| location_id | – | – | – |
| since | – | – | – |
No output schema declared.
No examples provided.
What is the Zscaler Zero Trust Exchange MCP server?
Zscaler Zero Trust Exchange is an MCP server listed in the public MCP registry as io.github.zscaler/zscaler-mcp-server. Manage Zscaler Zero Trust Exchange via 400+ tools, ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more. This page covers its PyPI package (zscaler-mcp).
Is the Zscaler Zero Trust Exchange MCP server safe to use?
Zscaler Zero Trust Exchange scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Zscaler Zero Trust Exchange MCP server expose?
Zscaler Zero Trust Exchange exposes 254 tools: zeasm_list_findings, zeasm_get_finding_details, zeasm_get_finding_evidence, zeasm_get_finding_scan_output, zeasm_list_lookalike_domains, and 249 more. Their descriptions and schemas cost roughly 37,993 tokens of context every time the server is loaded.
Is the Zscaler Zero Trust Exchange MCP server still maintained?
Zscaler Zero Trust Exchange is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.