Zscaler Zero Trust Exchange
PYPI · ZSCALER-MCP · 2 COMPONENTS · SCANNED SEP 21
Manage Zscaler Zero Trust Exchange via 400+ tools — ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 8 of 85 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 32 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 37993 tokens (~149/item across 254 items; 254 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage77
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 19% of tool parameters carry a description.Partial
- Structured output schemas are declared (4% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 254 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 254 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the Zscaler Zero Trust Exchange MCP server?
Zscaler Zero Trust Exchange runs locally as a PyPI package, launched with uvx zscaler-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · zscaler-mcp
claude mcp add zscaler-zscaler-mcp-server -- uvx zscaler-mcp
{
"mcpServers": {
"zscaler-zscaler-mcp-server": {
"command": "uvx",
"args": [
"zscaler-mcp"
]
}
}
} {
"servers": {
"zscaler-zscaler-mcp-server": {
"command": "uvx",
"args": [
"zscaler-mcp"
]
}
}
} codex mcp add zscaler-zscaler-mcp-server -- uvx zscaler-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"zscaler-zscaler-mcp-server": {
"type": "local",
"command": [
"uvx",
"zscaler-mcp"
],
"enabled": true
}
}
} openclaw mcp add zscaler-zscaler-mcp-server --command uvx --arg zscaler-mcp
mcp_servers:
zscaler-zscaler-mcp-server:
command: "uvx"
args: ["zscaler-mcp"] {
"McpServers": {
"zscaler-zscaler-mcp-server": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"zscaler-mcp"
]
}
}
} assistant mcp add zscaler-zscaler-mcp-server -t stdio -c uvx -a zscaler-mcp
{
"mcpServers": {
"zscaler-zscaler-mcp-server": {
"command": "uvx",
"args": [
"zscaler-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- 16 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- 14 Sept 26 +13
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.87 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed pypi/zscaler-mcp@0.15.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 85 packages
| Packages resolved | 85 |
|---|---|
| Stale | 7 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
zia_url_lookup ~417
Which category does a URL belong to? Use THIS for that question — default. Answers "what category is twilio.com?" directly: pass the URLs and get back Zscaler's classification for each, e.g. `{"url": "notpurple.com", "urlClassifications": ["SPECIALIZED_SHOPPING"]}`. The response is small and scales with the number of URLs you ask about, not with the size of the tenant's category inventory. This returns Zscaler's PREDEFINED classification ONLY. It does not report the tenant's custom categories: a URL an admin placed in a custom category still shows its predefined category here. When the user explicitly asks about CUSTOM categories ("which custom category contains app.box.com?"), make ONE call to `zia_list_url_categories(custom_only=True, contains_url="app.box.com")` — the server does the matching and returns only the categories that contain the URL. Do not answer the custom question from this tool's output, and do not list all categories and scan them yourself. Unless the user says "custom", this tool alone answers the question — stop after it. Up to 100 URLs per request; a URL in no predefined category comes back as `MISCELLANEOUS_OR_UNKNOWN`.
| Name | Type | Req | Description |
|---|---|---|---|
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| urls | array | yes | – |
No output schema declared.
No examples provided.
zid_get_group ~28
Get one ZIdentity group by ID. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| group_id | string | yes | – |
No output schema declared.
No examples provided.
zid_get_group_users ~206
List the users that belong to a ZIdentity group, by group ID. Read-only. Returns lean user summaries (id, login name, display name, primary email) for each member of the group.
| Name | Type | Req | Description |
|---|---|---|---|
| group_id | string | yes | – |
| limit | – | – | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zid_get_group_users_by_name ~208
List the users in a ZIdentity group resolved by group name. Read-only. Resolves the group by case-insensitive partial name first, then returns the lean user summaries for the first matching group's members.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | – |
| name | string | yes | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zid_get_user ~28
Get one ZIdentity user by ID. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| user_id | string | yes | – |
No output schema declared.
No examples provided.
zid_get_user_groups ~209
List the groups a ZIdentity user belongs to, by user ID. Read-only. Returns lean group summaries (id, name, description, dynamic flag, source IdP) for each of the user's group memberships.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| user_id | string | yes | – |
No output schema declared.
No examples provided.
zid_get_user_groups_by_name ~223
List a ZIdentity user's group memberships, resolving the user by name. Read-only. Resolves the user by case-insensitive partial match (email when '@' present, else login then display name), then returns the lean group summaries for the first matching user's memberships.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | – |
| name | string | yes | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zid_list_groups ~217
List ZIdentity groups. Read-only. Returns lean group summaries (id, name, description, dynamic flag, source IdP) rather than the full SDK group record. Pass `name` for a case-insensitive partial-name filter.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude_dynamic_groups | – | – | – |
| limit | – | – | – |
| name | – | – | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zid_list_users ~239
List ZIdentity users. Read-only. Returns lean user summaries (id, login name, display name, primary email) rather than the full SDK user record. Pass any of the `*_name` / email filters for a case-insensitive partial match.
| Name | Type | Req | Description |
|---|---|---|---|
| display_name | – | – | – |
| domain_name | – | – | – |
| idp_name | – | – | – |
| limit | – | – | – |
| login_name | – | – | – |
| offset | – | – | – |
| primary_email | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zid_search_groups ~206
Search ZIdentity groups by name (case-insensitive partial match). Read-only. Returns curated group summaries. An empty result means no group name contains this string — do not retry with split keywords or no filter.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | – |
| name | string | yes | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zid_search_users ~220
Search ZIdentity users by name, login name, or email. Read-only. Case-insensitive partial match. Values containing '@' match email; otherwise login name then display name are tried. An empty result means no user matches — do not retry with split keywords or no filter.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | – |
| name | string | yes | – |
| offset | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zins_get_casb_app_report ~249
Get the CASB (Cloud Access Security Broker) SaaS-application usage report. Read-only analytics. One row per SaaS application with its aggregated usage total, for seeing which cloud apps are being accessed. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_cyber_incidents ~258
Get cyber-security incidents grouped by category. Read-only analytics. Groups incidents by one or more dimensions (default THREAT_CATEGORY_ID); multi-dimension groupings surface their breakdown under nested `entries`. An empty result means no incidents were detected. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| categorize_by | – | – | – |
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_cyber_incidents_by_location ~259
Get cyber-security incidents grouped by location (or app/user/department). Read-only analytics. One id/name/total row per location (or the chosen id-bearing dimension), useful for ranking which sites carry the most incidents. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| categorize_by | string | – | – |
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_cyber_incidents_by_threat_and_app ~265
Get cyber-security incidents correlated by threat category and application. Read-only analytics. Groups by THREAT_CATEGORY_ID × APP_ID so each top-level threat-category bucket carries its per-application breakdown under nested `entries` — useful for finding the most-targeted apps. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_cyber_incidents_daily ~240
Get the daily cyber-security incident trend over time. Read-only analytics. Groups incidents by day (categorize_by=TIME) so you can spot spikes across the window. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_firewall_by_action ~237
Get Zero Trust Firewall traffic grouped by action (allow/block). Read-only analytics. One row per action with its aggregated total — the allowed-vs-blocked split. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_firewall_by_location ~237
Get Zero Trust Firewall traffic grouped by location. Read-only analytics. One id/name/total row per location, for ranking which sites drive the most firewall traffic. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_firewall_network_services ~232
Get Zero Trust Firewall traffic grouped by network service. Read-only analytics. One row per network service (protocol/port) with its aggregated total. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_iot_device_stats ~93
Get IoT device statistics and classifications. Read-only analytics. A single current-state object: total/IoT/user/server/unclassified device counts plus a per-classification breakdown under `entries`. No time window — this reflects the present network state. An empty/zeroed result means no IoT devices were detected or IoT Device Visibility is not enabled.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
No output schema declared.
No examples provided.
zins_get_shadow_it_apps ~255
Get discovered Shadow IT applications with risk and usage detail. Read-only analytics. One row per unsanctioned/discovered app: category, risk index, sanctioned state, data volume, and user count. An empty result means no shadow apps were detected. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_shadow_it_summary ~97
Get the aggregate Shadow IT summary dashboard. Read-only analytics. A single object with org-wide totals (apps, bytes, upload/download) plus breakdowns grouped by category and by risk index. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
No output schema declared.
No examples provided.
zins_get_threat_class ~253
Get threat-class distribution (Virus/Spyware, Advanced, Behavioral). Read-only analytics. One row per threat class with its aggregated total. An empty result means no threats of these classes were detected. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
| traffic_unit | string | – | – |
No output schema declared.
No examples provided.
zins_get_threat_super_categories ~258
Get threat super-categories (malware, phishing, spyware, …) from web traffic. Read-only analytics. One row per threat super-category with its aggregated total. An empty result means no threats were detected in the window. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
| traffic_unit | string | – | – |
No output schema declared.
No examples provided.
zins_get_web_protocols ~239
Get web traffic broken down by protocol (HTTP, HTTPS, SSL, …). Read-only analytics. One row per protocol with its aggregated total. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
| traffic_unit | string | – | – |
No output schema declared.
No examples provided.
zins_get_web_traffic_by_location ~275
Get web traffic aggregated per location. Read-only analytics. Each row is a location with its total transactions or bytes; pass `include_trend=True` for the per-location time-series under `trend`. Window must be a 7- or 14-day historical interval (see the time-window inputs).
| Name | Type | Req | Description |
|---|---|---|---|
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| include_trend | boolean | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
| traffic_unit | string | – | – |
| trend_interval | – | – | – |
No output schema declared.
No examples provided.
zins_get_web_traffic_no_grouping ~284
Get overall web traffic volume with no grouping. Read-only analytics. Returns total organization traffic, optionally filtered by DLP engine or action (ALLOW/BLOCK), and optionally with an overall time-series `trend`. Window must be a 7- or 14-day historical interval.
| Name | Type | Req | Description |
|---|---|---|---|
| action_filter | – | – | – |
| dlp_engine_filter | – | – | – |
| end_days_ago | integer | – | – |
| end_time | – | – | – |
| include_trend | boolean | – | – |
| limit | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| start_days_ago | integer | – | – |
| start_time | – | – | – |
| traffic_unit | string | – | – |
| trend_interval | – | – | – |
No output schema declared.
No examples provided.
zms_get_agent_connection_status_statistics ~55
Get ZMS agent connection-status statistics (curated aggregate view). Read-only. Returns connected vs disconnected counts / percentages for fleet health. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| search | – | – | – |
No output schema declared.
No examples provided.
zms_get_agent_group_totp_secrets ~77
Get the TOTP secrets for a ZMS agent group (full record). Read-only API call, but the returned values ARE sensitive enrollment credentials — treat them like secrets. Keyed by `eyez_id`. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| eyez_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | TOTP secret bundle (treat as sensitive credentials). |
| eyez_id | – | – | Agent group eyez_id (echoed). |
No examples provided.
zms_get_agent_version_statistics ~59
Get ZMS agent version statistics (curated aggregate view). Read-only. Returns the distribution of agent software versions across the fleet — useful for spotting outdated agents. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| search | – | – | – |
No output schema declared.
No examples provided.
zms_get_metadata ~45
Get ZMS resource event metadata (full record). Read-only. Returns metadata about the resource-level events available in the deployment. Requires ZSCALER_CUSTOMER_ID.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Aggregate payload (counts/percentages). |
No examples provided.
zms_get_nonce ~57
Get one ZMS nonce. Read-only. Keyed by `eyez_id`. The payload may carry sensitive enrollment data — handle accordingly. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| eyez_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Full nonce payload. |
| eyez_id | – | – | Nonce eyez_id (echoed). |
No examples provided.
zms_get_resource_group_members ~216
List the members of a ZMS resource group. Read-only. Returns one row per member workload. Obtain `group_id` from `zms_list_resource_groups`. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| group_id | string | yes | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zms_get_resource_group_protection_status ~65
Get the ZMS resource-group protection-status summary (aggregate view). Read-only. Returns protected vs unprotected group counts and percentage. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| page_num | integer | – | – |
| page_size | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Aggregate payload (counts/percentages). |
No examples provided.
zms_get_resource_protection_status ~75
Get the ZMS resource protection-status summary (curated aggregate view). Read-only. Returns protected vs unprotected counts and protection percentage — microsegmentation coverage at a glance. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| page_num | integer | – | – |
| page_size | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Aggregate payload (counts/percentages). |
No examples provided.
zms_list_agent_groups ~223
List ZMS agent groups. Read-only. Returns one row per group (eyez_id, name, type, cloud provider, agent count, policy/tamper status). Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
| sort | – | – | – |
| sort_dir | – | – | – |
No output schema declared.
No examples provided.
zms_list_agents ~236
List ZMS microsegmentation agents. Read-only. Returns one row per agent (eyez_id, name, connection status, version, OS, IP). Requires ZSCALER_CUSTOMER_ID. Use a returned `eyez_id` with the agent-group / nonce tools.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
| sort | – | – | – |
| sort_dir | – | – | – |
No output schema declared.
No examples provided.
zms_list_app_catalog ~244
List the ZMS application catalog. Read-only. Returns one row per discovered application (id, name, category) plus its nested port/protocol/process specs — useful for policy planning. Filter by name/category, sort by name/category/time. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| category | – | – | – |
| name | – | – | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| sort_by | – | – | – |
| sort_order | – | – | – |
No output schema declared.
No examples provided.
zms_list_app_zones ~211
List ZMS app zones. Read-only. Returns one row per app zone (id, name, description, resource count). Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| sort_order | – | – | – |
No output schema declared.
No examples provided.
zms_list_default_policy_rules ~196
List ZMS default policy rules. Read-only. The built-in default rules evaluated when no custom rule matches. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zms_list_nonces ~214
List ZMS enrollment nonces. Read-only. Returns one row per nonce (eyez_id, name, status, expiry). Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| search | – | – | – |
| sort | – | – | – |
| sort_dir | – | – | – |
No output schema declared.
No examples provided.
zms_list_policy_rules ~236
List ZMS microsegmentation policy rules. Read-only. Returns one row per rule (id, name, action, priority, enabled). Filter by name/action. `fetch_all` bypasses pagination — use sparingly. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| action | – | – | – |
| fetch_all | boolean | – | – |
| name | – | – | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
No output schema declared.
No examples provided.
zms_list_resource_groups ~225
List ZMS resource groups. Read-only. Returns one row per group (id, name, managed/unmanaged type, origin, member count, and CIDRs/FQDNs for unmanaged groups). Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| resource_hostname | – | – | – |
No output schema declared.
No examples provided.
zms_list_resources ~267
List ZMS resources (workloads). Read-only. Returns one row per workload (id, name, type, status, cloud provider/region, OS, IPs). Filter by name/status/type/provider/region/OS. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| cloud_provider | – | – | – |
| cloud_region | – | – | – |
| include_deleted | boolean | – | – |
| name | – | – | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| platform_os | – | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| resource_type | – | – | – |
| sort_order | – | – | – |
| status | – | – | – |
No output schema declared.
No examples provided.
zms_list_tag_keys ~239
List ZMS tag keys within a namespace. Read-only. Middle of the tag hierarchy. Returns one row per key (id, key_name, value count). Obtain `namespace_id` from `zms_list_tag_namespaces`. Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| key_name | – | – | – |
| namespace_id | string | yes | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| sort_order | – | – | – |
No output schema declared.
No examples provided.
zms_list_tag_namespaces ~227
List ZMS tag namespaces. Read-only. Top of the tag hierarchy (namespace -> key -> value). Returns one row per namespace (id, name, origin, key count). Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| origin | – | – | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| sort_order | – | – | – |
No output schema declared.
No examples provided.
zms_list_tag_values ~259
List ZMS tag values for a key. Read-only. Bottom of the tag hierarchy. Returns one row per value (id, name). Needs the `tag_id` (from `zms_list_tag_keys`) and the `namespace_origin` (CUSTOM / EXTERNAL / ML / UNKNOWN). Requires ZSCALER_CUSTOMER_ID.
| Name | Type | Req | Description |
|---|---|---|---|
| name | – | – | – |
| namespace_origin | string | yes | – |
| page_num | integer | – | – |
| page_size | integer | – | – |
| query | – | – | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get… |
| sort_order | – | – | – |
| tag_id | string | yes | – |
No output schema declared.
No examples provided.
zpa_get_access_policy_rule ~38
Get one ZPA access policy rule (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| microtenant_id | – | – | – |
| rule_id | string | yes | – |
No output schema declared.
No examples provided.
zpa_get_app_connector ~38
Get one ZPA app connector by ID (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| connector_id | string | yes | – |
| microtenant_id | – | – | – |
No output schema declared.
No examples provided.
zpa_get_app_connector_group ~38
Get one ZPA app connector group (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| group_id | string | yes | – |
| microtenant_id | – | – | – |
No output schema declared.
No examples provided.
What is the Zscaler Zero Trust Exchange MCP server?
Zscaler Zero Trust Exchange is an MCP server listed in the public MCP registry as io.github.zscaler/zscaler-mcp-server. Manage Zscaler Zero Trust Exchange via 400+ tools, ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more. This page covers its PyPI package (zscaler-mcp).
Is the Zscaler Zero Trust Exchange MCP server safe to use?
Zscaler Zero Trust Exchange scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Zscaler Zero Trust Exchange MCP server expose?
Zscaler Zero Trust Exchange exposes 254 tools: zeasm_list_findings, zeasm_get_finding_details, zeasm_get_finding_evidence, zeasm_get_finding_scan_output, zeasm_list_lookalike_domains, and 249 more. Their descriptions and schemas cost roughly 37,993 tokens of context every time the server is loaded.
Is the Zscaler Zero Trust Exchange MCP server still maintained?
Zscaler Zero Trust Exchange is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.