ZAP Server MCP Server

Give AI agents a safe, self-hosted OWASP ZAP operator for guided web security scans, findings, reports, and production guardrails.

People who need security tools inside Claude, Cursor, VS Code, or another MCP client. The project is written in Java.

VERIFIED ACTIVE

LAST COMMIT 2026-08-25 · ★ 63 · #98 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

Apache-2.0 · Java · how we verify → /methodology

01 · Install ZAP Server

Docker

docker run -i --rm ghcr.io/dtkmn/mcp-zap-server:v0.11.0

Claude Desktop - add to config

{
  "mcpServers": {
    "dtkmn-mcp-zap-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/dtkmn/mcp-zap-server:v0.11.0"
      ]
    }
  }
}

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as container (OCI image) - can be sandboxed away from your filesystem

license Apache-2.0 - declared in the repository

registry namespace io.github.dtkmn is GitHub-verified and matches the repo owner

03 · What ZAP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.11.0 · 2026-07-27

Changed · Bumped runtime, MCP server metadata, Helm chart metadata, MCP Registry package metadata, extension proof defaults, and current installation examples to 0.11.0 / v0.11.0. · Updated mcp-gateway-core and…

v0.10.1 · 2026-07-16

Changed · Bumped runtime, MCP server metadata, Helm chart metadata, MCP Registry package metadata, extension proof defaults, and current install examples to 0.10.1 / v0.10.1. · Updated mcp-gateway-core and…

v0.10.0 · 2026-07-15

Changed · Bumped runtime, MCP server metadata, Helm chart metadata, MCP Registry package metadata, extension proof defaults, and install examples to 0.10.0 / v0.10.0. · Changed zap_auth_session_prepare to accept only…

04 · Who maintains ZAP Server

MCP ZAP Server is maintained by dtkmn. It's the only MCP server we track from this author; the repo dates to Apr 2025.

05 · Facts

repository: github.com/dtkmn/mcp-zap-server
website: https://danieltse.org/mcp-zap-server/
category: security - ranked #98 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 5 releases in the last 90 days (latest 2026-07-27)
registry: io.github.dtkmn/mcp-zap-server (active, first published 2026-05-10 · 2 versions)
packages: oci:ghcr.io/dtkmn/mcp-zap-server:v0.11.0 · oci:docker.io/dtkmn/mcp-zap-server:v0.11.0

06 · ZAP Server FAQ

What is ZAP Server?

Give AI agents a safe, self-hosted OWASP ZAP operator for guided web security scans, findings, reports, and production guardrails.

Is ZAP Server still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-25 and it shipped 5 releases in the last 90 days. We re-verify nightly.

How do I install ZAP Server?

Run `docker run -i --rm ghcr.io/dtkmn/mcp-zap-server:v0.11.0`. You can also paste the ready-made client config above.

07 · Alternatives to ZAP Server

Alternatives to ZAP Server

Maintained security servers if ZAP Server isn't the fit.

Pairs well with

Servers that cover what ZAP Server doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Toolmesh · Reolink MCP · Zzop · Skill Audit MCP · Sanction