mcp-zap-server: Give AI agents a safe, self-hosted ZAP operator for guided web security scans, findings, reports

by dtkmn · MCP Server · ★ 68

Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h

How to install mcp-zap-server

git clone https://github.com/dtkmn/mcp-zap-server.git

Taken from the project's README on GitHub.

Security audit verdict: SAFE · quality 69/100

None of the 42 rules matched — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against 42 published rules built on the SlowMist agent-security taxonomy, refreshed every 8 hours.

The quality score combines nine heuristic checks of the repo and its README: completeness, clarity, specificity, examples, structure, agent readiness, step-by-step content, instruction quality and security notes. It rates how well the project explains itself to an agent, not the code.

aijavallmmcpmcp-serverowaspsecuritysecurity-automationsecurity-scannersecurity-tools

Quick Facts

Stars68
Forks11
LanguageJava
CategoryMCP Server
LicenseApache-2.0
Quality Score69/100
Open Issues26
Last Updated2026-10-30
Created2025-04-20
Platformsbrowser, java, mcp
Est. Tokens~23k

About mcp-zap-server

NOTE This project is not affiliated with or endorsed by OWASP or the OWASP ZAP project. It is an independent implementation. MCP ZAP Server turns OWASP ZAP into a self-hosted MCP server so AI agents can run guided or expert web security workflows without brittle glue scripts. This repository is the open-source distribution.

Compatible Skills

These tools work well together with mcp-zap-server for enhanced workflows:

  • api2mcp4j — semantic(0.58)+shared_fw(spring)+rare_topics+same_lang+similar_pop+shared_platform (72%)
  • spring-ai-agent-utils — semantic(0.28)+complementary+shared_fw(spring)+rare_topics+same_lang+similar_pop+shared_platform (67%)
  • yu-ai-agent — semantic(0.48)+shared_fw(spring)+rare_topics+same_lang+similar_pop+shared_platform (64%)
  • developer-kit — semantic(0.28)+complementary+shared_fw(spring)+rare_topics+similar_pop+shared_platform (62%)

mcp-zap-server alternative? Top 6 similar tools

Looking for a mcp-zap-server alternative? If you're comparing mcp-zap-server with other mcp server tools, these 6 projects are the closest alternatives on Agent Skills Hub — ranked by topic overlap, star count, and community traction.

  • Wazuh-MCP-Server by gensecaihq · ⭐ 246

    Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability

  • api2mcp4j by TheEterna · ⭐ 113

    Spring Boot Starter: Auto-convert existing REST APIs (@RestController) to MCP Server with zero/low-code. Expos

  • spring-ai by eazybytes · ⭐ 175

    From Java Dev to AI Engineer: Spring AI Fast Track

  • Awesome-AI-For-Security by AmanPriyanshu · ⭐ 149

    A curated list of tools, papers, and datasets for applying AI to cybersecurity tasks. This list primarily focu

  • mcp-anything by gabrielekarra · ⭐ 56

    One command to turn any codebase into an MCP server

  • Fray by dalisecurity · ⭐ 53

    AI-native security toolkit — fray go target.com scans everything. 7,800+ payloads, 98 WAF vendors, 42+ recon c

More MCP Server Tools

Explore other popular mcp server tools:

View all MCP Server tools →

Popular Java Agent Tools

How this security grade is produced

Grades come from a rule-based scan built on the SlowMist agent-security taxonomy: 42 published rules, covering credential harvesting, data exfiltration, curl | sh installers and more. It is a first-layer scan, not a manual audit — we say so rather than overstate it.

The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.

Sources & who's responsible:

View on GitHub → Browse MCP Server tools