Owasp Zap MCP Server Demo

A WebSocket-based OWASP ZAP security scan control protocol server for real-time control and monitoring of security assessments

Security Developer tools #Security Scan #Real-time Monitoring #Automation #Multi-domain Detection .Python

rating : 2.5 points

downloads : 8.0K

update time : 2025-04-29

Open Site

What is the OWASP MCP Server?

The OWASP MCP Server is a powerful tool that connects to OWASP ZAP via the WebSocket protocol to perform security scans and real-time monitoring of websites. Users can start scans, view progress, and obtain results through simple commands or interface operations.

How to use the OWASP MCP Server?

You can start your security scan in just a few steps: Install OWASP ZAP, start the MCP Server, and then use the command-line tool to execute scan tasks.

Applicable scenarios

Suitable for enterprise and individual users who need automated, real-time monitoring, and large-scale security testing. Whether it's for daily security checks or CI/CD pipeline integration, the MCP Server can meet the requirements.

Main Features

Real-time control

Supports real-time monitoring of scan progress and status via WebSocket.

Concurrent scanning of multiple domains

Can scan multiple domains simultaneously to improve efficiency.

Multiple scan modes

Provides multiple modes such as spider scan, active scan, and full scan to meet different needs.

CI/CD integration

Built-in support for CI/CD pipeline integration for easy automated deployment.

Advantages

Real-time updates without manual page refresh.

Powerful automation capabilities, suitable for large-scale applications.

Supports multiple output formats (HTML, JSON, etc.).

Easy to integrate into existing development processes.

Limitations

Requires high computer performance to run OWASP ZAP.

Initial setup may require a certain technical background.

Some advanced features may require additional configuration.

How to Use

Install OWASP ZAP

Download and install the latest version of OWASP ZAP.

Start OWASP ZAP

Ensure that OWASP ZAP is running and listening on the specified port.

Start the MCP Server

Run the MCP Server to start receiving scan requests.

Execute a Scan

Use the command-line tool to execute specific scan tasks.

Usage Examples

Basic Scan Example

Demonstrate how to perform a basic spider scan.

Authenticated Scan Example

Show how to handle content that requires login to access.

Frequently Asked Questions

Why is sudo permission required to start OWASP ZAP?

What if there is a port conflict?

Related Resources

OWASP ZAP Official Documentation

Learn the basics and advanced usage of OWASP ZAP.

OWASP MCP Server GitHub Repository

Get the source code and support materials.

🚀 OWASP MCP Server

A WebSocket-based Mission Control Protocol (MCP) server for OWASP ZAP security scanning, supporting real-time control and monitoring of security assessments.

🚀 Quick Start

Prerequisites

Python 3.8+
OWASP ZAP 2.12.0+
Java Runtime Environment (JRE) 8+
Sudo or administrator privileges (required for ZAP)

Why Choose the MCP Server?

Property	MCP Server	ZAP UI	ZAP API
Automation	✅ Fully supported	❌ Limited	✅ Basic
Real-time Updates	✅ WebSocket	✅ Visual	❌ Pull-based
CI/CD Integration	✅ Native support	❌ Manual	✅ Complex
Batch Processing	✅ Supported	❌ Not supported	✅ Limited
Learning Curve	🟡 Medium	🟢 Simple	🔴 Difficult
Progress Tracking	✅ Real-time	✅ Visual	❌ Manual
Multiple Domains	✅ Concurrent support	❌ Serial	🟡 Limited
Error Handling	✅ Robust	✅ Basic	❌ Manual

Core Components

mcp_server.py - The powerhouse. Start it first; it's the core scanning engine that connects to OWASP ZAP.
mcp_client.py - The brains in action. A powerful SDK used by other components to communicate with the server (you won't use this file directly).
mcp_cli.py - Your Swiss Army knife command-line tool. Simple to use and highly functional.
test_client.py - Ideal for learning and testing.

Steps to Start

Install OWASP ZAP: Download link: https://www.zaproxy.org/download/

Set up the project:

git clone https://github.com/shadsidd/Owasp-Zap-MCP-Server-Demo.git
cd Owasp-Zap-MCP-Server-Demo
python3 -m venv venv
source venv/bin/activate  # Use `venv\Scripts\activate` on Windows
pip install -r requirements.txt

Start the MCP server:
```
python mcp_server.py
```
Start ZAP: Open a terminal and run the following command to start ZAP's proxy:
```
zap-baseline.py -t http://target_URL:port
```

Use the command-line tool: For example, perform a spider scan:

python mcp_client.py --scan-type spider --target http://target_URL:port

💻 Usage Examples

Example Files

The project includes the following example files:

mcp_server.py - The core implementation of the MCP server.
mcp_client.py - Provides a command-line interface to control scans.
test_client.py - Tests connectivity and basic functionality.

⚠️ Important Note

Port conflicts: Ensure that the port of the target URL is not occupied by other applications.
Permission issues: On some systems, you may need to use sudo to elevate privileges.
Logging: Both the server and the client will output logs to assist with debugging.

📚 Documentation

Scan Types

The MCP server supports multiple scan types:

Spider scan (default): Crawls website content, the fastest but discovers fewer vulnerabilities.
Active scan: Performs actual attack tests and discovers more vulnerabilities.
Comprehensive scan: Combines spider and active scans to provide the most comprehensive results.

By following the above steps, you can easily set up and start using the OWASP MCP server for security assessments.