Owasp Zap MCP Server Demo

🚀 OWASP MCP Server

A WebSocket-based Mission Control Protocol (MCP) server for OWASP ZAP security scanning, supporting real-time control and monitoring of security assessments.

🚀 Quick Start

Prerequisites

• Python 3.8+
• OWASP ZAP 2.12.0+
• Java Runtime Environment (JRE) 8+
• Sudo or administrator privileges (required for ZAP)

Why Choose the MCP Server?

Core Components

• mcp_server.py - The powerhouse. Start it first; it's the core scanning engine that connects to OWASP ZAP.
• mcp_client.py - The brains in action. A powerful SDK used by other components to communicate with the server (you won't use this file directly).
• mcp_cli.py - Your Swiss Army knife command-line tool. Simple to use and highly functional.
• test_client.py - Ideal for learning and testing.

Steps to Start

1. Install OWASP ZAP: Download link: https://www.zaproxy.org/download/

2. Set up the project:

   git clone https://github.com/shadsidd/Owasp-Zap-MCP-Server-Demo.git
   cd Owasp-Zap-MCP-Server-Demo
   python3 -m venv venv
   source venv/bin/activate  # Use `venv\Scripts\activate` on Windows
   pip install -r requirements.txt
   

3. Start the MCP server:

   python mcp_server.py
   

4. Start ZAP: Open a terminal and run the following command to start ZAP's proxy:

   zap-baseline.py -t http://target_URL:port
   

5. Use the command-line tool: For example, perform a spider scan:

   python mcp_client.py --scan-type spider --target http://target_URL:port
   

💻 Usage Examples

Example Files

The project includes the following example files:

• mcp_server.py - The core implementation of the MCP server.
• mcp_client.py - Provides a command-line interface to control scans.
• test_client.py - Tests connectivity and basic functionality.

⚠️ Important Note

• Port conflicts: Ensure that the port of the target URL is not occupied by other applications.
• Permission issues: On some systems, you may need to use sudo to elevate privileges.
• Logging: Both the server and the client will output logs to assist with debugging.

📚 Documentation

Scan Types

The MCP server supports multiple scan types:

• Spider scan (default): Crawls website content, the fastest but discovers fewer vulnerabilities.
• Active scan: Performs actual attack tests and discovers more vulnerabilities.
• Comprehensive scan: Combines spider and active scans to provide the most comprehensive results.

By following the above steps, you can easily set up and start using the OWASP MCP server for security assessments.