ZAP MCP

🚀 ZAP-MCP: Model Context Protocol for OWASP ZAP

ZAP-MCP enables a powerful integration between OWASP ZAP and AI models through the Model Context Protocol (MCP). This project drives AI-based security testing by allowing AI models to directly interact with ZAP's scanning capabilities.

🚀 Quick Start

ZAP-MCP serves as a bridge connecting AI models (such as Claude) with OWASP ZAP, enabling automated security testing and analysis. It adopts a client-server architecture, where ZAP-MCP acts as the server, exposing standardized functions via the MCP protocol that can be directly invoked by AI models.

✨ Features

• AI-based Security Testing: Empower AI models to perform security scans and analysis.
• Real-time Scan Monitoring: Track scan progress and receive instant alerts.
• Automated Analysis: Generate security reports and recommendations.
• Flexible Integration: Be compatible with various AI models through the MCP protocol.
• WebSocket Communication: Provide real-time updates and interactions.

📦 Installation

Prerequisites

• Python 3.8+
• OWASP ZAP running locally or remotely
• Claude desktop application (or other MCP-compatible clients)

Steps

1. Clone the repository:

git clone https://github.com/tazer/ZAP-MCP.git
cd ZAP-MCP

2. Install dependencies:

pip install -r requirements.txt

3. Set up the MCP server:

./setup_mcp.sh

4. Configure ZAP-MCP:
   • Copy claude_desktop_config.json to the configuration directory of the Claude application.
   • Update the ZAP API key and URL in the configuration file.

💻 Usage Examples

Basic Usage

1. Start the MCP server:

mcp-server --config claude_desktop_config.json --model-dir ./models

2. Configure your Claude desktop application:

   • Open the Claude application settings.
   • Enable MCP server integration.
   • Set the WebSocket URL to: ws://localhost:7456/ws

3. Start using ZAP-MCP:

   • Now, the Claude application will have access to ZAP's scanning tools.
   • You can request security scans, get alerts, and generate reports.

Available Tools

The MCP server exposes these specific ZAP tools:

• start_scan: Initiate a new ZAP scan against a target URL.
• get_scan_status: Check the status of a running scan.
• get_alerts: Retrieve all alerts from the current scan.
• get_scan_summary: Obtain a summary of the current scan.

📚 Documentation

Configuration

The claude_desktop_config.json file contains all the necessary settings:

{
    "mcp_server": {
        "host": "localhost",
        "port": 7456,
        "model": "claude-instant-v1",
        "max_tokens": 1000,
        "temperature": 0.7,
        "zap_api_key": "your-zap-api-key",
        "zap_url": "http://localhost:8080"
    },
    "local_models": {
        "path": "./models",
        "prefer_local": true
    },
    "zap_settings": {
        "scan_timeout": 300,
        "max_concurrent_scans": 5,
        "alert_threshold": "HIGH",
        "scan_policy": "default"
    }
}

Development

This project was developed using Cursor AI, an intelligent coding assistant that helps optimize the development process and ensure code quality.

📄 License

This project is licensed under the MIT License. See the LICENSE file for details.

Author

• TAZER - Initial work and maintenance