加载中…
Safe, self-hosted ZAP operator for guided AI security scans and reports.
MCP ZAP Server 是 ChatHome Skills 收录的 MCP 条目，来源为 Official MCP Registry，质量分 76/100。 作为 Model Context Protocol 服务器，它向 Claude、Cursor、Copilot 等兼容 MCP 的 LLM 客户端暴露可直接调用的工具，让 agent 的能力超出模型内置范围。 该条目由 ChatHome Skills 的每日抓取从官方 registry 和 GitHub 发现查询中收录，每次运行都会重新核验仓库事实、新鲜度信号和安装元数据。 质量分综合了官方 registry 收录情况、可用安装命令、许可证完整性、仓库活跃度和 GitHub star 趋势，完整算法说明见来源页。安装命令已列于上方，可直接复制使用。 在将 MCP ZAP Server 加入生产 agent 工作流前，请核对上方的最近更新日期和仓库状态——下方事实快照是最近一次抓取的时点值。
docker run -i --rm ghcr.io/dtkmn/mcp-zap-server:v0.17.1运行此命令前，请先核对上游源码。
{
"_meta": {
"io.modelcontextprotocol.registry/official": {
"status": "active",
"isLatest": true,
"updatedAt": "2026-10-22T14:34:53.054941Z",
"publishedAt": "2026-10-22T14:34:53.054941Z",
"statusChangedAt": "2026-10-22T14:34:53.054941Z"
}
},
"server": {
"name": "io.github.dtkmn/mcp-zap-server",
"_meta": {
"io.modelcontextprotocol.registry/publisher-provided": {
"installation": "Docker Compose remains the easiest install path. OCI package installs require a separately running ZAP daemon reachable from the MCP container.",
"dockerCompose": "https://github.com/dtkmn/mcp-zap-server/blob/main/docker-compose.yml",
"externalDependency": "ZAP is not bundled in the MCP server image. Start ZAP separately on the configured Docker network, initialize mcp-zap-wrk for UID/GID 1000:1000, and mount the same mcp-zap-wrk:/zap/wrk volume into ZAP so reports generated by ZAP are readable by MCP.",
"recommendedInstallDoc": "https://github.com/dtkmn/mcp-zap-server/blob/main/llms-install.md"
}
},
"icons": [
{
"src": "https://raw.githubusercontent.com/dtkmn/mcp-zap-server/main/images/brand.png",
"sizes": [
"1024x1024"
],
"mimeType": "image/png"
}
],
"title": "MCP ZAP Server",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "0.17.1",
"packages": [
{
"transport": {
"url": "http://localhost:7456/mcp",
"type": "streamable-http",
"headers": [
{
"name": "X-API-Key",
"isSecret": true,
"isRequired": true,
"description": "MCP API key configured with MCP_API_KEY."
}
]
},
"identifier": "ghcr.io/dtkmn/mcp-zap-server:v0.17.1",
"runtimeHint": "docker",
"registryType": "oci",
"runtimeArguments": [
{
"name": "--network",
"type": "named",
"value": "mcp-zap-network",
"description": "Docker network containing the separately running ZAP daemon."
},
{
"name": "--user",
"type": "named",
"value": "1000:1000",
"description": "Run with the standard zaproxy/zap-stable UID/GID so shared report workspace files remain writable by both containers."
},
{
"name": "-p",
"type": "named",
"value": "127.0.0.1:7456:7456",
"description": "Expose the streamable HTTP MCP endpoint on localhost."
},
{
"name": "-v",
"type": "named",
"value": "mcp-zap-wrk:/zap/wrk",
"description": "Named report workspace volume. The external ZAP container must mount the same volume at /zap/wrk."
}
],
"environmentVariables": [
{
"name": "ZAP_API_URL",
"default": "mcp-zap-zap",
"description": "Hostname or URL of a separately running ZAP daemon reachable from this container."
},
{
"name": "ZAP_API_PORT",
"default": "8090",
"description": "ZAP API port."
},
{
"name": "ZAP_API_KEY",
"isSecret": true,
"isRequired": true,
"description": "API key configured on the ZAP daemon."
},
{
"name": "MCP_API_KEY",
"isSecret": true,
"isRequired": true,
"description": "API key clients must send as X-API-Key."
},
{
"name": "MCP_SERVER_TOOLS_SURFACE",
"default": "guided",
"description": "Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface."
},
{
"name": "MCP_SECURITY_MODE",
"value": "api-key"
},
{
"name": "MCP_SECURITY_ENABLED",
"value": "true"
},
{
"name": "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY",
"value": "false"
}
]
},
{
"transport": {
"url": "http://localhost:7456/mcp",
"type": "streamable-http",
"headers": [
{
"name": "X-API-Key",
"isSecret": true,
"isRequired": true,
"description": "MCP API key configured with MCP_API_KEY."
}
]
},
"identifier": "docker.io/dtkmn/mcp-zap-server:v0.17.1",
"runtimeHint": "docker",
"registryType": "oci",
"runtimeArguments": [
{
"name": "--network",
"type": "named",
"value": "mcp-zap-network",
"description": "Docker network containing the separately running ZAP daemon."
},
{
"name": "--user",
"type": "named",
"value": "1000:1000",
"description": "Run with the standard zaproxy/zap-stable UID/GID so shared report workspace files remain writable by both containers."
},
{
"name": "-p",
"type": "named",
"value": "127.0.0.1:7456:7456",
"description": "Expose the streamable HTTP MCP endpoint on localhost."
},
{
"name": "-v",
"type": "named",
"value": "mcp-zap-wrk:/zap/wrk",
"description": "Named report workspace volume. The external ZAP container must mount the same volume at /zap/wrk."
}
],
"environmentVariables": [
{
"name": "ZAP_API_URL",
"default": "mcp-zap-zap",
"description": "Hostname or URL of a separately running ZAP daemon reachable from this container."
},
{
"name": "ZAP_API_PORT",
"default": "8090",
"description": "ZAP API port."
},
{
"name": "ZAP_API_KEY",
"isSecret": true,
"isRequired": true,
"description": "API key configured on the ZAP daemon."
},
{
"name": "MCP_API_KEY",
"isSecret": true,
"isRequired": true,
"description": "API key clients must send as X-API-Key."
},
{
"name": "MCP_SERVER_TOOLS_SURFACE",
"default": "guided",
"description": "Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface."
},
{
"name": "MCP_SECURITY_MODE",
"value": "api-key"
},
{
"name": "MCP_SECURITY_ENABLED",
"value": "true"
},
{
"name": "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY",
"value": "false"
}
]
}
],
"repository": {
"id": "969625020",
"url": "https://github.com/dtkmn/mcp-zap-server",
"source": "github"
},
"websiteUrl": "https://danieltse.org/mcp-zap-server/",
"description": "Safe, self-hosted ZAP operator for guided AI security scans and reports."
}
}