MCP Integration Add-on on ZAP

MCP Automation Framework - mcp-config Job

Mon, 01 Jan 0001 00:00:00 +0000

MCP Automation Framework - mcp-config Job

The mcp-config job configures the MCP server as part of an Automation Framework plan.

Any parameter not specified in the YAML is left at its current value - you only need to include the options you want to change.

Job: mcp-config

  - type: mcp-config                   # Configure the MCP server
    parameters:
      enabled:                         # Bool: Enable the MCP server, default: false
      port:                            # Int: Port for the MCP HTTP listener, default: 8282
      securityKey:                     # String: The security key value (leave blank to use no key)

Parameters

enabled

Whether the MCP server should be running. Set to false to disable the server entirely. Default: false

MCP Automation Framework Support

Mon, 01 Jan 0001 00:00:00 +0000

MCP Automation Framework Support

This add-on supports the Automation Framework.

The following jobs are available:

mcp-config - Configure the MCP server (port, security key, enabled state, etc.)
mcp-import - Import an external MCP server into ZAP’s history and sites tree

MCP Automation Framework - mcp-import Job

Mon, 01 Jan 0001 00:00:00 +0000

MCP Automation Framework - mcp-import Job

The mcp-import job probes an external MCP server and records all of its accessible endpoints (initialize, tools, resources, prompts) in the ZAP history and sites tree.

For each discovered tool, resource, and prompt the job sends a representative request so that ZAP captures the full JSON-RPC structure. This allows the requests to be scanned and fuzzed like any other traffic.

MCP Integration Options

Mon, 01 Jan 0001 00:00:00 +0000

MCP Integration Options

This screen allows you to configure the MCP Integration add-on.

Enable MCP Server

When unchecked, the MCP HTTP listener is not started and the server is completely disabled. All other options are greyed out when the server is disabled.

MCP Tools

Mon, 01 Jan 0001 00:00:00 +0000

MCP Tools

The following tools are available for MCP clients to invoke:

zap_version

Get the ZAP version.

zap_info

Get basic ZAP information.

MCP Prompts

Mon, 01 Jan 0001 00:00:00 +0000

MCP Prompts

Prompts are reusable instruction templates. MCP clients discover them via prompts/list and retrieve them via prompts/get.

zap_baseline_scan

Run a ZAP baseline scan: spider the target (standard then AJAX) and check for passive vulnerabilities without any active attacking.

MCP Resources

Mon, 01 Jan 0001 00:00:00 +0000

MCP Resources

The following resources are available for MCP clients to read:

zap://alerts

ZAP security alerts summary. Returns a lightweight list with name, risk, pluginId, alertRef, instanceCount, systemic, and instancesUri. Use zap://alerts/{alertRef} to get the full instances for a specific alert.

MCP Integration Add-on on ZAP

MCP Automation Framework - mcp-config Job

MCP Automation Framework - mcp-config Job

Job: mcp-config

Parameters

enabled

MCP Automation Framework Support

MCP Automation Framework Support

See Also

MCP Automation Framework - mcp-import Job

MCP Automation Framework - mcp-import Job

MCP Integration Options

MCP Integration Options

Enable MCP Server

MCP Tools

MCP Tools

zap_version

zap_info

MCP Prompts

MCP Prompts

zap_baseline_scan

MCP Resources

MCP Resources

zap://alerts