OWASP ZAP

Exposes OWASP ZAP web security scanning capabilities to AI agents via MCP for guided security assessments.

This MCP server wraps OWASP ZAP (Zed Attack Proxy) to enable AI agents to perform guided web security scans, retrieve findings, generate reports, and apply production guardrails. Built with Java and Spring Boot, it communicates over HTTP and supports multi-replica deployments with PostgreSQL for durable state. It includes a bundled Open WebUI interface and Docker deployment support.