OWASP ZAP

This ZAP MCP server by LisBerndt provides AI assistants with comprehensive web application security testing capabilities through OWASP ZAP integration, offering both synchronous and asynchronous scanning modes including active vulnerability scanning, passive analysis, traditional spidering, and AJAX crawling with configurable browser engines. Built with Python and FastAPI, it features Docker containerization with automatic ZAP startup, session management with unique timestamping, progress tracking with heartbeat mechanisms to prevent timeouts, and configurable scan policies with evidence collection options. The implementation includes robust HTTP session handling with retry logic, extensive logging capabilities, and supports both direct MCP protocol communication and HTTP endpoints, making it ideal for security professionals and developers who need AI-assisted vulnerability assessment, automated penetration testing workflows, and integration of security scanning into development pipelines through their existing ZAP infrastructure.