--- bezeichner: "io.github.dtkmn/mcp-zap-server" art: "mcp_server" slug: "io-github-dtkmn-mcp-zap-server" paketkoordinate: "oci:docker.io/dtkmn/mcp-zap-server:v0.15.0" status: "aktiv" homepage: "https://danieltse.org/mcp-zap-server/" erhebungsstand: "2026-10-11T01:17:01.851Z" namensraum: "io.github.dtkmn" registerseite: "https://tracevero.com/mcp/io-github-dtkmn-mcp-zap-server" abgerufen_am: "2026-10-11" zugangsdaten_erforderlich: true ausfuehrungsort: "entfernt" dateisystem_pfadargument: false quelloffen_einsehbar: true einsatzgebiet: "sicherheit" roh_beschreibung: "Safe, self-hosted ZAP operator for guided AI security scans and reports." version: "0.15.0" roh_umgebungsvariablen: "ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY, ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY" roh_geheime_pflichtvariablen: "MCP_API_KEY, MCP_API_KEY, ZAP_API_KEY, ZAP_API_KEY" roh_transportarten: "streamable-http, streamable-http" roh_pfadargumente: "" roh_repository_url: "https://github.com/dtkmn/mcp-zap-server" roh_paketquellen: "oci, oci" roh_geheime_pflichtkopfzeilen: "" roh_pfad_umgebungsvariablen: "" roh_remote_adressen: "" roh_remote_hosts: "" roh_statusmeldung: "" roh_veroeffentlicht_am: "2026-10-08" roh_aktualisiert_am: "2026-10-08" roh_schemafassung: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json" roh_bereitstellungsform: "paket" roh_repository_quelle: "github" roh_repository_unterordner: "" roh_paketbezeichner: "docker.io/dtkmn/mcp-zap-server:v0.15.0, ghcr.io/dtkmn/mcp-zap-server:v0.15.0" roh_paketversionen: "" roh_laufzeithinweise: "docker" roh_umgebungsformate: "" roh_umgebungsbeschreibungen: "MCP_API_KEY=API key clients must send as X-API-Key. · MCP_SERVER_TOOLS_SURFACE=Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface. · ZAP_API_KEY=API key configured on the ZAP daemon. · ZAP_API_PORT=ZAP API port. · ZAP_API_URL=Hostname or URL of a separately running ZAP daemon reachable from this container." roh_symbolformate: "image/png" roh_verbindungswege: "{\"packages\":[{\"registryType\":\"oci\",\"identifier\":\"ghcr.io/dtkmn/mcp-zap-server:v0.15.0\",\"runtimeHint\":\"docker\",\"transport\":\"streamable-http\",\"environment\":[{\"name\":\"ZAP_API_URL\",\"description\":\"Hostname or URL of a separately running ZAP daemon reachable from this container.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_PORT\",\"description\":\"ZAP API port.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_KEY\",\"description\":\"API key configured on the ZAP daemon.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_API_KEY\",\"description\":\"API key clients must send as X-API-Key.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_SERVER_TOOLS_SURFACE\",\"description\":\"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_MODE\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ENABLED\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":true},{\"registryType\":\"oci\",\"identifier\":\"docker.io/dtkmn/mcp-zap-server:v0.15.0\",\"runtimeHint\":\"docker\",\"transport\":\"streamable-http\",\"environment\":[{\"name\":\"ZAP_API_URL\",\"description\":\"Hostname or URL of a separately running ZAP daemon reachable from this container.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_PORT\",\"description\":\"ZAP API port.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_KEY\",\"description\":\"API key configured on the ZAP daemon.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_API_KEY\",\"description\":\"API key clients must send as X-API-Key.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_SERVER_TOOLS_SURFACE\",\"description\":\"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_MODE\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ENABLED\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":true}],\"remotes\":[]}" --- # MCP ZAP Server ## Measured values | Property | Value | Source | Collected on | Level of trust | Raw declaration | | --- | --- | --- | --- | --- | --- | | Required secrets declared | true | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_geheime_pflichtvariablen: MCP_API_KEY, MCP_API_KEY, ZAP_API_KEY, ZAP_API_KEY; roh_geheime_pflichtkopfzeilen: | | Execution location | entfernt | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_transportarten: streamable-http, streamable-http | | Path argument present | false | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_pfadargumente: ; roh_pfad_umgebungsvariablen: | | Repository URL listed | true | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_repository_url: https://github.com/dtkmn/mcp-zap-server | | Field of use, derived from the vendor description | sicherheit | MCP-Register | 2026-08-26T16:45:01.514Z | abgeleitet | roh_beschreibung: Safe, self-hosted ZAP operator for guided AI security scans and reports. | | Description (raw) | Safe, self-hosted ZAP operator for guided AI security scans and reports. | MCP-Register | 2026-10-04T01:17:01.638Z | selbstauskunft | | | Declared version | 0.15.0 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Environment variables (raw) | ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY, ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Required secret variables (raw) | MCP_API_KEY, MCP_API_KEY, ZAP_API_KEY, ZAP_API_KEY | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Transports (raw) | streamable-http, streamable-http | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Path arguments (raw) | | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Repository (raw) | https://github.com/dtkmn/mcp-zap-server | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Package registries (raw) | oci, oci | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Required secret headers (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Path environment variables (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Remote URLs (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Remote hosts (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Registry status message (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | First listed in the registry (raw) | 2026-10-08 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Last changed in the registry (raw) | 2026-10-08 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Schema version of the raw record (raw) | https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Delivery form (raw) | paket | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Repository platform (raw) | github | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Repository subfolder (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Package identifiers (raw) | docker.io/dtkmn/mcp-zap-server:v0.15.0, ghcr.io/dtkmn/mcp-zap-server:v0.15.0 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Package versions (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Runtime hints (raw) | docker | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Environment variable formats (raw) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Environment variable descriptions (raw) | MCP_API_KEY=API key clients must send as X-API-Key. · MCP_SERVER_TOOLS_SURFACE=Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface. · ZAP_API_KEY=API key configured on the ZAP daemon. · ZAP_API_PORT=ZAP API port. · ZAP_API_URL=Hostname or URL of a separately running ZAP daemon reachable from this container. | MCP-Register | 2026-10-04T01:17:01.638Z | selbstauskunft | | | Icon formats (raw) | image/png | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Connection paths (source structure) | {"packages":[{"registryType":"oci","identifier":"ghcr.io/dtkmn/mcp-zap-server:v0.15.0","runtimeHint":"docker","transport":"streamable-http","environment":[{"name":"ZAP_API_URL","description":"Hostname or URL of a separately running ZAP daemon reachable from this container.","required":false,"secret":false},{"name":"ZAP_API_PORT","description":"ZAP API port.","required":false,"secret":false},{"name":"ZAP_API_KEY","description":"API key configured on the ZAP daemon.","required":true,"secret":true},{"name":"MCP_API_KEY","description":"API key clients must send as X-API-Key.","required":true,"secret":true},{"name":"MCP_SERVER_TOOLS_SURFACE","description":"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.","required":false,"secret":false},{"name":"MCP_SECURITY_MODE","required":false,"secret":false},{"name":"MCP_SECURITY_ENABLED","required":false,"secret":false},{"name":"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY","required":false,"secret":false}],"additional_arguments_declared":true},{"registryType":"oci","identifier":"docker.io/dtkmn/mcp-zap-server:v0.15.0","runtimeHint":"docker","transport":"streamable-http","environment":[{"name":"ZAP_API_URL","description":"Hostname or URL of a separately running ZAP daemon reachable from this container.","required":false,"secret":false},{"name":"ZAP_API_PORT","description":"ZAP API port.","required":false,"secret":false},{"name":"ZAP_API_KEY","description":"API key configured on the ZAP daemon.","required":true,"secret":true},{"name":"MCP_API_KEY","description":"API key clients must send as X-API-Key.","required":true,"secret":true},{"name":"MCP_SERVER_TOOLS_SURFACE","description":"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.","required":false,"secret":false},{"name":"MCP_SECURITY_MODE","required":false,"secret":false},{"name":"MCP_SECURITY_ENABLED","required":false,"secret":false},{"name":"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]} | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | ## Links - Namespace: [[namensraum/io-github-dtkmn|io.github.dtkmn]] --- - Registry page: - Retrieved on: 2026-10-11