MCP ZAP Server for VS Code
io.github.dtkmn/mcp-zap-server
Safe, self-hosted OWASP ZAP operator for guided AI security scans and reports.
client:VS Code
transport:stdio
runtime:oci
Install MCP ZAP Server in VS Code
.vscode/mcp.json
{
"inputs": [
{
"type": "promptString",
"id": "zap-api-url",
"description": "ZAP_API_URL",
"password": true
},
{
"type": "promptString",
"id": "zap-api-port",
"description": "ZAP_API_PORT",
"password": true
},
{
"type": "promptString",
"id": "zap-api-key",
"description": "ZAP_API_KEY",
"password": true
},
{
"type": "promptString",
"id": "mcp-api-key",
"description": "MCP_API_KEY",
"password": true
},
{
"type": "promptString",
"id": "mcp-server-tools-surface",
"description": "MCP_SERVER_TOOLS_SURFACE",
"password": true
},
{
"type": "promptString",
"id": "mcp-security-mode",
"description": "MCP_SECURITY_MODE",
"password": true
},
{
"type": "promptString",
"id": "mcp-security-enabled",
"description": "MCP_SECURITY_ENABLED",
"password": true
},
{
"type": "promptString",
"id": "mcp-security-allow-placeholder-api-key",
"description": "MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY",
"password": true
}
],
"servers": {
"mcp-zap-server": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/dtkmn/mcp-zap-server:v0.11.0"
],
"env": {
"ZAP_API_URL": "${input:zap-api-url}",
"ZAP_API_PORT": "${input:zap-api-port}",
"ZAP_API_KEY": "${input:zap-api-key}",
"MCP_API_KEY": "${input:mcp-api-key}",
"MCP_SERVER_TOOLS_SURFACE": "${input:mcp-server-tools-surface}",
"MCP_SECURITY_MODE": "${input:mcp-security-mode}",
"MCP_SECURITY_ENABLED": "${input:mcp-security-enabled}",
"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY": "${input:mcp-security-allow-placeholder-api-key}"
}
}
}
}VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs