--- bezeichner: "io.github.dtkmn/mcp-zap-server" art: "mcp_server" slug: "io-github-dtkmn-mcp-zap-server" paketkoordinate: "oci:docker.io/dtkmn/mcp-zap-server:v0.15.0" status: "aktiv" homepage: "https://danieltse.org/mcp-zap-server/" erhebungsstand: "2026-10-11T01:17:01.851Z" namensraum: "io.github.dtkmn" registerseite: "https://tracevero.de/mcp/io-github-dtkmn-mcp-zap-server" abgerufen_am: "2026-10-11" zugangsdaten_erforderlich: true ausfuehrungsort: "entfernt" dateisystem_pfadargument: false quelloffen_einsehbar: true einsatzgebiet: "sicherheit" roh_beschreibung: "Safe, self-hosted ZAP operator for guided AI security scans and reports." version: "0.15.0" roh_umgebungsvariablen: "ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY, ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY" roh_geheime_pflichtvariablen: "MCP_API_KEY, MCP_API_KEY, ZAP_API_KEY, ZAP_API_KEY" roh_transportarten: "streamable-http, streamable-http" roh_pfadargumente: "" roh_repository_url: "https://github.com/dtkmn/mcp-zap-server" roh_paketquellen: "oci, oci" roh_geheime_pflichtkopfzeilen: "" roh_pfad_umgebungsvariablen: "" roh_remote_adressen: "" roh_remote_hosts: "" roh_statusmeldung: "" roh_veroeffentlicht_am: "2026-10-08" roh_aktualisiert_am: "2026-10-08" roh_schemafassung: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json" roh_bereitstellungsform: "paket" roh_repository_quelle: "github" roh_repository_unterordner: "" roh_paketbezeichner: "docker.io/dtkmn/mcp-zap-server:v0.15.0, ghcr.io/dtkmn/mcp-zap-server:v0.15.0" roh_paketversionen: "" roh_laufzeithinweise: "docker" roh_umgebungsformate: "" roh_umgebungsbeschreibungen: "MCP_API_KEY=API key clients must send as X-API-Key. · MCP_SERVER_TOOLS_SURFACE=Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface. · ZAP_API_KEY=API key configured on the ZAP daemon. · ZAP_API_PORT=ZAP API port. · ZAP_API_URL=Hostname or URL of a separately running ZAP daemon reachable from this container." roh_symbolformate: "image/png" roh_verbindungswege: "{\"packages\":[{\"registryType\":\"oci\",\"identifier\":\"ghcr.io/dtkmn/mcp-zap-server:v0.15.0\",\"runtimeHint\":\"docker\",\"transport\":\"streamable-http\",\"environment\":[{\"name\":\"ZAP_API_URL\",\"description\":\"Hostname or URL of a separately running ZAP daemon reachable from this container.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_PORT\",\"description\":\"ZAP API port.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_KEY\",\"description\":\"API key configured on the ZAP daemon.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_API_KEY\",\"description\":\"API key clients must send as X-API-Key.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_SERVER_TOOLS_SURFACE\",\"description\":\"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_MODE\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ENABLED\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":true},{\"registryType\":\"oci\",\"identifier\":\"docker.io/dtkmn/mcp-zap-server:v0.15.0\",\"runtimeHint\":\"docker\",\"transport\":\"streamable-http\",\"environment\":[{\"name\":\"ZAP_API_URL\",\"description\":\"Hostname or URL of a separately running ZAP daemon reachable from this container.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_PORT\",\"description\":\"ZAP API port.\",\"required\":false,\"secret\":false},{\"name\":\"ZAP_API_KEY\",\"description\":\"API key configured on the ZAP daemon.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_API_KEY\",\"description\":\"API key clients must send as X-API-Key.\",\"required\":true,\"secret\":true},{\"name\":\"MCP_SERVER_TOOLS_SURFACE\",\"description\":\"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_MODE\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ENABLED\",\"required\":false,\"secret\":false},{\"name\":\"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":true}],\"remotes\":[]}" --- # MCP ZAP Server ## Gemessene Werte | Merkmal | Wert | Quelle | Erhoben am | Vertrauensgrad | Rohangabe | | --- | --- | --- | --- | --- | --- | | Pflicht-Geheimnisse deklariert | true | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_geheime_pflichtvariablen: MCP_API_KEY, MCP_API_KEY, ZAP_API_KEY, ZAP_API_KEY; roh_geheime_pflichtkopfzeilen: | | Ausführungsort | entfernt | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_transportarten: streamable-http, streamable-http | | Pfadargument vorhanden | false | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_pfadargumente: ; roh_pfad_umgebungsvariablen: | | Repository-Adresse geführt | true | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_repository_url: https://github.com/dtkmn/mcp-zap-server | | Einsatzgebiet, aus der Anbieterbeschreibung abgeleitet | sicherheit | MCP-Register | 2026-08-26T16:45:01.514Z | abgeleitet | roh_beschreibung: Safe, self-hosted ZAP operator for guided AI security scans and reports. | | Beschreibung (Rohangabe) | Safe, self-hosted ZAP operator for guided AI security scans and reports. | MCP-Register | 2026-10-04T01:17:01.638Z | selbstauskunft | | | Deklarierte Version | 0.15.0 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Umgebungsvariablen (Rohangabe) | ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY, ZAP_API_URL, ZAP_API_PORT, ZAP_API_KEY, MCP_API_KEY, MCP_SERVER_TOOLS_SURFACE, MCP_SECURITY_MODE, MCP_SECURITY_ENABLED, MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Geheime Pflichtvariablen (Rohangabe) | MCP_API_KEY, MCP_API_KEY, ZAP_API_KEY, ZAP_API_KEY | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Transportarten (Rohangabe) | streamable-http, streamable-http | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Pfadargumente (Rohangabe) | | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Repository (Rohangabe) | https://github.com/dtkmn/mcp-zap-server | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Paketquellen (Rohangabe) | oci, oci | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft | | | Geheime Pflichtkopfzeilen (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Pfad-Umgebungsvariablen (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Remote-Adressen (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Remote-Hosts (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Statusmeldung des Registers (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Im Register eingetragen am (Rohangabe) | 2026-10-08 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Im Register geändert am (Rohangabe) | 2026-10-08 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Schemafassung des Rohsatzes (Rohangabe) | https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Bereitstellungsform (Rohangabe) | paket | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Repository-Plattform (Rohangabe) | github | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Repository-Unterordner (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Paketbezeichner (Rohangabe) | docker.io/dtkmn/mcp-zap-server:v0.15.0, ghcr.io/dtkmn/mcp-zap-server:v0.15.0 | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | | Paketversionen (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Laufzeithinweise (Rohangabe) | docker | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Formate der Umgebungsvariablen (Rohangabe) | | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Beschreibungen der Umgebungsvariablen (Rohangabe) | MCP_API_KEY=API key clients must send as X-API-Key. · MCP_SERVER_TOOLS_SURFACE=Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface. · ZAP_API_KEY=API key configured on the ZAP daemon. · ZAP_API_PORT=ZAP API port. · ZAP_API_URL=Hostname or URL of a separately running ZAP daemon reachable from this container. | MCP-Register | 2026-10-04T01:17:01.638Z | selbstauskunft | | | Symbolformate (Rohangabe) | image/png | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft | | | Verbindungswege (Quellstruktur) | {"packages":[{"registryType":"oci","identifier":"ghcr.io/dtkmn/mcp-zap-server:v0.15.0","runtimeHint":"docker","transport":"streamable-http","environment":[{"name":"ZAP_API_URL","description":"Hostname or URL of a separately running ZAP daemon reachable from this container.","required":false,"secret":false},{"name":"ZAP_API_PORT","description":"ZAP API port.","required":false,"secret":false},{"name":"ZAP_API_KEY","description":"API key configured on the ZAP daemon.","required":true,"secret":true},{"name":"MCP_API_KEY","description":"API key clients must send as X-API-Key.","required":true,"secret":true},{"name":"MCP_SERVER_TOOLS_SURFACE","description":"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.","required":false,"secret":false},{"name":"MCP_SECURITY_MODE","required":false,"secret":false},{"name":"MCP_SECURITY_ENABLED","required":false,"secret":false},{"name":"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY","required":false,"secret":false}],"additional_arguments_declared":true},{"registryType":"oci","identifier":"docker.io/dtkmn/mcp-zap-server:v0.15.0","runtimeHint":"docker","transport":"streamable-http","environment":[{"name":"ZAP_API_URL","description":"Hostname or URL of a separately running ZAP daemon reachable from this container.","required":false,"secret":false},{"name":"ZAP_API_PORT","description":"ZAP API port.","required":false,"secret":false},{"name":"ZAP_API_KEY","description":"API key configured on the ZAP daemon.","required":true,"secret":true},{"name":"MCP_API_KEY","description":"API key clients must send as X-API-Key.","required":true,"secret":true},{"name":"MCP_SERVER_TOOLS_SURFACE","description":"Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface.","required":false,"secret":false},{"name":"MCP_SECURITY_MODE","required":false,"secret":false},{"name":"MCP_SECURITY_ENABLED","required":false,"secret":false},{"name":"MCP_SECURITY_ALLOW_PLACEHOLDER_API_KEY","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]} | MCP-Register | 2026-10-08T01:17:01.893Z | selbstauskunft | | ## Verweise - Namensraum: [[namensraum/io-github-dtkmn|io.github.dtkmn]] --- - Registerseite: - Abgerufen am: 2026-10-11