OWASP MCP Server

OWASP MCP Server

A WebSocket-based Mission Control Protocol (MCP) server for OWASP ZAP security scanning, enabling real-time control and monitoring of security assessments.

Prerequisites

• Python 3.8+
• OWASP ZAP 2.12.0+
• Java Runtime Environment (JRE) 8+
• Sudo/Administrator privileges (required for ZAP)

Why MCP Server?

Feature	MCP Server	ZAP UI	ZAP API
Automation	✅ Full	❌ Limited	✅ Basic
Real-time Updates	✅ WebSocket	✅ Visual	❌ Polling
CI/CD Integration	✅ Native	❌ Manual	✅ Complex
Batch Processing	✅ Yes	❌ No	✅ Limited
Learning Curve	🟡 Medium	🟢 Easy	🔴 Hard
Progress Tracking	✅ Real-time	✅ Visual	❌ Manual
Multiple Domains	✅ Concurrent	❌ Sequential	🟡 Limited
Error Handling	✅ Robust	✅ Basic	❌ Manual

Core Components

• mcp_server.py - The engine that powers everything. Start this first - it's your security scanning powerhouse that connects to OWASP ZAP.

• mcp_client.py - The brains behind the operation. A powerful SDK that other components use to talk to the server (you won't use this directly).

• mcp_cli.py - Your go-to command line tool for scanning. Think of it as your Swiss Army knife for security scanning - simple to use, yet powerful.

• test_client.py - A learning tool that shows you the ropes. Perfect for understanding how everything works or testing your setup.

Quick Start

1. Install OWASP ZAP: Download from https://www.zaproxy.org/download/

2. Setup Project:

   git clone https://github.com/shadsidd/Owasp-Zap-MCP-Server-Demo.git
   cd Owasp-Zap-MCP-Server-Demo
   python -m venv venv
   source venv/bin/activate  # Windows: .\venv\Scripts\activate
   pip install -r requirements.txt
   

3. Start ZAP (requires sudo/admin privileges):

   # macOS/Linux
   sudo /Applications/ZAP.app/Contents/Java/zap.sh -daemon -port 8080
   
   # Windows (as Administrator)
   "C:\Program Files\OWASP\Zed Attack Proxy\zap.bat" -daemon -port 8080
   

4. Start MCP Server:

   python mcp_server.py
   

5. Use the CLI:

   # Quick spider scan (passive)
   python mcp_cli.py scan example.com
   
   # Full active scan (comprehensive)
   python mcp_cli.py fullscan example.com
   
   # Specific scan type with HTML report
   python mcp_cli.py scan --scan-type=active --output=html example.com
   
   # Multiple domains scan
   python mcp_cli.py scan domain1.com domain2.com
   
   # Scan from file
   python mcp_cli.py scan -f domains.txt
   

Example Files

The examples/ directory contains scripts demonstrating key features:

Security Scanning

• basic_scan.py - Core scanning with error handling
• authenticated_scan.py - Form-based and other authentication methods
• scan_domains.py - Concurrent scanning of multiple domains
• custom_scan_policy.py - Custom rules and thresholds

Integration & Monitoring

• ci_cd_integration.py - CI/CD pipeline integration
• real_time_monitor.py - Live progress and alert monitoring
• team_notifications.py - Email, Slack, and Teams notifications
• custom_rules.py - Specialized security rules

Important Notes

1. Sudo Requirements:

   • OWASP ZAP requires sudo/administrator privileges to run
   • You will be prompted for your password when starting ZAP

2. Port Configuration:

   • ZAP uses port 8080 by default
   • MCP Server uses port 3000
   • Ensure these ports are not in use before starting

3. Common Issues:

   • If you see "Address already in use" error:

     # Check what's using port 8080
     sudo lsof -i :8080
     # Kill the process if needed
     sudo kill -9 <PID>
     

   • If ZAP fails to start, try:

     # Clear any existing ZAP processes
     pkill -f zap
     

Scan Types

The MCP Server supports multiple scan types:

• Spider Scan (Default): Crawls the website to discover content, fastest but finds fewer issues
• Active Scan: Performs security testing with actual attacks, finds more vulnerabilities
• Full Scan: Comprehensive scanning (spider + active), provides the most thorough results