mcpField
Z
ZAP MCP Server with SQLMap Integration Setup Guide

ZAP MCP Server with SQLMap Integration Setup Guide

Local
github.com/UnknownAirtistSecurity2Updated 79w ago
Repository

About ZAP MCP Server with SQLMap Integration Setup Guide

This repository provides setup instructions and configuration for running OWASP ZAP as an MCP server alongside SQLMap for authorized web security testing. It includes scripts for scans, ZAP rules, and forwarding findings for deeper testing.

Key features

  1. 01Docker-based ZAP setup
  2. 02SQLMap proxy configuration
  3. 03Custom ZAP detection rules
  4. 04Automated form scanning
  5. 05Scan scripts and CI examples

Use cases

  1. 01Set up ZAP and SQLMap for authorized assessments
  2. 02Scan target-site forms for vulnerabilities
  3. 03Run ZAP findings through SQLMap for further testing

MCP support

The guide configures OWASP ZAP to run as an MCP server. It describes the setup and related SQLMap scanning scripts, but does not specify which tools or resources the server exposes to MCP clients.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "zap-mcp-sqlmap-setup": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "pull"
      ]
    }
  }
}
Run commanddocker run -i --rm pull

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocipull

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

ZAP MCP Server with SQLMap Integration Setup Guide

This repository contains setup instructions and configuration files for using OWASP ZAP as an MCP (Man-in-the-middle Proxy) server with SQLMap integration for legitimate security testing and vulnerability assessment.

Prerequisites

  • Docker installed on your system
  • Basic understanding of web security testing
  • Administrator/root access to your system

Quick Setup

1. Clone this repository:
git clone https://github.com/UnknownAirtist/zap-mcp-sqlmap-setup.git
cd zap-mcp-sqlmap-setup
2. Run the setup script:
chmod +x setup.sh
./setup.sh
3. Start the ZAP MCP server:
docker-compose up -d

This will start the ZAP server on port 8080 and the API on port 8090.

Manual Setup

1. Install OWASP ZAP

You can install ZAP using Docker (recommended):

docker pull owasp/zap2docker-stable

Or download it directly from the official website.

2. Install SQLMap

SQLMap can be installed from the repository:

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git
3. Configure ZAP as an MCP server:

Start ZAP in daemon mode:

docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true
4. Set up SQLMap with ZAP:

Use SQLMap with ZAP as a proxy:

python sqlmap.py -u "http://target-website.com" --proxy=http://localhost:8080

Advanced Configuration

Custom ZAP Rules

The zap-rules directory contains custom ZAP rules for improving detection of SQL injection vulnerabilities:

  • Copy the .js files to the ZAP scripts directory
  • Enable them in the ZAP UI under Tools > Scripts
SQLMap Integration Scripts

The sqlmap-scripts directory contains helper scripts for tighter integration:

  • zap-sqlmap-bridge.py: Forwards ZAP findings to SQLMap for deeper testing
  • auto-scan.py: Automated scanning of all forms found on a target site

Usage Examples

Basic Scan
./scripts/start-scan.sh http://example.com
Full Scan with SQLMap Integration
./scripts/full-scan.sh http://vulnerable-website.com
Continuous Integration Setup

See the ci-example directory for GitHub Actions and Jenkins configuration examples.

Security Considerations

⚠️ IMPORTANT: Only use these tools on systems you own or have explicit permission to test. Unauthorized security testing is illegal in most jurisdictions.

Troubleshooting

  • Check logs/zap.log for ZAP-related issues
  • Check logs/sqlmap.log for SQLMap-related issues
  • If the server is not responding, ensure ports 8080 and 8090 are not in use by other applications

License

This project is licensed under the MIT License - see the LICENSE file for details.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.