---
title: root@localhost:~
description: Initialising MCP ZAP Server Protocol...
template: splash
editUrl: false
---

<div class="mission-terminal">
  <pre>{`  __  __  _____ _____    _____  __  _____
 |  \\/  |/ ____|  __ \\  |___  |/  \\|  __ \\
 | \\  / | |    | |__) |    / // /\\ \\ |__) |
 | |\\/| | |    |  ___/    / // /__\\ \\  ___/
 | |  | | |____| |       / // /____\\ \\ |
 |_|  |_|\\_____|_|      /_//_/      \\_\\_|

 > SYSTEM READY.
 > CONNECTING TO MCP PROTOCOL... [OK]
 > INITIALIZING OWASP ZAP CORE... [OK]`}</pre>

  # Welcome, Friend.

  <p class="mission-lead">
    You have accessed the <strong>MCP ZAP Server</strong> documentation. This system lets AI agents and
    operators drive OWASP ZAP through MCP for security testing and reporting.
  </p>

  <div class="telemetry-strip">
    <div class="telemetry-chip">
      <span>Protocol</span>
      <strong>MCP + OWASP ZAP</strong>
    </div>
    <div class="telemetry-chip">
      <span>Coverage</span>
      <strong>Guided, Expert, Queue, Ops</strong>
    </div>
    <div class="telemetry-chip">
      <span>Search Index</span>
      <strong>Pagefind Online</strong>
    </div>
  </div>

  <span class="section-label">./execute_mission.sh</span>

  <div class="mission-grid">
    <a class="mission-card" href="./getting-started/self-serve-first-run/">
      <h3>&gt; [01] SELF_SERVE_FIRST_RUN</h3>
      <p>Clone, bootstrap, start the local stack, connect Cursor or Open WebUI, and run the guided path.</p>
    </a>
    <a class="mission-card" href="./getting-started/tool-surfaces/">
      <h3>&gt; [02] TOOL_SURFACES</h3>
      <p>Choose the default guided surface or unlock the expert workflow controls.</p>
    </a>
    <a class="mission-card" href="./scanning/scan-execution-modes/">
      <h3>&gt; [03] EXECUTION_MODES</h3>
      <p>Understand guided, direct, queue-managed, and automation execution paths.</p>
    </a>
    <a class="mission-card" href="./getting-started/tool-scope-authorization/">
      <h3>&gt; [04] TOOL_SCOPE_AUTHZ</h3>
      <p>Control who can discover and invoke each MCP action.</p>
    </a>
    <a class="mission-card" href="./operations/observability/">
      <h3>&gt; [05] OBSERVABILITY</h3>
      <p>Trace requests with correlation IDs, audit events, and bounded metrics.</p>
    </a>
    <a class="mission-card" href="./scanning/seeded-api-gate-playbook/">
      <h3>&gt; [06] SEEDED_API_GATE</h3>
      <p>Adopt seeded API traffic, reviewed baselines, and enforcement without turning CI into noise.</p>
    </a>
    <a class="mission-card" href="./extensions/extension-api-release-policy/">
      <h3>&gt; [07] EXTENSION_POLICY</h3>
      <p>See what must be true before the extension API becomes a public compatibility promise.</p>
    </a>
  </div>

  <span class="section-label">tail -f /var/log/capabilities.txt</span>

  <ul class="capability-list">
    <li><strong>Guided_Flows</strong>: Let the server choose direct or queued execution for crawl and attack.</li>
    <li><strong>Expert_Tools</strong>: Expose raw queue, auth, policy, findings, and automation controls when needed.</li>
    <li><strong>Operational_Guardrails</strong>: Enforce scopes, rate limits, correlation IDs, queue observability, and scan-history evidence.</li>
  </ul>

  <span class="section-label">./contact_support.sh</span>

  <div class="support-box">
    <p><strong>Target:</strong> Teams deploying the OSS project</p>
    <p>
      <code>mcp-zap-server</code> is the Apache-2.0-licensed open-source core. Private or
      enterprise features can be built as separate extensions without shipping
      enterprise implementation code in this repository.
    </p>
    <p>
      <strong>Agentic Lab</strong> provides optional paid support for production
      adoption, SSO and OAuth2 setup, CI/CD quality gates, and compliance reporting.
    </p>
    <p>
      If this project saves you time or becomes part of your security workflow,
      you can <a href="https://github.com/sponsors/dtkmn">sponsor the maintainer</a>
      to support ongoing maintenance.
    </p>
    <a class="support-link" href="mailto:agentic.lab.au@gmail.com">&gt; OPEN_COMMUNICATION_CHANNEL</a>
  </div>

  <p class="home-status">_END OF LINE_</p>
</div>
