mcp-zap-server (dtkmn) — agentic threat model

Not certain from the listing — The underlying LLM is not specified as this is an MCP server. Standard foundation model risks like prompt injection could be used to bypass the server's scoping rules or force it to target unauthorized hosts.

Not certain from the listing — Data operations are limited to scan findings and reports. Risks include the potential exfiltration or poisoning of vulnerability reports and scan configurations stored or processed by the server.

The agent framework layer is highly critical here as it exposes OWASP ZAP orchestration tools. Insecure tool integration or prompt injection could allow an attacker to hijack the tool-calling mechanism to run arbitrary DAST scans against unauthorized targets.

As a self-hosted operator running over streamable HTTP, secure deployment is vital. Compromise of the hosting environment could allow lateral movement, unauthorized network scanning of internal assets, or exposure of the ZAP API keys and target credentials.

The agent emphasizes guided scans, findings, and reports. Observability must ensure that all scan targets, parameters, and execution states are strictly logged to detect unauthorized scanning attempts or guardrail bypasses.

Security and compliance are central to this agent, which explicitly features production guardrails and scoping controls to prevent unconstrained attacks. Strict authorization policies are required to define who can initiate scans and on what targets.

In a multi-agent ecosystem, other agents might call this MCP server to perform security checks. Trust boundaries must be enforced so that compromised upstream agents cannot abuse the ZAP operator to perform malicious reconnaissance.