ZAP MCP Server with SQLMap Integration Setup Guide
About
ZAP MCP Server with SQLMap integration setup guide and configuration
Details
- Author
- UnknownAirtist
- Downloads
- 261
- Categories
- Other
Jump to
- Docker-based quick setup with a single script
- Custom ZAP rules for SQL injection detection
- SQLMap integration scripts (bridge and auto-scan)
- CI/CD examples for GitHub Actions and Jenkins
- Configures ZAP as a transparent Man-in-the-middle proxy
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
ZAP MCP Server with SQLMap Integration Setup GuideCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
What are the prerequisites for using this setup?
You need Docker installed, basic understanding of web security testing, and administrator/root access to your system.
How do I start the ZAP MCP server?
Quick start: run docker-compose up -d from the cloned repository. Manual start: use the docker run command provided in the manual setup section.
How do I integrate SQLMap with ZAP?
Use SQLMap with the ZAP proxy by adding --proxy=http://localhost:8080 to your SQLMap command.
Can I use this setup in a CI/CD environment?
Yes, the repository includes example configurations for GitHub Actions and Jenkins in the ci-example directory.
Is it legal to use these tools?
Only use these tools on systems you own or have explicit permission to test. Unauthorized security testing is illegal in most jurisdictions.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"zap mcp server with sqlmap integration setup guide": {
"zap-mcp-sqlmap-setup": {
"command": "docker",
"args": [
"pull",
"owasp/zap2docker-stable"
]
}
}
}
}McpServers
{
"zap-mcp-sqlmap-setup": {
"command": "docker",
"args": [
"pull",
"owasp/zap2docker-stable"
]
}
}ZAP MCP Server with SQLMap Integration Setup Guide
This repository contains setup instructions and configuration files for using OWASP ZAP as an MCP (Man-in-the-middle Proxy) server with SQLMap integration for legitimate security testing and vulnerability assessment.
Prerequisites
- Docker installed on your system
- Basic understanding of web security testing
- Administrator/root access to your system
Quick Setup
1. Clone this repository:
git clone https://github.com/UnknownAirtist/zap-mcp-sqlmap-setup.git
cd zap-mcp-sqlmap-setup
2. Run the setup script:
chmod +x setup.sh
./setup.sh
3. Start the ZAP MCP server:
docker-compose up -d
This will start the ZAP server on port 8080 and the API on port 8090.
Manual Setup
1. Install OWASP ZAP
You can install ZAP using Docker (recommended):
docker pull owasp/zap2docker-stable
Or download it directly from the official website.
2. Install SQLMap
SQLMap can be installed from the repository:
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git
3. Configure ZAP as an MCP server:
Start ZAP in daemon mode:
docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true
4. Set up SQLMap with ZAP:
Use SQLMap with ZAP as a proxy:
python sqlmap.py -u "http://target-website.com" --proxy=http://localhost:8080
Advanced Configuration
Custom ZAP Rules
The zap-rules directory contains custom ZAP rules for improving detection of SQL injection vulnerabilities:
- Copy the .js files to the ZAP scripts directory
- Enable them in the ZAP UI under Tools > Scripts
SQLMap Integration Scripts
The sqlmap-scripts directory contains helper scripts for tighter integration:
- zap-sqlmap-bridge.py: Forwards ZAP findings to SQLMap for deeper testing
- auto-scan.py: Automated scanning of all forms found on a target site
Usage Examples
Basic Scan
./scripts/start-scan.sh http://example.com
Full Scan with SQLMap Integration
./scripts/full-scan.sh http://vulnerable-website.com
Continuous Integration Setup
See the ci-example directory for GitHub Actions and Jenkins configuration examples.
Security Considerations
⚠️ IMPORTANT: Only use these tools on systems you own or have explicit permission to test. Unauthorized security testing is illegal in most jurisdictions.
Troubleshooting
- Check logs/zap.log for ZAP-related issues
- Check logs/sqlmap.log for SQLMap-related issues
- If the server is not responding, ensure ports 8080 and 8090 are not in use by other applications
License
This project is licensed under the MIT License - see the LICENSE file for details.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
