Zscaler MCP Server

https://github.com/zscaler/zscaler-mcp-server
Admin
Zscaler MCP Server is a Model Context Protocol server that connects AI agents with the Zscaler Zero...
Tokens:476,352
Snippets:2,440
Trust Score:7.2
License:MIT
Update:7 months ago
Show doc for...
Tokens:
Raw
### Install Zscaler MCP Server from Source

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Installs the Zscaler Integrations MCP Server from its GitHub repository. This involves cloning the repository, navigating into the directory, and performing a local installation.

```bash
git clone https://github.com/zscaler/zscaler-mcp-server.git
cd zscaler-mcp-server
pip install -e .
```

--------------------------------

### Configure Write Operations Tool Allowlist Examples

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/guides/configuration.md

Provides examples of how to configure the `ZSCALER_MCP_WRITE_TOOLS` environment variable to specify which write operations are permitted, using wildcards for flexibility and security.

```bash
# Allow all ZPA create operations
export ZSCALER_MCP_WRITE_TOOLS="zpa_create_*"

# Allow ZPA create and delete
export ZSCALER_MCP_WRITE_TOOLS="zpa_create_*,zpa_delete_*"

# Allow all ZPA write tools
export ZSCALER_MCP_WRITE_TOOLS="zpa_*"

# Allow specific tool (no wildcard)
export ZSCALER_MCP_WRITE_TOOLS="zpa_create_application_segment"

# Allow multiple services
export ZSCALER_MCP_WRITE_TOOLS="zpa_*,zia_*,ztw_*"
```

--------------------------------

### Run Zscaler MCP Server from Command Line

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Starts the Zscaler Integrations MCP Server using a simple command. This is the most straightforward way to launch the server after installation and configuration.

```bash
zscaler-mcp-server
```

--------------------------------

### Configure Docker for Zscaler MCP Server in uvx

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Configuration example for integrating the Zscaler Integrations MCP Server with uvx when running via Docker. This setup uses an .env file for configuration and specifies the Docker image to run.

```json
{
  "mcpServers": {
    "zscaler-mcp-server": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--env-file", "/full/path/to/.env",
        "quay.io/zscaler/zscaler-mcp-server:latest"
      ]
    }
  }
}
```

--------------------------------

### Copy Example Environment File

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

This command copies the example environment file to be configured with Zscaler API credentials. It is a prerequisite for setting up the project's environment.

```bash
cp .env.example .env
```

--------------------------------

### Zscaler MCP Server Command Line Usage

Source: https://context7.com/zscaler/zscaler-mcp-server/llms.txt

Provides examples of how to start the Zscaler MCP server from the command line with various options. This includes specifying transport, services, debug logging, enabling write operations, listing tools, and showing the version.

```bash
# Run with default settings (stdio transport, read-only mode)
zscaler-mcp

# Run with specific services enabled
zscaler-mcp --services zia,zpa,zdx

# Run with debug logging
zscaler-mcp --debug

# Run with SSE transport on custom port
zscaler-mcp --transport sse --host 0.0.0.0 --port 8080

# Run with streamable-http transport
zscaler-mcp --transport streamable-http --host 0.0.0.0 --port 8000

# Enable write operations with explicit allowlist (REQUIRED)
zscaler-mcp --enable-write-tools --write-tools "zpa_create_*,zpa_delete_*"

# List all available tools
zscaler-mcp --list-tools

# Show version
zscaler-mcp --version
```

--------------------------------

### Run Zscaler MCP Server Examples

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/README.md

These commands show how to execute the example Python scripts for the Zscaler MCP Server using different transport mechanisms: stdio, SSE, and streamable-http. These examples are useful for testing and understanding the server's capabilities.

```sh
# Run with stdio transport
python examples/basic_usage.py

# Run with SSE transport
python examples/sse_usage.py

# Run with streamable-http transport
python examples/streamable_http_usage.py
```

--------------------------------

### Clone and Install zscaler-mcp-server Repository

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/index.md

Instructions for cloning the zscaler-mcp-server repository and setting up the development environment using uv. This includes creating a virtual environment and installing dependencies.

```bash
git clone https://github.com/zscaler/zscaler-mcp-server.git
cd zscaler-mcp-server

# Create .venv and install dependencies
uv sync --all-extras

# Activate the venv
source .venv/bin/activate
```

--------------------------------

### Install Zscaler MCP Server using uv

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Installs the zscaler-mcp-server package using the 'uv' tool. This method requires the package to be published to PyPI. Currently, the package is in development and not yet published, so source installation methods are recommended.

```bash
uv tool install zscaler-mcp-server
```

--------------------------------

### Example .env File Configuration

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/index.html

An example of the .env file used for configuring Zscaler API credentials and other settings for the MCP Server. This file should be copied from .env.example and edited with your specific credentials and desired configurations.

```dotenv
ZSCALER_CLIENT_ID=your_client_id
ZSCALER_CLIENT_SECRET=your_client_secret
ZSCALER_CUSTOMER_ID=your_customer_id
ZSCALER_VANITY_DOMAIN=your_vanity_domain
# Optional configurations below
# ZSCALER_CLOUD=beta
# ZSCALER_USE_LEGACY=false
# ZSCALER_MCP_SERVICES=zia,zpa,zdx
# ZSCALER_MCP_TRANSPORT=stdio
# ZSCALER_MCP_DEBUG=false
# ZSCALER_MCP_HOST=127.0.0.1
# ZSCALER_MCP_PORT=8000
```

--------------------------------

### Install Zscaler MCP Server from Source using uv

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Installs the zscaler-mcp-server package in development mode from the source directory using 'uv pip install -e .'. This is a recommended method for development when the package is not yet published to PyPI.

```bash
uv pip install -e .
```

--------------------------------

### Install uv package manager

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/README.md

This command installs the `uv` package manager, which is required for the `uvx` command used in Cursor's MCP server configuration. It fetches and executes an installation script from a provided URL. Ensure you have `curl` installed and execute this command in your terminal.

```bash
curl -LsSf https://astral.sh/uv/install.sh | sh
```

--------------------------------

### Install Zscaler MCP Server in Development Mode

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Installs the Zscaler MCP Server and its dependencies in development mode using 'uv'. It also includes instructions for activating the virtual environment.

```bash
# Create .venv and install dependencies
uv sync --all-extras

# Activate the venv
source .venv/bin/activate
```

--------------------------------

### Install Zscaler MCP Server using make

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Installs the zscaler-mcp-server package using the 'make install-dev' command. This is a convenience method for development installations. If the package is not found, update your shell PATH.

```bash
make install-dev
```

--------------------------------

### Install Zscaler MCP Server from Source using pip

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Installs the zscaler-mcp-server package in development mode from the source directory using 'pip install -e .'. This is an alternative source installation method.

```bash
pip install -e .
```

--------------------------------

### Initialize ZscalerMCPServer Using Environment Variables

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/README.md

This Python example demonstrates initializing the ZscalerMCPServer by loading configuration from environment variables. This is a common practice for managing sensitive credentials and settings in a secure and flexible manner.

```python
from zscaler_mcp.server import ZscalerMCPServer
import os

# Load from environment variables
server = ZscalerMCPServer(
    debug=True,
    enabled_services={"zia", "zpa"}
)

# Run the server
server.run("stdio")
```

--------------------------------

### Install Zscaler MCP Server using pip

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Installs the Zscaler Integrations MCP Server package using pip. Ensure you have Python 3.11 or higher installed.

```bash
pip install zscaler-mcp
```

--------------------------------

### Configure uvx for Zscaler MCP Server

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Configuration examples for integrating the Zscaler Integrations MCP Server with the uvx client. Shows how to use .env files, specify services, and use individual environment variables for authentication.

```json
{
  "mcpServers": {
    "zscaler-mcp-server": {
      "command": "uvx",
      "args": ["--env-file", "/path/to/.env", "zscaler-mcp-server"]
    }
  }
}
```

```json
{
  "mcpServers": {
    "zscaler-mcp-server": {
      "command": "uvx",
      "args": [
        "--env-file", "/path/to/.env",
        "zscaler-mcp-server",
        "--services", "zia,zpa,zdx"
      ]
    }
  }
}
```

```json
{
  "mcpServers": {
    "zscaler-mcp-server": {
      "command": "uvx",
      "args": ["zscaler-mcp-server"],
      "env": {
        "ZSCALER_CLIENT_ID": "your-client-id",
        "ZSCALER_CLIENT_SECRET": "your-client-secret",
        "ZSCALER_CUSTOMER_ID": "your-customer-id",
        "ZSCALER_VANITY_DOMAIN": "your-vanity-domain"
      }
    }
  }
}
```

--------------------------------

### Installing E2E Test Dependencies with Pip

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/tests/e2e/IMPLEMENTATION.md

Provides the command to install the necessary E2E testing dependencies using pip. This includes installing the project in editable mode with the optional 'e2e' dependencies.

```bash
# Install E2E dependencies
pip install -e ".[e2e]"
```

--------------------------------

### Run Zscaler MCP Server Programmatically

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Starts the Zscaler Integrations MCP Server within a Python script. This allows for programmatic control and integration into larger applications.

```python
from zscaler_mcp.server import ZscalerMCPServer

server = ZscalerMCPServer()
server.run()
```

--------------------------------

### Configure Zscaler MCP Server using Docker in Cursor

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/README.md

This alternative configuration demonstrates setting up the Zscaler MCP server in Cursor using Docker. It specifies the `docker run` command with necessary arguments like `-i`, `--rm`, `--env-file`, and the Docker image name. This method is useful if `uvx` is not installed or preferred. Ensure the `.env` file path is absolute and Docker is installed and configured.

```json
{
  "mcpServers": {
    "zscaler-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--env-file",
        "/absolute/path/to/your/.env",
        "quay.io/zscaler/zscaler-mcp-server:latest"
      ]
    }
  }
}
```

--------------------------------

### Install Project Dependencies (Python, Pip)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/guides/contributing.html

This command installs the necessary Python dependencies for the Zscaler Integrations MCP Server project using pip. It assumes a virtual environment is already activated. The `requirements.txt` file lists the production dependencies, while `requirements-dev.txt` lists development-specific ones.

```bash
pip install -r requirements.txt
pip install -r requirements-dev.txt
```

--------------------------------

### Conventional Commits Example (Git)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/guides/contributing.html

Examples illustrating the Conventional Commits format used for commit messages in the Zscaler Integrations MCP Server project. This format helps in automating releases and maintaining semantic versioning. It includes various types like 'feat', 'fix', 'docs', 'style', 'refactor', 'test', and 'chore'.

```git
feat(zcc): add list_trusted_networks tool
fix(zia): resolve authentication timeout issue
docs: update installation instructions
```

--------------------------------

### Quick Start: Create Secret and Grant Access (AWS CLI)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docs/deployment/secrets_manager_integration.md

This section provides a quick start guide for Approach 1, which is recommended for most users. It involves creating a secret in AWS Secrets Manager with initial credentials and then granting the deployment user permissions to access this secret via an IAM policy.

```bash
# 1. Create secret
aws secretsmanager create-secret \
  --region us-east-1 \
  --name zscaler/mcp/credentials \
  --secret-string '{"ZSCALER_CLIENT_ID":"...","ZSCALER_CLIENT_SECRET":"...",...}'

# 2. Grant your deployment user Secrets Manager access
aws iam put-user-policy \
  --user-name your-user \
  --policy-name ZscalerSecretsAccess \
  --policy-document file://deployment-secrets-policy.json

# 3. Use the updated run_bedrock.sh script (from Step 3 above)
chmod +x run_bedrock.sh
./run_bedrock.sh

# Done! ✅ No container changes needed
```

--------------------------------

### Configure Zscaler OneAPI Authentication via .env File

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Sets up Zscaler OneAPI authentication credentials by creating a `.env` file in the project root. This file should contain your Zscaler client ID, client secret, customer ID, vanity domain, and cloud environment. Remember to add `.env` to your `.gitignore` to prevent committing sensitive information.

```bash
ZSCALER_CLIENT_ID=your_client_id
ZSCALER_CLIENT_SECRET=your_client_secret
ZSCALER_CUSTOMER_ID=your_customer_id
ZSCALER_VANITY_DOMAIN=your_vanity_domain
ZSCALER_CLOUD=beta
```

--------------------------------

### Configure Claude Desktop for Zscaler MCP Server

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Adds the Zscaler MCP server configuration to Claude Desktop. This involves specifying the command to run the server and any necessary arguments.

```json
{
  "mcpServers": {
    "zscaler": {
      "command": "zscaler-mcp-server",
      "args": []
    }
  }
}
```

--------------------------------

### Get Zscaler MCP Server Help Information

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/index.rst.txt

Displays all available command-line options and arguments for the Zscaler Integrations MCP Server. This is useful for discovering all configurable settings.

```bash
zscaler-mcp --help
```

--------------------------------

### Configure ZIA Legacy API Authentication via Environment Variables

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Sets environment variables for authenticating with ZIA Legacy API. This includes username, password, API key, and cloud environment.

```bash
# ZIA Legacy
export ZIA_USERNAME="your_username"
export ZIA_PASSWORD="your_password"
export ZIA_API_KEY="your_api_key"
export ZIA_CLOUD="zscaler"
```

--------------------------------

### Configure ZPA Legacy API Authentication via Environment Variables

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Sets environment variables for authenticating with ZPA Legacy API. This includes client ID, client secret, customer ID, and cloud environment.

```bash
# ZPA Legacy
export ZPA_CLIENT_ID="your_client_id"
export ZPA_CLIENT_SECRET="your_client_secret"
export ZPA_CUSTOMER_ID="your_customer_id"
export ZPA_CLOUD="PRODUCTION"
```

--------------------------------

### Configure Zscaler MCP Server using a YAML File

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Defines Zscaler MCP server configuration in a YAML file, typically named 'zscaler.yaml'. This method allows for centralized configuration of client credentials and logging settings.

```yaml
zscaler:
  client:
    clientId: "your_client_id"
    clientSecret: "your_client_secret"
    vanityDomain: "your_vanity_domain"
    cloud: "zscaler"
    logging:
      enabled: true
      verbose: false
```

--------------------------------

### Configure Zscaler OneAPI Authentication via Environment Variables

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/getting-started.rst.txt

Sets environment variables for authenticating with Zscaler OneAPI. These variables include client ID, client secret, and vanity domain. The cloud environment can also be specified.

```bash
export ZSCALER_CLIENT_ID="your_client_id"
export ZSCALER_CLIENT_SECRET="your_client_secret"
export ZSCALER_VANITY_DOMAIN="your_vanity_domain"
export ZSCALER_CLOUD="zscaler"  # Optional, defaults to zscaler
```

--------------------------------

### Comprehensive Test Assertions (Python)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/tests/e2e/IMPLEMENTATION.md

Provides an example of comprehensive assertions in Python tests. It covers checking tool usage by verifying the number of tools and their names, as well as validating the content of the result for expected keywords.

```python
def assertions(tools, result):
    # Check tool usage
    self.assertGreaterEqual(len(tools), 1)

    # Check result content
    result_lower = result.lower()
    self.assertTrue("expected_content" in result_lower)

    # Check specific tool names if needed
    tool_names = [tool["input"]["tool_name"] for tool in tools]
    self.assertIn("expected_tool_name", tool_names)
```

--------------------------------

### Configure Zscaler MCP Server using uvx in Cursor

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/README.md

This configuration snippet shows how to set up the Zscaler MCP server in Cursor using the `uvx` command. It specifies the command and its arguments, including the path to an environment file and the server name. Ensure the `.env` file path is absolute and the `uvx` command is accessible in your system's PATH.

```json
{
  "mcpServers": {
    "zscaler-mcp-server": {
      "command": "uvx",
      "args": ["--env-file", "/absolute/path/to/your/.env", "zscaler-mcp-server"]
    }
  }
}
```

--------------------------------

### Query Z-Insights Web Traffic Analytics (Python)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/api/services.rst.txt

Shows how to retrieve web traffic data from Z-Insights using OneAPI authentication. It includes examples for getting traffic by location, threat categories, and web protocols within a specified time range. Requires the zscaler-mcp client and time module.

```python
# Z-Insights requires OneAPI (OAuth2) authentication
from zscaler_mcp.client import get_zscaler_client
import time

# Get client with OneAPI (not legacy)
client = get_zscaler_client(use_legacy=False, service="zinsights")

# Calculate timestamps: 7 days ago to 2 days ago
current_time_ms = int(time.time() * 1000)
end_time = current_time_ms - (2 * 24 * 60 * 60 * 1000)   # 2 days ago
start_time = current_time_ms - (7 * 24 * 60 * 60 * 1000)  # 7 days ago

# Get traffic by location
entries, response, err = client.zinsights.web_traffic.get_traffic_by_location(
    start_time=start_time,
    end_time=end_time,
    traffic_unit="TRANSACTIONS",
    limit=10
)

# Get threat categories
entries, response, err = client.zinsights.web_traffic.get_threat_super_categories(
    start_time=start_time,
    end_time=end_time,
    traffic_unit="TRANSACTIONS",
    limit=50
)

# Get web protocols distribution
entries, response, err = client.zinsights.web_traffic.get_protocols(
    start_time=start_time,
    end_time=end_time,
    traffic_unit="BYTES",
    limit=20
)
```

--------------------------------

### Access Zscaler Services using Python Client

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/api/services.rst.txt

Demonstrates how to initialize the Zscaler client and access different Zscaler services like ZIA, ZPA, ZDX, and ZCC using Python. This requires the 'zscaler-mcp' library.

```python
from zscaler_mcp.client import get_zscaler_client

client = get_zscaler_client()

# Access ZIA service
zia_service = client.zia

# Access ZPA service
zpa_service = client.zpa

# Access ZDX service
zdx_service = client.zdx

# Access ZCC service

```

--------------------------------

### Clone Repository and Setup Virtual Environment (Git, Python)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/guides/contributing.html

This snippet demonstrates how to clone the Zscaler Integrations MCP Server repository and set up a Python virtual environment for development. It requires Git for cloning and Python 3.11+ for creating the virtual environment.

```bash
git clone https://github.com/your-username/zscaler-mcp-server.git
cd zscaler-mcp-server
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
```

--------------------------------

### Initialize ZscalerMCPServer as a Python Library

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/README.md

Demonstrates how to instantiate the ZscalerMCPServer class in Python. You can configure various options such as debug logging, enabled services and tools, a custom user-agent comment, and whether to enable write operations. The server defaults to read-only mode.

```python
from zscaler_mcp.server import ZscalerMCPServer

# Create server with read-only mode (default - safe)
server = ZscalerMCPServer(
    debug=True,  # Optional, enable debug logging
    enabled_services={"zia", "zpa", "zdx"},  # Optional, defaults to all services
    enabled_tools={"zia_list_rule_labels", "zpa_list_application_segments"},  # Optional, defaults to all tools
    user_agent_comment="My Custom App",  # Optional, additional User-Agent info
    enable_write_tools=False  # Optional, defaults to False (read-only mode)
)

# Run with stdio transport (default)
server.run()

# Or run with SSE transport
server.run("sse")

# Or run with streamable-http transport
server.run("streamable-http")

# Or run with streamable-http transport on custom host/port
server.run("streamable-http", host="0.0.0.0", port=8080)
```

--------------------------------

### Get Zscaler Client using Legacy API Authentication (Python)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/docsrc/_build/_sources/api/client.rst.txt

Illustrates how to initialize a Zscaler client for legacy API authentication. This includes examples for ZIA and ZPA services, requiring specific parameters such as username, password, API key, client ID, client secret, customer ID, and cloud environment.

```python
from zscaler_mcp.client import get_zscaler_client

# ZIA Legacy
client = get_zscaler_client(
    use_legacy=True,
    service="zia",
    username="your_username",
    password="your_password",
    api_key="your_api_key",
    cloud="your_cloud"
)

# ZPA Legacy
client = get_zscaler_client(
    use_legacy=True,
    service="zpa",
    client_id="your_client_id",
    client_secret="your_client_secret",
    customer_id="your_customer_id",
    cloud="your_cloud"
)
```

--------------------------------

### Mock Realistic API Response Data (Python)

Source: https://github.com/zscaler/zscaler-mcp-server/blob/master/tests/e2e/IMPLEMENTATION.md

Demonstrates how to mock realistic data for API responses, specifically for cloud applications. This example shows a JSON structure with application details including ID, name, category, risk level, and status, which should mirror actual API outputs.

```python
mock_response = {
    "applications": [
        {
            "id": "app-001",
            "name": "Salesforce",
            "category": "Business",
            "risk_level": "Low",
            "status": "Active"
        }
    ]
}
```
Tokens:
Raw