SkillFoxx

Zscaler MCP Server

The official Zscaler MCP server: 402 tools for ZIA, ZPA, ZDX and other services, read-only by default

  • 55 ★ on the repository
  • Last commit
  • MIT
MCP serverOfficial

Broad access

Why this level

  • With writes enabled the agent changes and deletes tenant security policies
  • The OneAPI secret opens access to the organization's security configuration
All reasons and checks

zscaler/zscaler-mcp-serverAuthor:Zscaler

Install

Manual install

uv tool install zscaler-mcp

After installing add the command `uvx --env-file /absolute/path/to/.env zscaler-mcp` to the client.

Access and checks

How we review

Broad accessThe tool can change data, run commands or handle secrets.

  • With writes enabled the agent changes and deletes tenant security policies
  • The OneAPI secret opens access to the organization's security configuration

This is third-party code. Review the repository files before installing.

What it does

Zscaler MCP Server connects an AI agent to the Zscaler Zero Trust Exchange platform. The server provides 402 tools across ten services: ZIA with internet access policies, ZPA with application access, ZDX with monitoring, ZTW, Z-Insights, ZIdentity, EASM, ZCC, ZMS and ZCell. The agent lists application segments, firewall rules and rule labels and reads analytics. By default only `list_*` and `get_*` operations are available. To allow create, update and delete you need both the `--enable-write-tools` flag and an explicit `--write-tools` list of patterns. Deletes are never executed on the first call: a human confirms in an interactive prompt, and a client without that ability gets a single-use confirmation token valid for five minutes.

Who it is for. Zscaler administrators and security teams who review policies and network state together with an agent.

Good fit when

  • Before an audit you need a list of ZPA application segments and segment groups in one request
  • ZIA firewall rules keep growing and must be checked against labels and categories
  • The ZDX user experience score dropped and you need to find the affected applications
  • The agent may only create ZPA records and must not delete or change policies

Not a fit when

  • There is no OneAPI client with the needed rights: without it the server cannot authorize to the tenant
  • Policy changes go through approval and version control and direct writes to the tenant break the process
  • A production tenant with a public preview server: the project warns that features are still changing

Example request

List all ZPA application segments and segment groups, then show ZIA rules labelled legacy

MCP

Transport
stdio, http, sse
Authentication
API key

Environment variables

ZSCALER_CLIENT_ID required
Zscaler OneAPI OAuth client ID.
ZSCALER_CLIENT_SECRET required, secret
OneAPI client secret, `ZSCALER_PRIVATE_KEY` can be set instead.
ZSCALER_CUSTOMER_ID required
Zscaler customer ID.
ZSCALER_VANITY_DOMAIN required
Zscaler tenant vanity domain.

Limitations

Python 3.11 or newer and OneAPI credentials are needed: `ZSCALER_CLIENT_ID`, `ZSCALER_CLIENT_SECRET` or `ZSCALER_PRIVATE_KEY`, `ZSCALER_CUSTOMER_ID`, `ZSCALER_VANITY_DOMAIN`. The project is in public preview and the README advises against production use without checks. The PyPI package is called `zscaler-mcp`, not `zscaler-mcp-server`. For HTTP mode client authentication modes are available: `api-key`, `jwt`, `zscaler` and `oidc`. For a shared tenant it is better to narrow the API client rights to the services you need.

How to disable. Remove the server from the client, delete the `.env` with OneAPI keys and revoke the API client in the Zscaler console. If installed with uv: `uv tool uninstall zscaler-mcp`.

FAQ

How do I connect the server to a client?

In the MCP config add the `uvx` command with arguments `--env-file /absolute/path/to/.env zscaler-mcp`, and the `.env` file holds the OneAPI data.

Can the agent change policies?

Only if the server starts with the `--enable-write-tools` flag and a `--write-tools` list. Without a list no write tool is registered.

How is deletion protected?

A delete never runs on the first call: a human confirms it in a prompt or the client passes a single-use HMAC token that lives five minutes. The check cannot be turned off.

Which Zscaler services are covered?

ZIA, ZPA, ZDX, ZCell, ZMS, ZTW, Z-Insights, ZIdentity, EASM and ZCC. Unneeded services are turned off with `ZSCALER_MCP_SERVICES`.

Where can the server run?

Locally over stdio, in a container, on a virtual machine, in Kubernetes through Helm, in Azure, Google Cloud and Amazon Bedrock AgentCore.

Discussion

No questions or reviews yet.

MCP servers

MCP access to Wazuh for investigating alerts and vulnerabilities, checking SIEM health and invoking response tools

MCP serverBroad access269

Wazuh MCP Server gives an agent access to the Wazuh SIEM so hosts, ports, packages and processes can be queried in plain language.

MCP serverExtended access96
Official

A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging

MCP serverBroad access403
Official

Official Auth0 MCP server: tenant applications, Actions, logs and users via the Management API

MCP serverBroad access122

MCP Scanner

mcp-scanner

Official

A scanner from Cisco AI Defense: checks MCP servers and their tools for threats with three engines, YARA rules, a model and the Cisco API

CLIExtended access1.1K

README in short

A server overview, read and write modes, security layers, client authentication, a services table, installation through uv and containers, deployment on virtual machines and in clouds, and connection to Claude Desktop, Cursor and VS Code.

README badge

Report a problem