Skip to main content

Zscaler MCP Server

zscaler-mcp-server is a Model Context Protocol (MCP) server that connects AI agents with the Zscaler Zero Trust Exchange platform.

By default, the server operates in read-only mode for security, requiring explicit opt-in to enable write operations.

Public Preview

This project is in public preview and under active development. Features and functionality may change before the stable 1.0 release. Avoid production deployments and please share feedback through GitHub Issues.

What it does​

The Zscaler MCP Server brings context to your AI agents. Try prompts like:

  • "List my ZPA application segments"
  • "List my ZPA segment groups"
  • "List my ZIA rule labels"
  • "Show the ZDX experience score for my San Francisco office in the last 24 hours"

It exposes 300+ tools across every major Zscaler product, behind a single MCP interface that any MCP-compatible client (Claude Desktop, Claude Code, Cursor, Gemini CLI, Kiro IDE, VS Code + Copilot) can speak.

Supported services​

ServiceCodeDescription
ZPAZscaler Private AccessApplication segments, server groups, access policies, app connector groups, PRA
ZIAZscaler Internet AccessURL filtering, cloud firewall, DLP, SSL inspection, sandbox, ATP, cloud app control
ZDXZscaler Digital ExperienceApplication/device experience scores, deep traces, alerts, software inventory
ZCCZscaler Client ConnectorDevice enrollment, forwarding profiles, trusted networks
ZTWZscaler Cloud & Branch ConnectorIP groups, network services, admin roles
ZIdentityIdentity serviceUsers, groups
EASMExternal Attack Surface ManagementFindings, lookalike domains, asset evidence
Z-InsightsAnalyticsWeb traffic, threat trends, CASB, shadow IT, IoT
ZMSMicrosegmentationAgents, resources, policy rules, tags

See Services overview for the full per-service tool catalog.

Security-first by design​

The server ships with safe defaults and multiple defense-in-depth layers:

  • Read-only by default — only list_* and get_* operations are exposed
  • Mandatory write allowlist — enabling writes requires both --enable-write-tools AND an explicit --write-tools pattern
  • HMAC-confirmed deletes — destructive actions require a cryptographic confirmation token that prompt-injection cannot forge
  • OneAPI entitlement filter — toolsets for unentitled products are silently dropped at startup
  • Output sanitization — every tool response is scrubbed of invisible Unicode, HTML, and prompt-injection payloads
  • TLS + Host-header validation + Source-IP ACL — for HTTP transports

See Security for the full security model.