Zscaler MCP Server – Zero Trust Security Tools
Zscaler Integration MCP Server connects AI agents to Zscaler Zero Trust Exchange products through the Model Context Protocol. It provides tool access for Zscaler services such as ZIA, ZPA, ZDX, ZCC, ZIdentity, and ZMS, with read-only operation enabled by default and write operations requiring explicit opt-in controls.
Overview
Zscaler Integration MCP Server is the official open-source MCP server for connecting AI agents and MCP clients to the Zscaler Zero Trust Exchange platform. It is designed for teams that want conversational, agent-assisted access to Zscaler security configuration, operational data, and product-specific API workflows without giving the model direct unmanaged API access.
The server is implemented as a Python MCP server and is published for local execution, package-based use, and container deployment. Zscaler documents the project as connecting AI agents with the Zero Trust Exchange platform and emphasizes that the default mode is read-only for safer autonomous use.
What the MCP server enables
The server exposes Zscaler tools across multiple services, including ZIA, ZPA, ZDX, ZCC, ZIdentity, ZMS, and related Zero Trust Exchange capabilities. Agents can use these tools to list and retrieve Zscaler resources such as internet access policy objects, private access application segments, digital experience data, client connector information, identity data, and management-service objects, depending on the enabled services and the permissions attached to the configured OneAPI credentials.
By default, only read-oriented list_* and get_* tools are registered. Create, update, and delete operations are disabled unless write mode is explicitly enabled and the operator provides an allowlist for the write tools that should be exposed.
When to use it
Use this MCP server when a security or operations team wants an AI assistant to answer questions about a Zscaler tenant, investigate configuration, summarize policy objects, or support security troubleshooting. Practical examples include asking an agent to list ZPA application segments, show ZIA firewall rules, inspect enabled services, or retrieve ZDX and ZCC information for troubleshooting.
It is especially useful for SOC, Zero Trust operations, network security, and platform administration workflows where a human wants natural-language assistance while still keeping Zscaler API credentials and tool permissions under explicit administrative control.
Connection and authentication
Zscaler documents stdio, sse, and streamable-http transports. The default command-line execution uses stdio; HTTP transports are started with --transport sse or --transport streamable-http, and remote deployments bind to a configured host and port.
Authentication has two layers. Zscaler API access uses OneAPI credentials such as ZSCALER_CLIENT_ID, ZSCALER_CLIENT_SECRET or ZSCALER_PRIVATE_KEY, ZSCALER_CUSTOMER_ID, and ZSCALER_VANITY_DOMAIN. For HTTP transports, MCP client authentication can also be enabled with ZSCALER_MCP_AUTH_ENABLED, ZSCALER_MCP_AUTH_MODE, and related API-key, Zscaler, JWKS, or OAuth configuration variables. Stdio does not use MCP client authentication because the client starts a local process.
Key considerations
The safest deployment pattern is read-only mode, which is the documented default. If write tools are needed, enable them only with both the global write flag and a narrow allowlist, such as specific zpa_create_* or named tool patterns. For HTTP deployments, restrict network exposure with TLS, host validation, source controls, and MCP authentication. The OneAPI entitlements attached to the credentials determine which Zscaler product toolsets are actually usable, so least-privilege credentials should be used.
Supported Transports
streamable_http
URL: http://localhost:8000/mcp
sse
URL: http://localhost:8000/sse
stdio
Command: uvx
Args:
--env-file/absolute/path/to/.envzscaler-mcp
Frequently Asked Questions
- When should an AI agent use the Zscaler MCP Server?
- Use it when an AI agent needs controlled access to live Zscaler tenant configuration and operational data, such as listing ZPA application segments, showing ZIA firewall rules, inspecting ZDX or ZCC data, or helping security teams troubleshoot Zero Trust Exchange settings.
- What does this MCP server add to an AI agent's capabilities?
- It adds structured MCP tools for Zscaler services, allowing the agent to call Zscaler-backed operations instead of relying on static knowledge. The server exposes service-specific tools for ZIA, ZPA, ZDX, ZCC, ZIdentity, ZMS, and related Zscaler management workflows according to the enabled services and credential entitlements.
- What can the AI agent access or manage through this server?
- In default read-only mode, the agent can use `list_*` and `get_*` tools to retrieve supported Zscaler resources and configuration. Write operations such as create, update, or delete actions are disabled by default and only become available when write mode is enabled and a specific write-tool allowlist is provided.
- How is authentication configured for this MCP server?
- Zscaler API authentication uses OneAPI credentials configured through environment variables such as `ZSCALER_CLIENT_ID`, `ZSCALER_CLIENT_SECRET` or `ZSCALER_PRIVATE_KEY`, `ZSCALER_CUSTOMER_ID`, and `ZSCALER_VANITY_DOMAIN`. HTTP MCP client authentication can be enabled separately with `ZSCALER_MCP_AUTH_ENABLED`, `ZSCALER_MCP_AUTH_MODE`, and an API key, Zscaler credential mode, JWKS, or OAuth configuration.
- Which transport should be used for this MCP server?
- Use `stdio` for local desktop or editor integrations where the MCP client starts the server process directly. Use `streamable_http` for hosted or remote MCP deployments. Use `sse` only when a client or deployment pattern specifically requires the SSE transport. For HTTP transports, enable MCP client authentication and restrict network access.