zscaler-mcp-server

zscaler-mcp-server is a Model Context Protocol (MCP) server that connects AI agents with the Zscaler Zero Trust Exchange platform. By default, the server operates in read-only mode for security, requiring explicit opt-in to enable write operations.

Support Disclaimer

-> Disclaimer: Please refer to our General Support Statement before proceeding with the use of this provider. You can also refer to our troubleshooting guide for guidance on typical problems.

[!IMPORTANT] 🚧 Public Preview: This project is currently in public preview and under active development. Features and functionality may change before the stable 1.0 release. While we encourage exploration and testing, please avoid production deployments. We welcome your feedback through GitHub Issues to help shape the final release.

📄 Table of contents

• 📺 Overview
• 🔒 Security & Permissions
• 🔐 MCP Client Authentication
• Supported Tools
• Installation & Setup
  • Prerequisites
  • Environment Configuration
  • Installation
• Usage
  • Command Line
  • Service Configuration
  • Additional Command Line Options
• Zscaler API Credentials & Authentication
  • OneAPI Authentication
  • Authentication Troubleshooting
  • MCP Server Configuration
• As a Library
• Container Usage
  • Using Pre-built Image (Recommended)
  • Building Locally (Development)
• Editor/Assistant Integration
  • Using uvx (recommended)
  • With Service Selection
  • Using Individual Environment Variables
  • Docker Version
• Additional Deployment Options
  • Remote MCP Deployment (EC2, VM, etc.)
  • Azure Container Apps / Virtual Machine / AKS (Preview)
  • Google Cloud (Cloud Run / GKE / VM / ADK Agent)
  • Kubernetes (Helm Chart)
  • Amazon Bedrock AgentCore
• Using the MCP Server with Agents
  • Claude Desktop
  • Cursor
  • Visual Studio Code + GitHub Copilot
• Platform Integrations
• Troubleshooting
• License

📺 Overview

The Zscaler Integrations MCP Server brings context to your agents. Try prompts like:

• "List my ZPA Application segments"
• "List my ZPA Segment Groups"
• "List my ZIA Rule Labels"

[!WARNING] 🔒 READ-ONLY BY DEFAULT: For security, this MCP server operates in read-only mode by default. Only list_* and get_* operations are available. To enable tools that can CREATE, UPDATE, or DELETE Zscaler resources, you must explicitly enable write mode using the --enable-write-tools flag or by setting ZSCALER_MCP_WRITE_ENABLED=true. See the Security & Permissions section for details.

<!-- markdownlint-disable MD028 -->

[!TIP] Writing effective prompts: This server exposes 402 tools across multiple Zscaler services. Most MCP clients (Claude Desktop, Cursor, etc.) use deferred tool loading and will search for relevant tools based on your prompt. For best results, be specific about the service and action in your prompts:

• Good: "List my ZPA application segments" — targets the right service and tool directly
• Good: "Show ZIA firewall rules" — clear service (zia) and action (list)
• Less effective: "Show me my devices" — ambiguous; multiple services expose device-related tools

When a service is disabled, its tools are fully removed from the server. However, the AI agent may still attempt to find related tools in other services. If you get unexpected results, refine your prompt with the specific service name (e.g. zpa, zia, zdx, zcc, zcell, zms).

🔒 Security & Permissions

The Zscaler MCP Server implements a security-first design with granular permission controls and safe defaults:

Read-Only Mode (Default - Always Available)

By default, the server operates in read-only mode, exposing only tools that list or retrieve information:

• ✅ ALWAYS AVAILABLE - Read-only tools are registered by the server
• ✅ Safe to use with AI agents autonomously
• ✅ No risk of accidental resource modification or deletion
• ✅ All list_* and get_* operations are available (110+ read-only tools)
• ❌ All create_*, update_*, and delete_* operations are disabled by default
• 💡 Note: You may need to enable read-only tools in your AI agent's UI settings

# Read-only mode (default - safe)
zscaler-mcp

When the server starts in read-only mode, you'll see:

🔒 Server running in READ-ONLY mode (safe default)
   Only list and get operations are available
   To enable write operations, use --enable-write-tools AND --write-tools flags

💡 Read-only tools are ALWAYS registered by the server regardless of any flags. You never need to enable them server-side. Note: Your AI agent UI (like Claude Desktop) may require you to enable individual tools before use.

Write Mode (Explicit Opt-In - Allowlist REQUIRED)

To enable tools that can create, modify, or delete Zscaler resources, you must provide BOTH flags:

1. ✅ --enable-write-tools - Global unlock for write operations
2. ✅ --write-tools "pattern" - MANDATORY explicit allowlist

🔐 SECURITY: Allowlist is MANDATORY - If you set --enable-write-tools without --write-tools, 0 write tools will be registered. This ensures you consciously choose which write operations to enable.

# ❌ WRONG: This will NOT enable any write tools (allowlist missing)
zscaler-mcp --enable-write-tools

# ✅ CORRECT: Explicit allowlist required
zscaler-mcp --enable-write-tools --write-tools "zpa_create_*,zpa_delete_*"

When you try to enable write mode without an allowlist:

⚠️  WRITE TOOLS MODE ENABLED
⚠️  NO allowlist provided - 0 write tools will be registered
⚠️  Read-only tools will still be available
⚠️  To enable write operations, add: --write-tools 'pattern'

Write Tools Allowlist (MANDATORY)

The allowlist provides two-tier security:

1. ✅ First Gate: --enable-write-tools must be set (global unlock)
2. ✅ Second Gate: Explicit allowlist determines which write tools are registered (MANDATORY)

Allowlist Examples:

# Enable ONLY specific write tools with wildcards
zscaler-mcp --enable-write-tools --write-tools "zpa_create_*,zpa_delete_*"

# Enable specific tools without wildcards
zscaler-mcp --enable-write-tools --write-tools "zpa_create_application_segment,zia_create_rule_label"

# Enable all ZPA write operations (but no ZIA/ZDX/ZTW)
zscaler-mcp --enable-write-tools --write-tools "zpa_*"

Or via environment variable:

export ZSCALER_MCP_WRITE_ENABLED=true
export ZSCALER_MCP_WRITE_TOOLS="zpa_create_*,zpa_delete_*"
zscaler-mcp

Wildcard patterns supported:

• zpa_create_* - Allow all ZPA creation tools
• zpa_delete_* - Allow all ZPA deletion tools
• zpa_* - Allow all ZPA write tools
• *_application_segment - Allow all operations on application segments
• zpa_create_application_segment - Exact match (no wildcard)

When using a valid allowlist, you'll see:

⚠️  WRITE TOOLS MODE ENABLED
⚠️  Explicit allowlist provided - only listed write tools will be registered
⚠️  Allowed patterns: zpa_create_*, zpa_delete_*
⚠️  Server can CREATE, MODIFY, and DELETE Zscaler resources
🔒 Security: 85 write tools blocked by allowlist, 8 allowed

Tool Design Philosophy

Each operation is a separate, single-purpose tool with explicit naming that makes its intent clear:

✅ Good (Verb-Based - Current Design)

zpa_list_application_segments    ← Read-only, safe to allow-list
zpa_get_application_segment      ← Read-only, safe to allow-list
zpa_create_application_segment   ← Write operation, requires --enable-write-tools
zpa_update_application_segment   ← Write operation, requires --enable-write-tools
zpa_delete_application_segment   ← Destructive, requires --enable-write-tools

This design allows AI assistants (Claude, Cursor, GitHub Copilot) to:

• Allow-list read-only tools for autonomous exploration
• Require explicit user confirmation for write operations
• Clearly understand the intent of each tool from its name

Responses: the API record, verbatim

A read tool returns the Zscaler API record unchanged. The server does not trim, rename, or re-declare a resource's attributes — that attribute set belongs to the API, so a field Zscaler adds in future reaches you with no server upgrade.

To keep responses small, you control what comes back rather than the server guessing. Two levers:

• --toolsets — load only the slice of tools you need, so the tool catalog stays small (see Toolsets).

• query — every list tool accepts an optional JMESPath expression applied to the results, so the agent projects exactly what it wants:

  zcc_list_devices(query="[*].{user: user, policy: policyName}")   # just those two fields
  zcc_list_devices(query="[?registrationState=='Quarantined']")    # just quarantined devices
  zcc_list_devices(query="length(@)")                              # just the count
  

  Field names are exactly what the Zscaler API returns. Omit query to get the full records.

Security Layers

The server implements multiple layers of security (defense-in-depth). The first nine apply on every transport, including stdio — they govern which tools are exposed and how dangerous calls are confirmed. The remaining HTTP-only layers (TLS, host-header validation, source-IP ACL, MCP client authentication) are described in the Network-Level Controls section further down.

1. **Read-Only T