# Zscaler MCP Server > Lets your agent look into and manage Zscaler's ZIA, ZPA, ZDX and more with your OneAPI credentials, read-only unless you allow changes. Zscaler's own MCP server for the Zscaler Zero Trust Exchange. It connects your agent to Zscaler's services through OneAPI, so you can review policies, troubleshoot connectivity, audit security settings and investigate incidents in plain words. It's read-only unless you choose otherwise. What you can do with it - ZIA (Internet Access): review firewall, URL filtering, SSL inspection and sandbox rules, locations and URL categories, and check which category a URL falls in - ZPA (Private Access): review application segments, segment groups, server groups, app connectors and access policies, and onboard new applications - ZDX (Digital Experience): check application scores, ongoing alerts and device deep traces to troubleshoot someone's experience - ZCC (Client Connector): list enrolled devices and forwarding profiles - EASM: review findings and lookalike domains on your external attack surface - Z-Insights: look at web traffic, cyber incidents and shadow IT analytics - Also ZIdentity, Workload Segmentation (ZTW), Microsegmentation (ZMS) and Zscaler Cellular How it connects It runs on your machine with uvx zscaler-mcp (Python 3.11 or later, with uv installed), or from Zscaler's Docker image. It signs in to Zscaler with OneAPI credentials from an API client you create in the ZIdentity console: a client ID, a client secret (or a private key), your customer ID and your vanity domain. It only offers tools for the Zscaler products those credentials are entitled to. Zscaler also ships it as a Claude Code plugin with guided skills (onboarding a ZPA application, auditing SSL inspection, investigating ZDX alerts, troubleshooting a user's connectivity and more), as a Claude Desktop extension, and as a Gemini CLI extension. The plugin and the Gemini extension read your credentials from a .env file in their folder. Good to know - Read-only by default: only list and get tools are available. To let it create, change or delete anything, start it with --enable-write-tools and an explicit allowlist of write tools, such as --write-tools "zpa_create_*". - Deletes always need a confirmation first, and that check can't be turned off. - ZIA changes take effect once the staged configuration is activated. - You can load only the toolsets you need (--toolsets) to keep your agent's context small. - Zscaler calls it a public preview and asks you to avoid production deployments for now. - Type: Plugin - Made by: zscaler - Category: Security - Formats: Local MCP, Claude plugins, Extensions - Version: latest - Website: https://github.com/zscaler/zscaler-mcp-server - Source: https://github.com/zscaler/zscaler-mcp-server - Page: https://pluginboard.ai/plugins/zscaler-mcp ## Works with - Claude - GitHub Copilot - Cursor - Claude Code - Codex - Antigravity - Gemini CLI - OpenClaw - OpenCode - Hermes Agent ## Install You'll need: - `ZSCALER_CLIENT_ID` (required): Zscaler OneAPI Client ID from ZIdentity console. - `ZSCALER_CLIENT_SECRET` (required): Zscaler OneAPI Client Secret from ZIdentity console. - `ZSCALER_CUSTOMER_ID` (required): Zscaler Customer ID from ZIdentity console. - `ZSCALER_VANITY_DOMAIN` (required): Zscaler vanity domain (e.g. mycompany.zscloud.net). Replace each `` placeholder with your own value. ### Claude In Claude (web or desktop): Customize → Plugins → Add → Add marketplace, enter anthropics/claude-plugins-official, then add zscaler ### GitHub Copilot Add to VS Code: vscode:mcp/install?%7B%22name%22%3A%22zscaler-mcp-server%22%2C%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22zscaler-mcp%3D%3D0.15.4%22%5D%2C%22env%22%3A%7B%22ZSCALER_CLIENT_ID%22%3A%22%3CZSCALER_CLIENT_ID%3E%22%2C%22ZSCALER_CLIENT_SECRET%22%3A%22%3CZSCALER_CLIENT_SECRET%3E%22%2C%22ZSCALER_CUSTOMER_ID%22%3A%22%3CZSCALER_CUSTOMER_ID%3E%22%2C%22ZSCALER_VANITY_DOMAIN%22%3A%22%3CZSCALER_VANITY_DOMAIN%3E%22%7D%7D Run in your terminal: ```shell code --add-mcp '{"name":"zscaler-mcp-server","command":"uvx","args":["zscaler-mcp==0.15.4"],"env":{"ZSCALER_CLIENT_ID":"","ZSCALER_CLIENT_SECRET":"","ZSCALER_CUSTOMER_ID":"","ZSCALER_VANITY_DOMAIN":""}}' ``` Copilot CLI: ```shell copilot mcp add zscaler-mcp-server --env ZSCALER_CLIENT_ID= --env ZSCALER_CLIENT_SECRET= --env ZSCALER_CUSTOMER_ID= --env ZSCALER_VANITY_DOMAIN= -- uvx zscaler-mcp==0.15.4 ``` ### Cursor Add to Cursor: cursor://anysphere.cursor-deeplink/mcp/install?name=zscaler-mcp-server&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyJ6c2NhbGVyLW1jcD09MC4xNS40Il0sImVudiI6eyJaU0NBTEVSX0NMSUVOVF9JRCI6IjxaU0NBTEVSX0NMSUVOVF9JRD4iLCJaU0NBTEVSX0NMSUVOVF9TRUNSRVQiOiI8WlNDQUxFUl9DTElFTlRfU0VDUkVUPiIsIlpTQ0FMRVJfQ1VTVE9NRVJfSUQiOiI8WlNDQUxFUl9DVVNUT01FUl9JRD4iLCJaU0NBTEVSX1ZBTklUWV9ET01BSU4iOiI8WlNDQUxFUl9WQU5JVFlfRE9NQUlOPiJ9fQ%3D%3D Add to .cursor/mcp.json: ```json { "mcpServers": { "zscaler-mcp-server": { "command": "uvx", "args": [ "zscaler-mcp==0.15.4" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` ### Claude Code In Claude Code: ```text /plugin marketplace add anthropics/claude-plugins-official /plugin install zscaler@claude-plugins-official ``` ### Codex Run in your terminal: ```shell codex mcp add --env ZSCALER_CLIENT_ID= --env ZSCALER_CLIENT_SECRET= --env ZSCALER_CUSTOMER_ID= --env ZSCALER_VANITY_DOMAIN= zscaler-mcp-server -- uvx zscaler-mcp==0.15.4 ``` ### Antigravity Add to ~/.gemini/config/mcp_config.json: ```json { "mcpServers": { "zscaler-mcp-server": { "command": "uvx", "args": [ "zscaler-mcp==0.15.4" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` ### Gemini CLI Run in your terminal: ```shell gemini mcp add -e ZSCALER_CLIENT_ID= -e ZSCALER_CLIENT_SECRET= -e ZSCALER_CUSTOMER_ID= -e ZSCALER_VANITY_DOMAIN= zscaler-mcp-server uvx zscaler-mcp==0.15.4 ``` ### OpenClaw In a terminal: Run openclaw mcp add zscaler-mcp-server --command uvx, with --arg before each argument (zscaler-mcp==0.15.4) and --env NAME=value for each variable it needs. ### OpenCode Run in your terminal: ```shell opencode mcp add zscaler-mcp-server --env ZSCALER_CLIENT_ID= --env ZSCALER_CLIENT_SECRET= --env ZSCALER_CUSTOMER_ID= --env ZSCALER_VANITY_DOMAIN= -- uvx zscaler-mcp==0.15.4 ``` ### Hermes Agent Add to ~/.hermes/config.yaml: ```json { "mcp_servers": { "zscaler-mcp-server": { "command": "uvx", "args": [ "zscaler-mcp==0.15.4" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` --- From Pluginboard (https://pluginboard.ai).