zscaler-mcp-server.readthedocs.io
Zscaler Integrations MCP Server connects AI agents to Zscaler products through the Model Context Protocol. It lets agents use Zscaler toolsets spanning products such as ZIA, ZPA, ZDX, ZCC, and related services.
Zscaler MCP Server exposes an installable Python/Docker CLI and an MCP server supporting `stdio`, `sse`, and `streamable-http`; HTTP MCP can be protected by API key, JWT, Zscaler OneAPI credentials, or OAuth via OIDCProxy.
- Zscaler Integrations MCP Serverdiscovered
- Zscaler Integrations MCP Server (stdio)discovered
- Zscaler Integrations MCP Server CLIdiscovered
Create a .env file with your Zscaler OneAPI values as shown in Getting Started: ZSCALER_CLIENT_ID, ZSCALER_CLIENT_SECRET or JWT-based ZSCALER_PRIVATE_KEY, ZSCALER_VANITY_DOMAIN, and ZSCALER_CUSTOMER_ID when using ZPA tools. The docs describe these as the credentials required for the server to access Zscaler APIs.
Generate a key from the server itself with zscaler-mcp --generate-auth-token, or set your own random value in ZSCALER_MCP_AUTH_API_KEY as documented in MCP Client Authentication. For Docker deployments, the same generation flow is available by running the image with --generate-auth-token as shown in Docker.
Configure the server with ZSCALER_MCP_AUTH_JWKS_URI and optionally ZSCALER_MCP_AUTH_AUDIENCE / ZSCALER_MCP_AUTH_ISSUER so it validates JWTs from your identity provider, as documented in MCP Client Authentication. Then obtain a JWT from that IdP for the configured audience/issuer and send it as Authorization: Bearer <JWT>.
For oidcproxy mode, the MCP client self-onboards via OAuth 2.1 with Dynamic Client Registration; the client discovers the server metadata and runs the browser consent flow automatically. The docs say clients like mcp-remote handle this flow and the bundled setup script can configure it for you; see MCP Client Authentication and One-step setup script.
conventions · 0/8 published
- integrations.json✗
/.well-known/integrations.json - llms.txt✗
/llms.txt - API catalog✗
/.well-known/api-catalog - OpenAPI document✗
/api/schema/, /openapi.json, /swagger.json, /api/openapi.json, or /v1/openapi.json - MCP server card✗
/.well-known/mcp/server-card.json - OAuth protected resource✗
/.well-known/oauth-protected-resource - Agent card✗
/.well-known/agent-card.json - Agent skills✗
/.well-known/agent-skills/index.json
Publish these signals → /publishing