Zscaler Integrations MCP Server

MCP discovered

Details

Transport: streamable-http, sse
Docs: https://zscaler-mcp-server.readthedocs.io/en/latest/security/mcp-client-auth.html

Authentication

Zscaler MCP server API key bearer discovered Get token ↗

Authorization: Bearer <credential>

Generate a key from the server itself with zscaler-mcp --generate-auth-token, or set your own random value in ZSCALER_MCP_AUTH_API_KEY as documented in MCP Client Authentication. For Docker deployments, the same generation flow is available by running the image with --generate-auth-token as shown in Docker.

OIDC JWT accepted by the MCP server jwt discovered Get key ↗

Authorization: Bearer <credential>

Configure the server with ZSCALER_MCP_AUTH_JWKS_URI and optionally ZSCALER_MCP_AUTH_AUDIENCE / ZSCALER_MCP_AUTH_ISSUER so it validates JWTs from your identity provider, as documented in MCP Client Authentication. Then obtain a JWT from that IdP for the configured audience/issuer and send it as Authorization: Bearer <JWT>.

Zscaler OneAPI credentials compound discovered Get key ↗

Authorization: Basic <credential>

Create a .env file with your Zscaler OneAPI values as shown in Getting Started: ZSCALER_CLIENT_ID, ZSCALER_CLIENT_SECRET or JWT-based ZSCALER_PRIVATE_KEY, ZSCALER_VANITY_DOMAIN, and ZSCALER_CUSTOMER_ID when using ZPA tools. The docs describe these as the credentials required for the server to access Zscaler APIs.

Zscaler OneAPI credentials X-Zscaler-Client-ID: <credential> + Zscaler OneAPI credentials X-Zscaler-Client-Secret: <credential> discovered

OIDCProxy OAuth grant for the MCP server oauth2 discovered Set up OAuth ↗

OAuth · resolves from well-known metadata

For oidcproxy mode, the MCP client self-onboards via OAuth 2.1 with Dynamic Client Registration; the client discovers the server metadata and runs the browser consent flow automatically. The docs say clients like mcp-remote handle this flow and the bundled setup script can configure it for you; see MCP Client Authentication and One-step setup script.