What it can do: Zscaler Zero Trust Exchange
MCP server · zscaler
What Zscaler Zero Trust Exchange declares, asks for and runs, according to the marketplaces we read. Runs on your machine: the AI tool starts this PyPI package locally: zscaler-mcp. Tools it declares: 302. Environment variables it asks for: 10, secrets among them: 5. As of our marketplace pass on 2026-10-11.
This is not a security audit. We list what the marketplaces publish about this plugin: what it declares, what it asks for and what it runs. We do not run or inspect its code, and a verified mark is the marketplace's statement, not ours.
Where it runs
- Runs on your machine: the AI tool starts this PyPI package locally:
zscaler-mcp - Its MCP server runs on your machine: the AI tool starts this PyPI package locally:
${claude-plugin-root}/-env - Runs on your machine, in a container started from this image:
mcp/zscaler-mcp-server
What it declares
Tools it declares: 302. As declared on: Docker MCP Catalog.
get_zia_dlp_dictionariesget_zia_dlp_enginesget_zia_user_departmentsget_zia_user_groupsget_zia_usersget_zpa_app_protection_profileget_zpa_app_segments_by_typeget_zpa_enrollment_certificateget_zpa_isolation_profileget_zpa_posture_profileget_zpa_saml_attributeget_zpa_scim_attribute
Show the remaining 188
get_zpa_scim_groupget_zpa_trusted_networkzcc_list_deviceszcc_list_forwarding_profileszcc_list_trusted_networkszdx_delete_analysiszdx_delete_deeptracezdx_get_alertzdx_get_analysiszdx_get_applicationzdx_get_application_metriczdx_get_application_score_trendzdx_get_application_userzdx_get_deeptrace_cloudpathzdx_get_deeptrace_cloudpath_metricszdx_get_deeptrace_eventszdx_get_deeptrace_health_metricszdx_get_deeptrace_webprobe_metricszdx_get_devicezdx_get_device_deep_tracezdx_get_software_detailszdx_get_web_probeszdx_list_alert_affected_deviceszdx_list_alertszdx_list_application_userszdx_list_applicationszdx_list_cloudpath_probeszdx_list_deeptrace_top_processeszdx_list_departmentszdx_list_device_deep_traceszdx_list_deviceszdx_list_historical_alertszdx_list_locationszdx_list_softwarezdx_start_analysiszdx_start_deeptracezeasm_get_finding_detailszeasm_get_finding_evidencezeasm_get_finding_scan_outputzeasm_get_lookalike_domainzeasm_list_findingszeasm_list_lookalike_domainszeasm_list_organizationszia_activate_configurationzia_add_atp_malicious_urlszia_add_auth_exempt_urlszia_add_urls_to_categoryzia_bulk_update_cloud_applicationszia_create_cloud_firewall_rulezia_create_gre_tunnelzia_create_ip_destination_groupzia_create_ip_source_groupzia_create_locationzia_create_network_app_groupzia_create_network_servicezia_create_network_svc_groupzia_create_rule_labelzia_create_ssl_inspection_rulezia_create_static_ipzia_create_url_categoryzia_create_url_filtering_rulezia_create_vpn_credentialzia_create_web_dlp_rulezia_delete_atp_malicious_urlszia_delete_auth_exempt_urlszia_delete_cloud_firewall_rulezia_delete_gre_tunnelzia_delete_ip_destination_groupzia_delete_ip_source_groupzia_delete_locationzia_delete_network_app_groupzia_delete_network_servicezia_delete_network_svc_groupzia_delete_rule_labelzia_delete_ssl_inspection_rulezia_delete_static_ipzia_delete_url_categoryzia_delete_url_filtering_rulezia_delete_vpn_credentialzia_delete_web_dlp_rulezia_geo_searchzia_get_activation_statuszia_get_cloud_firewall_rulezia_get_gre_tunnelzia_get_ip_destination_groupzia_get_ip_source_groupzia_get_locationzia_get_network_appzia_get_network_app_groupzia_get_network_servicezia_get_network_svc_groupzia_get_rule_labelzia_get_sandbox_behavioral_analysiszia_get_sandbox_file_hash_countzia_get_sandbox_quotazia_get_sandbox_reportzia_get_ssl_inspection_rulezia_get_static_ipzia_get_url_categoryzia_get_url_filtering_rulezia_get_vpn_credentialzia_get_web_dlp_rulezia_list_atp_malicious_urlszia_list_auth_exempt_urlszia_list_cloud_app_control_actionszia_list_cloud_application_custom_tagszia_list_cloud_applicationszia_list_cloud_firewall_ruleszia_list_device_groupszia_list_deviceszia_list_devices_litezia_list_gre_rangeszia_list_gre_tunnelszia_list_ip_destination_groupszia_list_ip_source_groupszia_list_locationszia_list_network_app_groupszia_list_network_appszia_list_network_serviceszia_list_network_svc_groupszia_list_rule_labelszia_list_ssl_inspection_ruleszia_list_static_ipszia_list_url_categorieszia_list_url_filtering_ruleszia_list_vpn_credentialszia_list_web_dlp_ruleszia_list_web_dlp_rules_litezia_remove_urls_from_categoryzia_update_cloud_firewall_rulezia_update_ip_destination_groupzia_update_ip_source_groupzia_update_locationzia_update_network_app_groupzia_update_network_servicezia_update_network_svc_groupzia_update_rule_labelzia_update_ssl_inspection_rulezia_update_static_ipzia_update_url_categoryzia_update_url_filtering_rulezia_update_vpn_credentialzia_update_web_dlp_rulezia_url_lookupzid_get_groupzid_get_group_userszid_get_group_users_by_namezid_get_userzid_get_user_groupszid_get_user_groups_by_namezid_list_groupszid_list_userszid_search_groupszid_search_userszins_get_casb_app_reportzins_get_cyber_incidentszins_get_cyber_incidents_by_locationzins_get_cyber_incidents_by_threat_and_appzins_get_cyber_incidents_dailyzins_get_firewall_by_actionzins_get_firewall_by_locationzins_get_firewall_network_serviceszins_get_iot_device_statszins_get_shadow_it_appszins_get_shadow_it_summaryzins_get_threat_classzins_get_threat_super_categorieszins_get_web_protocolszins_get_web_traffic_by_locationzins_get_web_traffic_no_groupingzms_get_agent_connection_status_statisticszms_get_agent_group_totp_secretszms_get_agent_version_statisticszms_get_metadatazms_get_noncezms_get_resource_group_memberszms_get_resource_group_protection_statuszms_get_resource_protection_statuszms_list_agent_groupszms_list_agentszms_list_app_catalogzms_list_app_zoneszms_list_default_policy_ruleszms_list_nonceszms_list_policy_ruleszms_list_resource_groupszms_list_resourceszms_list_tag_keys
We keep the first 200 names of a list.
Prompts and resources: the marketplaces we read do not publish them.
What it asks for
Environment variables it asks for: 4, secrets among them: 2. As declared on: Official MCP Registry.
ZSCALER_CLIENT_IDsecret requiredZSCALER_CLIENT_SECRETsecret requiredZSCALER_CUSTOMER_IDrequiredZSCALER_VANITY_DOMAINrequired
Environment variables it asks for: 10, secrets among them: 5. As declared on: Docker MCP Catalog.
ZSCALER_CLIENT_IDsecret requiredZSCALER_CLIENT_SECRETsecret requiredZSCALER_CLOUDsecret requiredZSCALER_CUSTOMER_IDsecret requiredZSCALER_MCP_DISABLED_SERVICESZSCALER_MCP_DISABLED_TOOLSZSCALER_MCP_SKIP_CONFIRMATIONSZSCALER_MCP_WRITE_ENABLEDZSCALER_MCP_WRITE_TOOLSZSCALER_VANITY_DOMAINsecret required
Names only: we keep no values, examples or descriptions of these variables. OAuth scopes and install-time settings are not published by the marketplaces we read.
What it runs besides MCP
Commands: 20 As declared on: Claude Code: claude-plugins-official.
app-healthaudit-softwareaudit-sslcheck-accesscompare-locationscreate-access-rulecreate-forwarding-rulecreate-server-groupcreate-timeout-rulediagnose-deeptraceinvestigate-alertsinvestigate-incident
Show the remaining 8
investigate-sandboxinvestigate-urlonboard-apponboard-locationreview-attack-surfacetroubleshoot-connectortroubleshoot-experiencetroubleshoot-user
Rules: 7 As declared on: Claude Code: claude-plugins-official.
cross-service-overlapwrite-operation-safetyzdx-read-onlyzia-activation-requiredzms-graphql-conventionszpa-dependency-chainzscaler-tool-conventions
Who answers for it
zscaler
- No marketplace we read marks it or its publisher as verified.
- License: MIT.
- The repository github.com/zscaler/zscaler-mcp-server belongs to the account the publisher is listed under on Official MCP Registry.
How it has changed
Its tools, settings, hooks and composition have not changed since we started watching it.
In context
- Median number of secrets an MCP server asks for on the marketplaces we read: 0.0. This one asks for: 5.
- Share of MCP servers that run on a remote server: 63%.
Where it is published and how its figures have moved
Data comes from the Official MCP Registry (registry.modelcontextprotocol.io), CC0 1.0. Data comes from the public marketplace file https://github.com/anthropics/claude-plugins-official/blob/HEAD/.claude-plugin/marketplace.json. Data comes from the Docker MCP Catalog (desktop.docker.com/mcp/catalog) and Docker Hub. Figures come from our own regular passes over the marketplaces, last read on . We publish no contact details for plugin publishers.