Zscaler Zero Trust Exchange

listing.by

Manage Zscaler Zero Trust Exchange services such as ZPA, ZIA, ZDX and ZCC through more than 400 tools, read-only by default.

state.local.long (state.local.title)listing.badge.runs_withstate.key.long

listing.install

listing.local.explain

uvx zscaler-mcp

listing.local.needs listing.local.note

  • ZSCALER_CLIENT_ID listing.env.secret Zscaler OneAPI Client ID from ZIdentity console.
  • ZSCALER_CLIENT_SECRET listing.env.secret Zscaler OneAPI Client Secret from ZIdentity console.
  • ZSCALER_CUSTOMER_ID Zscaler Customer ID from ZIdentity console.
  • ZSCALER_VANITY_DOMAIN Zscaler vanity domain (e.g. mycompany.zscloud.net).
act.add_to a11y.new_tab

listing.share.h

listing.share.p_local

mcp.tc/i/zscaler-zero-trust-exchange

listing.about

Connects an AI assistant to the Zscaler Zero Trust Exchange platform. It exposes about 400 tools across services including ZPA, ZIA, ZDX, ZCC, ZTW, ZMS and EASM, so you can list and inspect resources such as application segments, segment groups and firewall rule labels.

The server runs locally over stdio, started with uvx from the zscaler-mcp PyPI package, or as a Docker image. It needs a Zscaler OneAPI client ID, client secret, customer ID and vanity domain. It starts in read-only mode; create, update and delete tools need an explicit write flag plus an allowlist. The project is labelled public preview.

listing.can

  • List and inspect ZPA application segments and segment groups
  • Review ZIA configuration such as rule labels and firewall rules
  • Query multiple Zscaler services from one server
  • Run in read-only mode by default
  • Enable selected write tools through an explicit allowlist
  • Select which Zscaler services to load

listing.tools

listing.notools.key

listing.prompts

  • List my ZPA application segments

  • Show ZIA firewall rules

  • List my ZPA segment groups

  • List my ZIA rule labels

listing.setup.h

listing.setup.local

Claude Code

  1. Run this in a terminal, in your project folder:
claude mcp add --transport stdio zscaler-zero-trust-exchange --env "ZSCALER_CLIENT_ID=<YOUR_ZSCALER_CLIENT_ID>" --env "ZSCALER_CLIENT_SECRET=<YOUR_ZSCALER_CLIENT_SECRET>" --env "ZSCALER_CUSTOMER_ID=<YOUR_ZSCALER_CUSTOMER_ID>" --env "ZSCALER_VANITY_DOMAIN=<YOUR_ZSCALER_VANITY_DOMAIN>" -- uvx zscaler-mcp
  1. Start Claude Code and type /mcp. zscaler-zero-trust-exchange should show as connected.

Add --scope user to make it available in every project. Replace the placeholders with your own values.

Claude Desktop

  1. Open Settings → Developer → Edit Config. It opens claude_desktop_config.json. Add:
claude_desktop_config.json
{
  "mcpServers": {
    "zscaler-zero-trust-exchange": {
      "command": "uvx",
      "args": [
        "zscaler-mcp"
      ],
      "env": {
        "ZSCALER_CLIENT_ID": "<YOUR_ZSCALER_CLIENT_ID>",
        "ZSCALER_CLIENT_SECRET": "<YOUR_ZSCALER_CLIENT_SECRET>",
        "ZSCALER_CUSTOMER_ID": "<YOUR_ZSCALER_CUSTOMER_ID>",
        "ZSCALER_VANITY_DOMAIN": "<YOUR_ZSCALER_VANITY_DOMAIN>"
      }
    }
  }
}
  1. Save the file and restart Claude Desktop. Replace the placeholders with your own values.

Needs uv (Python) on your computer. The file lives in ~/Library/Application Support/Claude/ on macOS and %APPDATA%\Claude\ on Windows.

Cursor

Add to Cursor a11y.new_tab

Or add it by hand to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project):

mcp.json
{
  "mcpServers": {
    "zscaler-zero-trust-exchange": {
      "command": "uvx",
      "args": [
        "zscaler-mcp"
      ],
      "env": {
        "ZSCALER_CLIENT_ID": "<YOUR_ZSCALER_CLIENT_ID>",
        "ZSCALER_CLIENT_SECRET": "<YOUR_ZSCALER_CLIENT_SECRET>",
        "ZSCALER_CUSTOMER_ID": "<YOUR_ZSCALER_CUSTOMER_ID>",
        "ZSCALER_VANITY_DOMAIN": "<YOUR_ZSCALER_VANITY_DOMAIN>"
      }
    }
  }
}

Needs uv (Python) on your computer. Replace the placeholders with your own values.

VS Code

Add it to .vscode/mcp.json. VS Code asks for the secret the first time and stores it securely:

.vscode/mcp.json
{
  "servers": {
    "zscaler-zero-trust-exchange": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "zscaler-mcp"
      ],
      "env": {
        "ZSCALER_CLIENT_ID": "${input:zscaler-client-id}",
        "ZSCALER_CLIENT_SECRET": "${input:zscaler-client-secret}",
        "ZSCALER_CUSTOMER_ID": "<YOUR_ZSCALER_CUSTOMER_ID>",
        "ZSCALER_VANITY_DOMAIN": "<YOUR_ZSCALER_VANITY_DOMAIN>"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "zscaler-client-id",
      "description": "ZSCALER_CLIENT_ID",
      "password": true
    },
    {
      "type": "promptString",
      "id": "zscaler-client-secret",
      "description": "ZSCALER_CLIENT_SECRET",
      "password": true
    }
  ]
}

Needs uv (Python) on your computer.

Devin Desktop

  1. Add it to ~/.config/devin/mcp_config.json (macOS and Linux) or %APPDATA%\devin\mcp_config.json (Windows):
mcp_config.json
{
  "mcpServers": {
    "zscaler-zero-trust-exchange": {
      "command": "uvx",
      "args": [
        "zscaler-mcp"
      ],
      "env": {
        "ZSCALER_CLIENT_ID": "<YOUR_ZSCALER_CLIENT_ID>",
        "ZSCALER_CLIENT_SECRET": "<YOUR_ZSCALER_CLIENT_SECRET>",
        "ZSCALER_CUSTOMER_ID": "<YOUR_ZSCALER_CUSTOMER_ID>",
        "ZSCALER_VANITY_DOMAIN": "<YOUR_ZSCALER_VANITY_DOMAIN>"
      }
    }
  }
}
  1. Refresh the MCP server list in Cascade. Replace the placeholders with your own values.

Devin Desktop is the new name for Windsurf.

Codex

codex mcp add zscaler-zero-trust-exchange --env "ZSCALER_CLIENT_ID=<YOUR_ZSCALER_CLIENT_ID>" --env "ZSCALER_CLIENT_SECRET=<YOUR_ZSCALER_CLIENT_SECRET>" --env "ZSCALER_CUSTOMER_ID=<YOUR_ZSCALER_CUSTOMER_ID>" --env "ZSCALER_VANITY_DOMAIN=<YOUR_ZSCALER_VANITY_DOMAIN>" -- uvx zscaler-mcp

Or edit ~/.codex/config.toml directly:

config.toml
[mcp_servers.zscaler-zero-trust-exchange]
command = "uvx"
args = ["zscaler-mcp"]
env = { ZSCALER_CLIENT_ID = "<YOUR_ZSCALER_CLIENT_ID>", ZSCALER_CLIENT_SECRET = "<YOUR_ZSCALER_CLIENT_SECRET>", ZSCALER_CUSTOMER_ID = "<YOUR_ZSCALER_CUSTOMER_ID>", ZSCALER_VANITY_DOMAIN = "<YOUR_ZSCALER_VANITY_DOMAIN>" }

Needs uv (Python) on your computer. Replace the placeholders with your own values.

Gemini CLI

gemini mcp add -e "ZSCALER_CLIENT_ID=<YOUR_ZSCALER_CLIENT_ID>" -e "ZSCALER_CLIENT_SECRET=<YOUR_ZSCALER_CLIENT_SECRET>" -e "ZSCALER_CUSTOMER_ID=<YOUR_ZSCALER_CUSTOMER_ID>" -e "ZSCALER_VANITY_DOMAIN=<YOUR_ZSCALER_VANITY_DOMAIN>" zscaler-zero-trust-exchange uvx zscaler-mcp

This adds it to the current project. Add -s user to use it everywhere.

Any client

Most clients that start local servers accept this shape:

{
  "mcpServers": {
    "zscaler-zero-trust-exchange": {
      "command": "uvx",
      "args": [
        "zscaler-mcp"
      ],
      "env": {
        "ZSCALER_CLIENT_ID": "<YOUR_ZSCALER_CLIENT_ID>",
        "ZSCALER_CLIENT_SECRET": "<YOUR_ZSCALER_CLIENT_SECRET>",
        "ZSCALER_CUSTOMER_ID": "<YOUR_ZSCALER_CUSTOMER_ID>",
        "ZSCALER_VANITY_DOMAIN": "<YOUR_ZSCALER_VANITY_DOMAIN>"
      }
    }
  }
}

Zed puts servers under context_servers in its settings, with the same command, args and env fields.

Needs uv (Python) on your computer. Replace the placeholders with your own values.

listing.faq

Can I paste mcp.tc/i/zscaler-zero-trust-exchange into my MCP client?

No. Zscaler Zero Trust Exchange runs on your own computer, started by your client, so it has no web address to connect to. The quick link is the page to share; the install command is uvx zscaler-mcp.

Does Zscaler Zero Trust Exchange need an API key?

Yes. It reads ZSCALER_CLIENT_ID, ZSCALER_CLIENT_SECRET, ZSCALER_CUSTOMER_ID and ZSCALER_VANITY_DOMAIN from its environment, and ZSCALER_CLIENT_ID and ZSCALER_CLIENT_SECRET are secrets. Put the value in your client's config on your own machine, never in a shared file.

Is Zscaler Zero Trust Exchange a remote or a local server?

Local. Your client starts it as a process on your computer with uvx zscaler-mcp, which needs uv (Python).

What can Zscaler Zero Trust Exchange do?

You can list and inspect ZPA application segments and segment groups, review ZIA configuration such as rule labels and firewall rules and query multiple Zscaler services from one server.

Which clients can use it?

Any client that starts local servers: Claude Code, Claude Desktop, Cursor, VS Code, Devin Desktop, Codex, Gemini CLI, Zed and others. claude.ai and ChatGPT only connect to remote servers.

Who wrote this page?

mcp.tc's robot read Zscaler Zero Trust Exchange's public metadata (its package and repository pages), and an AI model drafted the text from it. A person reviews anything the checks can't confirm. The text can still be wrong, so if you spot a mistake, use Report this listing on this page.

listing.em.h

listing.em.lead_local listing.em.how

listing.em.badge

em.prev_lightem.prev_dark
Markdown
[![Zscaler Zero Trust Exchange on mcp.tc](https://mcp.tc/i/zscaler-zero-trust-exchange/badge.svg)](https://mcp.tc/i/zscaler-zero-trust-exchange)
HTML
<a href="https://mcp.tc/i/zscaler-zero-trust-exchange"><img src="https://mcp.tc/i/zscaler-zero-trust-exchange/badge.svg" alt="Zscaler Zero Trust Exchange on mcp.tc" height="20"></a>

listing.em.badge_note

listing.em.widget

HTML
<script src="https://mcp.tc/w/zscaler-zero-trust-exchange.js" async></script>

listing.em.widget_note

iframe

HTML
<iframe src="https://mcp.tc/embed/zscaler-zero-trust-exchange" title="Zscaler Zero Trust Exchange on mcp.tc" width="420" height="200" loading="lazy" allow="clipboard-write" style="border:0;border-radius:8px;max-width:100%"></iframe>

listing.em.iframe_note

JSON

listing.em.json_local

https://mcp.tc/i/zscaler-zero-trust-exchange.json

listing.em.fields

listing.related

listing.more_in

  • StackHawk

    Security & Compliance

    state.local.label (state.local.title)

    Set up StackHawk, run security scans and triage findings from your IDE or chat.

    mcp.tc/i/stackhawk

  • Snyk API & Web

    Snyk

    state.local.label (state.local.title)

    Onboard scan targets, run DAST scans and triage vulnerability findings in Snyk API & Web from your AI assistant.

    mcp.tc/i/snyk-api-web

  • SonarQubevf.sr

    SonarSource

    state.local.label (state.local.title)

    Check code quality and security issues, quality gates and code snippets with SonarQube Server or SonarQube Cloud from your AI assistant.

    mcp.tc/i/sonarqube

  • Oktavf.sr

    Security & Compliance

    state.local.label (state.local.title)

    Manage Okta users, groups, applications, policies and system logs from your assistant using natural language.

    mcp.tc/i/okta

  • CrowdStrike Falconvf.sr

    CrowdStrike

    state.local.label (state.local.title)

    Query CrowdStrike Falcon detections, hosts, threat intel, vulnerabilities and more from your AI assistant.

    mcp.tc/i/crowdstrike-falcon

  • Burp Suite

    PortSwigger

    state.local.label (state.local.title)

    Drive Burp Suite from AI clients through an extension that exposes Burp over MCP, with an SSE endpoint and a bundled stdio proxy.

    mcp.tc/i/burp-suite

listing.disclaimer_checked