# Zscaler Zero Trust Exchange MCP server > Manage Zscaler Zero Trust Exchange services such as ZPA, ZIA, ZDX and ZCC through more than 400 tools, read-only by default. - Listing: https://mcp.tc/i/zscaler-zero-trust-exchange - Connect: this is a local (stdio) server; install it on your machine (see Install). The listing link is a page, not an MCP endpoint. - Type: local (stdio) - Auth: API key - Category: [Security & Compliance](https://mcp.tc/c/security) - Vendor: Zscaler - Repository: - Package: pypi `zscaler-mcp` ## About Connects an AI assistant to the Zscaler Zero Trust Exchange platform. It exposes about 400 tools across services including ZPA, ZIA, ZDX, ZCC, ZTW, ZMS and EASM, so you can list and inspect resources such as application segments, segment groups and firewall rule labels. The server runs locally over stdio, started with uvx from the zscaler-mcp PyPI package, or as a Docker image. It needs a Zscaler OneAPI client ID, client secret, customer ID and vanity domain. It starts in read-only mode; create, update and delete tools need an explicit write flag plus an allowlist. The project is labelled public preview. ## What it can do - List and inspect ZPA application segments and segment groups - Review ZIA configuration such as rule labels and firewall rules - Query multiple Zscaler services from one server - Run in read-only mode by default - Enable selected write tools through an explicit allowlist - Select which Zscaler services to load ## Example prompts - "List my ZPA application segments" - "Show ZIA firewall rules" - "List my ZPA segment groups" - "List my ZIA rule labels" ## Install ### Claude Code 1. Run this in a terminal, in your project folder: ```bash claude mcp add --transport stdio zscaler-zero-trust-exchange --env "ZSCALER_CLIENT_ID=" --env "ZSCALER_CLIENT_SECRET=" --env "ZSCALER_CUSTOMER_ID=" --env "ZSCALER_VANITY_DOMAIN=" -- uvx zscaler-mcp ``` 2. Start Claude Code and type `/mcp`. **zscaler-zero-trust-exchange** should show as connected. Add `--scope user` to make it available in every project. Replace the placeholders with your own values. ### Claude Desktop 1. Open **Settings → Developer → Edit Config**. It opens `claude_desktop_config.json`. Add: `claude_desktop_config.json`: ```json { "mcpServers": { "zscaler-zero-trust-exchange": { "command": "uvx", "args": [ "zscaler-mcp" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` 2. Save the file and restart Claude Desktop. Replace the placeholders with your own values. Needs uv (Python) on your computer. The file lives in `~/Library/Application Support/Claude/` on macOS and `%APPDATA%\Claude\` on Windows. ### Cursor [Add to Cursor]() (opens Cursor) Or add it by hand to `~/.cursor/mcp.json` (all projects) or `.cursor/mcp.json` (this project): `mcp.json`: ```json { "mcpServers": { "zscaler-zero-trust-exchange": { "command": "uvx", "args": [ "zscaler-mcp" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` Needs uv (Python) on your computer. Replace the placeholders with your own values. ### VS Code Add it to `.vscode/mcp.json`. VS Code asks for the secret the first time and stores it securely: `.vscode/mcp.json`: ```json { "servers": { "zscaler-zero-trust-exchange": { "type": "stdio", "command": "uvx", "args": [ "zscaler-mcp" ], "env": { "ZSCALER_CLIENT_ID": "${input:zscaler-client-id}", "ZSCALER_CLIENT_SECRET": "${input:zscaler-client-secret}", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } }, "inputs": [ { "type": "promptString", "id": "zscaler-client-id", "description": "ZSCALER_CLIENT_ID", "password": true }, { "type": "promptString", "id": "zscaler-client-secret", "description": "ZSCALER_CLIENT_SECRET", "password": true } ] } ``` Needs uv (Python) on your computer. ### Devin Desktop 1. Add it to `~/.config/devin/mcp_config.json` (macOS and Linux) or `%APPDATA%\devin\mcp_config.json` (Windows): `mcp_config.json`: ```json { "mcpServers": { "zscaler-zero-trust-exchange": { "command": "uvx", "args": [ "zscaler-mcp" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` 2. Refresh the MCP server list in Cascade. Replace the placeholders with your own values. Devin Desktop is the new name for Windsurf. ### Codex ```bash codex mcp add zscaler-zero-trust-exchange --env "ZSCALER_CLIENT_ID=" --env "ZSCALER_CLIENT_SECRET=" --env "ZSCALER_CUSTOMER_ID=" --env "ZSCALER_VANITY_DOMAIN=" -- uvx zscaler-mcp ``` Or edit `~/.codex/config.toml` directly: `config.toml`: ```toml [mcp_servers.zscaler-zero-trust-exchange] command = "uvx" args = ["zscaler-mcp"] env = { ZSCALER_CLIENT_ID = "", ZSCALER_CLIENT_SECRET = "", ZSCALER_CUSTOMER_ID = "", ZSCALER_VANITY_DOMAIN = "" } ``` Needs uv (Python) on your computer. Replace the placeholders with your own values. ### Gemini CLI ```bash gemini mcp add -e "ZSCALER_CLIENT_ID=" -e "ZSCALER_CLIENT_SECRET=" -e "ZSCALER_CUSTOMER_ID=" -e "ZSCALER_VANITY_DOMAIN=" zscaler-zero-trust-exchange uvx zscaler-mcp ``` This adds it to the current project. Add `-s user` to use it everywhere. ### Any client Most clients that start local servers accept this shape: ```json { "mcpServers": { "zscaler-zero-trust-exchange": { "command": "uvx", "args": [ "zscaler-mcp" ], "env": { "ZSCALER_CLIENT_ID": "", "ZSCALER_CLIENT_SECRET": "", "ZSCALER_CUSTOMER_ID": "", "ZSCALER_VANITY_DOMAIN": "" } } } } ``` Zed puts servers under `context_servers` in its settings, with the same `command`, `args` and `env` fields. Needs uv (Python) on your computer. Replace the placeholders with your own values. ## Details - Server version: 0.15.4 - Last checked: 2026-10-04 - Listed: 2026-10-04 - Updated: 2026-10-04 --- Source: https://mcp.tc/i/zscaler-zero-trust-exchange (mcp.tc is an independent directory, not affiliated with this server's publisher). Corrections: https://mcp.tc/report