I Got Featured on the Official OWASP ZAP Blog — Here's How I Built an AI Layer on Top of It published: true tags: security, ai, mcp, opensource

Months ago I was a full-stack dev with zero security research experience. Last month, the OWASP ZAP team published a guest post about a tool I built. Here's the story, and the tech behind it.
The problem
Every serious security platform locks its best automation, correlation, and workflow features behind an enterprise price tag. I wanted something fully programmatic, fully open, and fully mine to extend. So I picked ZAP — open source, scriptable REST API, no licensing walls — and started layering AI on top of it.
The result is VulneraMCP, an MCP server that turns ZAP from "a scanner you drive" into "a scanner an AI agent drives, with a memory."
🔗 Repo: github.com/telmon95/VulneraMCP
📝 OWASP ZAP feature: zaproxy.org/blog/2025-11-28-enhancing-zap-with-ai-for-bug-bounty-hunting
What it actually does
VulneraMCP sits between an AI agent (Cursor, Claude Desktop, ChatGPT — anything that speaks MCP) and ZAP's REST API. It's not just a wrapper. Three things make it different:
ZAP Integration Layer — drives spidering, active/passive scanning, context management, alert retrieval
MCP Proxy Layer — intercepts traffic and runs custom logic ZAP doesn't ship with (IDOR checks, business-logic flaws)
Learning Engine — ingests writeups and lab solutions from HackTheBox and PortSwigger Academy, extracts exploit patterns, and generates adaptive payloads instead of firing the same static list at every target
Everything gets persisted to Postgres — findings, scan history, exploit patterns — so the system actually gets smarter the more you throw at it.
The stack
ZAP — the scanning engine (spidering, active/passive scans)
Node.js + TypeScript — backend automation
MCP — the AI-agent interaction layer
PostgreSQL — learning data, scan results, exploit patterns
Docker — containerized, works fully offline/air-gapped
What it can do out of the box
Recon (Subfinder, Amass, HTTPx, DNS enumeration), automated XSS/SQLi/IDOR/CSRF testing, JS analysis (deobfuscation, endpoint extraction, secret detection), Caido and ZAP proxy integration, a live dashboard, and an AI reasoning layer that explains why something is a finding instead of just dumping a severity score.
The part I'm most proud of
This wasn't a weekend hack. It's the product of months of manual testing, reading writeups, and rebuilding the same scanning pipeline until the learning loop actually held up. When the OWASP ZAP team reached out to feature it as a guest post, that was the first real external validation that the approach — clinical-grade patience applied to security research — actually works.
Try it / build on it
It's MIT licensed and built to be extended — new training data sources, new MCP tools, new integrations (Burp, nuclei, whatever you need) all slot in cleanly.
⭐ github.com/telmon95/VulneraMCP
If you're working on AI-augmented security tooling or just getting into bug bounty hunting, I'd love to hear what you're building — drop a comment or hit me up @DEOXYRIBOSE404.