Zscaler MCP Server is a Model Context Protocol (MCP) server for managing Zscaler products with LLMs (your AI, your AI, Gemini, etc.).
It exposes hundreds of tools across the Zscaler services. Read-only operations are available by default; create / update / delete tools require explicit allowlisting via the 'Enable Write Tools' and 'Write Tools Allowlist' settings below, and destructive operations additionally require an in-session HMAC confirmation token.
Tools Reads data38 get_ get_ get_ get_ get_ get_ get_ get_ get_ get_ get_ get_ get_ get_ zcc_ zcc_ zcc_ zcc_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_ zcell_
Deletes or can't be undone2 zdx_ zdx_
Skills 42 in the Claude listing
Cross product troubleshoot user connectivity Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC. Easm review attack surface Review the organization's external attack surface using Zscaler EASM. Zcc generate logout otp Generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user. Zdx analyze application health Analyze the health of one or more monitored applications across the organization using ZDX scores, metrics, and affected-user breakdowns. Zdx audit software inventory Audit the software inventory across devices in the organization using ZDX data. Zdx compare location experience Compare digital experience across locations, departments, and geolocations using ZDX data. Zdx diagnose deeptrace Run a ZDX deep trace diagnostics session to investigate network and device issues. Zdx investigate alerts Investigate active and historical ZDX alerts to understand their scope, root cause, and impact. Zdx investigate multi app outage Diagnose a multi-application outage scoped to one location by correlating ZDX alerts, affected devices, and shared cloud-path hops. Zdx troubleshoot user experience Troubleshoot a user's digital experience using ZDX data. Zia audit ssl inspection bypass Audit ZIA SSL inspection rules to identify which applications, URL categories, users, or groups are subject to INSPECT, DO_NOT_INSPECT, or DO_NOT_DECRYPT actions. Zia check user url access Determine whether a specific user or group is allowed to access a given URL by evaluating all applicable ZIA policies in order. Zia create cloud app control rule Create ZIA Cloud App Control rules that enforce granular, action-level decisions on cloud applications (Dropbox, OneDrive, Google Drive, ChatGPT, GitHub, YouTube, Slack, etc.). Zia create firewall filtering rule Create a ZIA Cloud Firewall Filtering rule that controls network traffic by source/destination IP, country, network application, network service, device trust level, user/group/department, location, a Zia create ssl inspection rule Create a ZIA SSL Inspection rule that controls how Zscaler handles SSL/TLS encrypted traffic — BLOCK (drop the SSL connection), DECRYPT (decrypt and inspect), or DO_NOT_DECRYPT (pass through without d Zia create url filtering rule Create a ZIA URL Filtering rule that controls user access to web content by URL category, protocol, request method, user agent, user/group/department, location, device trust level, and optional time-o Zia investigate sandbox Investigate ZIA Sandbox file analysis results, quarantine issues, and security policy enforcement. Zia investigate url category Investigate where a specific URL or URL category is referenced across all ZIA policy rules. Zia look up cloud app name Look up the canonical ZIA cloud-application name (e.g. Zia look up rule targets Look up the shared 'who/where/when/what-device' fields that every ZIA rule resource scopes by — users, groups, departments, locations, location_groups, url_categories, devices, device_groups, workload Zia manage time interval Find an existing ZIA Time Interval by name, or create a new one when no match exists, then return the interval ID so the caller can attach it to a policy rule via its `time_windows` field. Zia onboard location End-to-end onboarding of a new ZIA location with its traffic forwarding dependencies. Zins analyze web traffic Analyze web traffic patterns using Zscaler Analytics (Z-Insights). Zins assess network security Assess network security posture using Zscaler Analytics (Z-Insights). Zins audit shadow it Audit shadow IT and SaaS application usage using Zscaler Analytics (Z-Insights). Zins investigate security incident Investigate security incidents using Zscaler Z-Insights analytics. Zms analyze policy rules Analyze Zscaler Microsegmentation (ZMS) policy rules for optimization opportunities. Zms assess workload protection Assess Zscaler Microsegmentation (ZMS) workload protection coverage and identify protection gaps. Zms audit microsegmentation posture Audit the overall Zscaler Microsegmentation (ZMS) deployment posture. Zms review tag classification Review Zscaler Microsegmentation (ZMS) tag classification, application discovery, and tag-to-resource-group mapping. Zms troubleshoot agent deployment Troubleshoot Zscaler Microsegmentation (ZMS) agent deployment and connectivity issues. Zpa application segment ba onboard End-to-end onboarding of a new Browser Access (BA) application in Zscaler Private Access. Zpa application segment onboard End-to-end onboarding of a new application in Zscaler Private Access. Zpa application segment pra onboard End-to-end onboarding of a new Privileged Remote Access (PRA) application in Zscaler Private Access. Zpa audit baseline compliance Read-only audit of a ZPA tenant against the Zscaler ZPA Baseline Recommendations v1.0 document. Zpa create access policy rule Create ZPA access policy rules with v2 conditions. Zpa create conditional access rule Create a ZPA Access Policy rule that gates access to a private application on multiple combined checks: identity (SCIM group / SAML), one or more named device posture profiles (associated by UDID; ZPA Zpa create forwarding policy rule Create ZPA client forwarding policy rules that control how traffic is routed from the Zscaler Client Connector. Zpa create server group Create a ZPA server group with all required dependencies. Zpa create session duration rule Create a ZPA Timeout Policy rule that enforces session duration — i.e. Zpa create timeout policy rule Create ZPA timeout policy rules that control session re-authentication and idle timeout behavior. Zpa troubleshoot app connector Troubleshoot ZPA App Connector issues including enrollment failures, upgrade problems, Public Service Edge connectivity, and high CPU/memory/disk utilization. 
Have I Been Pwned#426
WorkOS#447