Zscaler MCP Server

Partner, reviewed

Plugin · by zscaler · runs in Claude Code, Cowork · 42 skills, 1 MCP server, 20 commands · listed 2026-03-31

Claude Code

claude plugin install zscaler-mcp-server

Source

Skills (42)

Skill cross-product-troubleshoot-user-connectivity

Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC. Investigates end-to-end: (1) ZCC client status and enrollment, (2) ZDX digital experience scores and…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill cross-product-troubleshoot-user-connectivity
```
Skill easm-review-attack-surface

Review the organization's external attack surface using Zscaler EASM. Lists organizations, retrieves findings (exposed services, vulnerabilities, misconfigurations), checks for lookalike domains…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill easm-review-attack-surface
```
Skill zcc-generate-logout-otp

Generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user. Walks the admin from a user identifier (email or device name) through device lookup → confirmation → OTP…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zcc-generate-logout-otp
```
Skill zdx-analyze-application-health

Analyze the health of one or more monitored applications across the organization using ZDX scores, metrics, and affected-user breakdowns.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-analyze-application-health
```
Skill zdx-audit-software-inventory

Audit the software inventory across devices in the organization using ZDX data. Lists installed software, filters by location, department, or user, and drills into specific software version details.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-audit-software-inventory
```
Skill zdx-compare-location-experience

Compare digital experience across locations, departments, and geolocations using ZDX data. Identifies which offices or regions have the best and worst experience for specific applications, detects…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-compare-location-experience
```
Skill zdx-diagnose-deeptrace

Run a ZDX deep trace diagnostics session to investigate network and device issues. Start new sessions, analyze web probe metrics, cloud path topology, device health, top processes, and event…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-diagnose-deeptrace
```
Skill zdx-investigate-alerts

Investigate active and historical ZDX alerts to understand their scope, root cause, and impact. Drills into affected devices, correlates with application metrics, and identifies patterns across time.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-investigate-alerts
```
Skill zdx-investigate-multi-app-outage

Diagnose a multi-application outage scoped to one location by correlating ZDX alerts, affected devices, and shared cloud-path hops.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-investigate-multi-app-outage
```
Skill zdx-troubleshoot-user-experience

Troubleshoot a user's digital experience using ZDX data. Investigates device health, application scores, network path metrics, and active alerts to identify performance bottlenecks.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zdx-troubleshoot-user-experience
```
Skill zia-audit-ssl-inspection-bypass

Audit ZIA SSL inspection rules to identify which applications, URL categories, users, or groups are subject to INSPECT, DO_NOT_INSPECT, or DO_NOT_DECRYPT actions.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-audit-ssl-inspection-bypass
```
Skill zia-check-user-url-access

Determine whether a specific user or group is allowed to access a given URL by evaluating all applicable ZIA policies in order.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-check-user-url-access
```
Skill zia-create-cloud-app-control-rule

Create ZIA Cloud App Control rules that enforce granular, action-level decisions on cloud applications (Dropbox, OneDrive, Google Drive, ChatGPT, GitHub, YouTube, Slack, etc.).

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-create-cloud-app-control-rule
```
Skill zia-create-firewall-filtering-rule

Create a ZIA Cloud Firewall Filtering rule that controls network traffic by source/destination IP, country, network application, network service, device trust level, user/group/department, location…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-create-firewall-filtering-rule
```
Skill zia-create-ssl-inspection-rule

Create a ZIA SSL Inspection rule that controls how Zscaler handles SSL/TLS encrypted traffic — BLOCK (drop the SSL connection), DECRYPT (decrypt and inspect), or DO_NOT_DECRYPT (pass through without…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-create-ssl-inspection-rule
```
Skill zia-create-url-filtering-rule

Create a ZIA URL Filtering rule that controls user access to web content by URL category, protocol, request method, user agent, user/group/department, location, device trust level, and optional…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-create-url-filtering-rule
```
Skill zia-investigate-sandbox

Investigate ZIA Sandbox file analysis results, quarantine issues, and security policy enforcement. Uses sandbox report, quota, behavioral analysis, and file hash tools combined with SSL inspection…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-investigate-sandbox
```
Skill zia-investigate-url-category

Investigate where a specific URL or URL category is referenced across all ZIA policy rules. Searches URL filtering rules, DLP web rules, SSL inspection rules, and cloud firewall rules to provide a…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-investigate-url-category
```
Skill zia-look-up-cloud-app-name

Look up the canonical ZIA cloud-application name (e.g. ONEDRIVE, GOOGLE_DRIVE, SHAREPOINT_ONLINE, DROPBOX) given whatever the admin typed — friendly names like 'OneDrive', 'Google Drive', 'share…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-look-up-cloud-app-name
```
Skill zia-look-up-rule-targets

Look up the shared 'who/where/when/what-device' fields that every ZIA rule resource scopes by — users, groups, departments, locations, location_groups, url_categories, devices, device_groups…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-look-up-rule-targets
```
Skill zia-manage-time-interval

Find an existing ZIA Time Interval by name, or create a new one when no match exists, then return the interval ID so the caller can attach it to a policy rule via its `time_windows` field.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-manage-time-interval
```
Skill zia-onboard-location

End-to-end onboarding of a new ZIA location with its traffic forwarding dependencies. Walks through the full dependency chain: (1) Create a static IP for the site's egress point, (2) Create VPN…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zia-onboard-location
```
Skill zins-analyze-web-traffic

Analyze web traffic patterns using Zscaler Analytics (Z-Insights). Examines traffic distribution by location, protocol breakdown (HTTP vs HTTPS), threat categories, DLP violations, and volume trends…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zins-analyze-web-traffic
```
Skill zins-assess-network-security

Assess network security posture using Zscaler Analytics (Z-Insights). Analyzes Zero Trust Firewall effectiveness by action distribution (allow/block ratios), location-based firewall activity…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zins-assess-network-security
```
Skill zins-audit-shadow-it

Audit shadow IT and SaaS application usage using Zscaler Analytics (Z-Insights). Discovers unsanctioned applications, assesses risk scores, monitors CASB-protected SaaS usage, tracks data transfers…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zins-audit-shadow-it
```
Skill zins-investigate-security-incident

Investigate security incidents using Zscaler Z-Insights analytics. Correlates threat categories, cyber incident trends, firewall actions, web traffic patterns, and shadow IT data to build a…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zins-investigate-security-incident
```
Skill zms-analyze-policy-rules

Analyze Zscaler Microsegmentation (ZMS) policy rules for optimization opportunities. Reviews custom and default policy rules, identifies stale or unused rules, detects overly permissive rules, maps…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zms-analyze-policy-rules
```
Skill zms-assess-workload-protection

Assess Zscaler Microsegmentation (ZMS) workload protection coverage and identify protection gaps. Investigates resource protection status, resource group membership, unprotected workloads by cloud…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zms-assess-workload-protection
```
Skill zms-audit-microsegmentation-posture

Audit the overall Zscaler Microsegmentation (ZMS) deployment posture. Reviews agent fleet health, workload protection coverage, resource group structure, policy rules, app zones, application…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zms-audit-microsegmentation-posture
```
Skill zms-review-tag-classification

Review Zscaler Microsegmentation (ZMS) tag classification, application discovery, and tag-to-resource-group mapping. Investigates tag namespaces (CUSTOM, EXTERNAL, ML), tag keys and values…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zms-review-tag-classification
```
Skill zms-troubleshoot-agent-deployment

Troubleshoot Zscaler Microsegmentation (ZMS) agent deployment and connectivity issues. Investigates agent fleet health, connection status, version compliance, agent group configuration, provisioning…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zms-troubleshoot-agent-deployment
```
Skill zpa-application_segment-ba-onboard

End-to-end onboarding of a new Browser Access (BA) application in Zscaler Private Access. Walks through the full dependency chain — App connector group, server group, segment group, BA TLS…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-application_segment-ba-onboard
```
Skill zpa-application_segment-onboard

End-to-end onboarding of a new application in Zscaler Private Access. Walks through the complete dependency chain: (1) App connector group, (2) Server group, (3) Segment group, (4) Application…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-application_segment-onboard
```
Skill zpa-application_segment-pra-onboard

End-to-end onboarding of a new Privileged Remote Access (PRA) application in Zscaler Private Access. Walks through the full dependency chain — App connector group, server group, segment group, PRA…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-application_segment-pra-onboard
```
Skill zpa-audit-baseline-compliance

Read-only audit of a ZPA tenant against the Zscaler ZPA Baseline Recommendations v1.0 document. Inventories app connector groups, server groups, application segments, access policy rules, forwarding…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-audit-baseline-compliance
```
Skill zpa-create-access-policy-rule

Create ZPA access policy rules with v2 conditions. Supports all condition object types: APP, APP_GROUP, SAML, SCIM, SCIM_GROUP, PLATFORM, COUNTRY_CODE, POSTURE, TRUSTED_NETWORK, RISK_FACTOR_TYPE…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-access-policy-rule
```
Skill zpa-create-conditional-access-rule

Create a ZPA Access Policy rule that gates access to a private application on multiple combined checks: identity (SCIM group / SAML), one or more named device posture profiles (associated by UDID…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-conditional-access-rule
```
Skill zpa-create-forwarding-policy-rule

Create ZPA client forwarding policy rules that control how traffic is routed from the Zscaler Client Connector. Supports actions: BYPASS (direct internet), INTERCEPT (route through ZPA)…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-forwarding-policy-rule
```
Skill zpa-create-server-group

Create a ZPA server group with all required dependencies. Server groups require app connector groups to exist first. This skill walks through the dependency chain: (1) Check for existing app…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-server-group
```
Skill zpa-create-session-duration-rule

Create a ZPA Timeout Policy rule that enforces session duration — i.e. forces re-authentication after N minutes/hours/days, optionally with an idle-timeout.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-session-duration-rule
```
Skill zpa-create-timeout-policy-rule

Create ZPA timeout policy rules that control session re-authentication and idle timeout behavior. Configures how long a user session remains active (reauth_timeout) and how long an idle session…

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-timeout-policy-rule
```
Skill zpa-troubleshoot-app-connector

Troubleshoot ZPA App Connector issues including enrollment failures, upgrade problems, Public Service Edge connectivity, and high CPU/memory/disk utilization.

Any agent
```
npx skills add zscaler/zscaler-mcp-server --skill zpa-troubleshoot-app-connector
```

Commands (20)

Command app-health

Analyze application health across the organization using ZDX scores and metrics.
Command audit-software

Audit software inventory across devices using ZDX data for compliance and vulnerability assessment.
Command audit-ssl

Audit ZIA SSL inspection rules -- list rules by action (INSPECT, DO_NOT_INSPECT, DO_NOT_DECRYPT, BLOCK), identify bypasses, and assess risk.
Command check-access

Check whether a user or group can access a specific URL via ZIA policies.
Command compare-locations

Compare digital experience across locations, departments, or geolocations using ZDX.
Command create-access-rule

Create a ZPA access policy rule with v2 conditions for application access control.
Command create-forwarding-rule

Create a ZPA client forwarding policy rule to bypass or intercept traffic.
Command create-server-group

Create a ZPA server group with required app connector group dependency.
Command create-timeout-rule

Create a ZPA timeout policy rule for session re-authentication and idle timeout.
Command diagnose-deeptrace

Run a ZDX deep trace diagnostics session — start, analyze, or clean up deep traces for a user's device.
Command investigate-alerts

Investigate active and historical ZDX alerts to understand scope, root cause, and impact.
Command investigate-incident

Investigate security incidents using Z-Insights analytics -- threats, firewall actions, shadow IT, and web traffic.
Command investigate-sandbox

Investigate ZIA Sandbox file analysis -- check sandbox reports, quota, SSL prerequisite, and diagnose file block/quarantine issues.
Command investigate-url

Investigate where a URL or URL category is referenced across ZIA policy rules.
Command onboard-app

End-to-end onboarding of a new application in ZPA with full dependency chain.
Command onboard-location

End-to-end onboarding of a new ZIA location with traffic forwarding dependencies.
Command review-attack-surface

Review external attack surface using Zscaler EASM findings, exposed services, and lookalike domains.
Command troubleshoot-connector

Troubleshoot ZPA App Connector issues -- enrollment, connectivity, upgrades, and resource utilization.
Command troubleshoot-experience

Troubleshoot a user's digital experience using ZDX scores, metrics, and network path data.
Command troubleshoot-user

Cross-product troubleshooting of user connectivity across ZCC, ZDX, ZPA, and ZIA.

From Anthropic's public plugin directory, read on 2026-10-15. Find a skill by task.