OWASP ZAP

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

OWASP ZAP is ranked #4 of 30 in penetration Testing Software on Inferse. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Compared on penetration Testing Software

Free plan: Yeszaproxy.org
Authenticated scanning: Yeszaproxy.org
API testing: Yeszaproxy.org
Browser-based scanning: Yeszaproxy.org
CI/CD integration: Yeszaproxy.org
Deployment model: self_hostedzaproxy.org

Facts

Purpose: ZAP is a web application scanner and proxy for security testing.zaproxy.org · 29 Sept 2026
Open source: ZAP describes itself as free and open source, and says anyone can contribute to the project.zaproxy.org · 29 Sept 2026
Scanner: ZAP provides active scanning, passive scanning, a spider, alerts, and scan policies.zaproxy.org · 29 Sept 2026
Add-ons: Add-ons can be installed dynamically from the online Marketplace, and are typically added or removed without restarting ZAP.zaproxy.org · 29 Sept 2026
Automation: The Automation Framework controls ZAP with a YAML plan and supports jobs including active scanning, passive scanning, spidering, API imports, and report generation.zaproxy.org · 29 Sept 2026
CI integration: ZAP provides GitHub Actions for baseline, full, and API scans through its Docker packaged scans.zaproxy.org · 29 Sept 2026
API formats: The Automation Framework supports importing OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons.zaproxy.org · 29 Sept 2026
Deployment: ZAP publishes Docker images, including a bare image described as minimal and ideal for CI.zaproxy.org · 29 Sept 2026
Audience: ZAP says it is designed for developers, testers new to security testing, and security testing specialists.zaproxy.org · 29 Sept 2026
Runtime requirement: The Windows and Linux installers require Java 17 or higher, while the macOS installer includes Java 17.zaproxy.org · 29 Sept 2026
Release support: The download page says the ZAP team can support only the latest full release.zaproxy.org · 29 Sept 2026
Download security: The download page warns that current ZAP releases are unsigned and provides checksums for downloads.zaproxy.org · 29 Sept 2026
Project status: ZAP says it has not been an OWASP project since August 2023 and identifies its current name as ZAP or ZAP by Checkmarx.zaproxy.org · 29 Sept 2026
Third-party integrations: ZAP lists DefectDojo, Dradis, and Faraday among products and services that can import ZAP results.zaproxy.org · 29 Sept 2026