{
  "id": "tool:owasp-zap",
  "_kind": "Tool",
  "_file": "domain/tools/tools-security-observability.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "OWASP ZAP",
    "homepageUrl": "https://www.zaproxy.org",
    "kind": "security",
    "description": "Open-source dynamic application security testing (DAST) tool maintained by OWASP for finding\nvulnerabilities in web applications. Provides automated scanning, active and passive attack modes,\nand a REST API for CI/CD pipeline integration.\n"
  },
  "outgoingEdges": [
    {
      "from": "tool:owasp-zap",
      "to": "language:java",
      "kind": "belongs_to_language"
    },
    {
      "from": "tool:owasp-zap",
      "to": "skill-area:dast-scanning",
      "kind": "tool_used_by",
      "attributes": {}
    },
    {
      "from": "tool:owasp-zap",
      "to": "skill-area:web-security-testing",
      "kind": "tool_used_by",
      "attributes": {}
    },
    {
      "from": "tool:owasp-zap",
      "to": "tool:snyk",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Security scanning — OWASP ZAP is DAST for web apps; Snyk is SCA and code scanning"
      }
    },
    {
      "from": "tool:owasp-zap",
      "to": "tool:sonarqube",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Security testing — OWASP ZAP is DAST (runtime); SonarQube is SAST (static)"
      }
    }
  ],
  "incomingEdges": [
    {
      "from": "specialization:security-compliance",
      "to": "tool:owasp-zap",
      "kind": "uses_tool"
    },
    {
      "from": "specialization:security-research",
      "to": "tool:owasp-zap",
      "kind": "uses_tool"
    },
    {
      "from": "tool:snyk",
      "to": "tool:owasp-zap",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Security scanning — Snyk is SCA and code scanning; OWASP ZAP is DAST for web apps"
      }
    },
    {
      "from": "tool:sonarqube",
      "to": "tool:owasp-zap",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Security testing — SonarQube is SAST (static); OWASP ZAP is DAST (runtime)"
      }
    },
    {
      "from": "tool-server:mcp-owasp-zap",
      "to": "tool:owasp-zap",
      "kind": "integrates_with",
      "attributes": {}
    }
  ]
}