Months ago I was a full-stack dev with zero security research experience. Last month, the OWASP ZAP team published a guest post about a tool I built. Here's the story, and the tech behind it.
The problem
Every serious security platform locks its best automation, correlation, and workflow features behind an enterprise price tag. I wanted something fully programmatic, fully open, and fully mine to extend. So I picked ZAP — open source, scriptable REST API, no licensing walls — and started layering AI on top of it.
The result is VulneraMCP, an MCP server that turns ZAP from "a scanner you drive" into "a scanner an AI agent drives, with a memory."
What it actually does
