Zscaler Discover

Zscaler Tenant Discovery

Scan the entire Zscaler tenant and generate a structured inventory in project memory.

Prerequisites

1. Verify .mcp.json exists at project root
2. Run zscaler_check_connectivity — abort if it fails
3. Run zscaler_get_available_services — note which services are available

Scan Plan

Use subagents to scan ZIA, ZPA, and ZTB in parallel. ZIdentity/ZCC/ZDX run in a third subagent.

ZIA (MCP tools)

| Resource | Tool | |----------|------| | Locations | zia_list_locations | | Cloud firewall rules | zia_list_cloud_firewall_rules (no search param) | | URL filtering rules | zia_list_url_filtering_rules | | URL categories (custom) | zia_list_url_categories | | SSL inspection rules | zia_list_ssl_inspection_rules | | DLP rules | zia_list_web_dlp_rules_lite | | IP source groups | zia_list_ip_source_groups | | IP destination groups | zia_list_ip_destination_groups | | GRE tunnels | zia_list_gre_tunnels | | Static IPs | zia_list_static_ips | | VPN credentials | zia_list_vpn_credentials |

ZPA (MCP tools)

| Resource | Tool | |----------|------| | App segments | zpa_list_application_segments | | Segment groups | zpa_list_segment_groups | | Server groups | zpa_list_server_groups | | Access policy rules | zpa_list_access_policy_rules | | App connector groups | zpa_list_app_connector_groups | | Service edge groups | zpa_list_service_edge_groups | | PRA portals | zpa_list_pra_portals | | PRA credentials | zpa_list_pra_credentials | | BA certificates | zpa_list_ba_certificates | | SCIM groups | get_zpa_scim_group |

ZIdentity / ZCC / ZDX (MCP tools)

| Resource | Tool | |----------|------| | Users | zidentity_list_users | | Groups | zidentity_list_groups | | Devices (ZCC) | zcc_list_devices | | Applications (ZDX) | zdx_list_applications | | Alerts (ZDX) | zdx_list_alerts |

ZTB (AirGap API — OPTIONAL)

Skip if ZSCALER_AIRGAP_SITE is not set in .env.

Use Python urllib to call the AirGap API. Read .env for credentials and site name.

import urllib.request, urllib.parse, json, ssl, os

env = {}
with open(".env") as f:
    for line in f:
        line = line.strip()
        if "=" in line and not line.startswith("#"):
            k, v = line.split("=", 1)
            env[k] = v

site = env.get("ZSCALER_AIRGAP_SITE")
if not site:
    print("SKIP: No ZSCALER_AIRGAP_SITE in .env")
    exit(0)

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

# OAuth2 token
vanity = env.get("ZSCALER_VANITY_DOMAIN", env.get("ZSCALER_CLIENT_ID", "").split("@")[0])
token_data = urllib.parse.urlencode({
    "client_id": env["ZSCALER_CLIENT_ID"],
    "client_secret": env["ZSCALER_CLIENT_SECRET"],
    "grant_type": "client_credentials"
}).encode()
req = urllib.request.Request(f"https://{vanity}.zslogin.net/oauth2/v1/token", data=token_data)
req.add_header("Content-Type", "application/x-www-form-urlencoded")
token = json.loads(urllib.request.urlopen(req, context=ctx).read())["access_token"]

BASE = f"https://{site}-api.goairgap.com"
def api_get(path):
    r = urllib.request.Request(f"{BASE}{path}")
    r.add_header("Authorization", f"Bearer {token}")
    return json.loads(urllib.request.urlopen(r, context=ctx).read())

# Collect ZTB data
sites = api_get("/api/v2/Site/")
gateways = api_get("/api/v3/Gateway/")
networks = api_get("/api/v2/Network/")
ipsec = api_get("/api/v2/cluster/ipsec-status")

# PBR and VRRP require IDs from gateways/clusters
# Iterate gateways for PBR policies
# Iterate clusters for VRRP status

Collect: sites, gateways, networks/VLANs, PBR policies (per gateway), IPsec status, VRRP status (per cluster).

Output

Memory File

Write to memory/zscaler-tenant.md in the project's auto-memory directory (.claude/projects//memory/).

---
name: zscaler-tenant-inventory
description: Auto-discovered Zscaler tenant inventory — locations, segments, rules, gateways, users. Generated by /zscaler-discover.
type: reference
---

# Zscaler Tenant Inventory

Generated: 
Vanity: 
Customer ID: 

## ZIA

### Locations
| Name | ID | Profile | IP/GRE | State |
...

### Cloud Firewall Rules
| Order | Name | ID | Action | State | Protocols |
...

(repeat for each ZIA resource)

## ZPA

### App Segments
| Name | ID | Domain(s) | Segment Group | Enabled |
...

(repeat for each ZPA resource)

## ZIdentity
### Users
| Name | Email | Status |
...

### Groups
| Name | ID | Member Count |
...

## ZTB (if scanned)
### Sites / Gateways / Networks / PBR / IPsec / VRRP
...

## ZCC / ZDX
...

For each table: include name, ID, key attributes, and state/enabled. Keep rows concise.

Update MEMORY.md

Add a pointer line if not already present:

## Zscaler Tenant Inventory
- See `memory/zscaler-tenant.md` for full auto-discovered inventory (generated by /zscaler-discover)

Print Summary

After writing the file, print:

• Count per resource type (e.g., "ZIA: 3 locations, 12 firewall rules, ...")
• Anomalies: disabled rules, empty segment groups, orphaned segments, services with zero resources
• Total scan time

Error Handling

• If a service is unavailable (from get_available_services), skip it and note in output
• If an MCP tool call fails, log the error and continue with remaining resources
• If ZTB API fails, skip ZTB section and note the error

Related API Reference

For detailed endpoint documentation used by discovery:

• ZIA resources (locations, rules, policies) → See @zscaler-zia skill
• ZPA resources (segments, groups, connectors) → See @zscaler-zpa skill
• ZTB resources (sites, gateways, networks) → See @zscaler-ztb skill
• ZCC devices → See @zscaler-zcc skill
• ZDX applications and devices → See @zscaler-zdx skill
• ZIdentity users and groups → See @zscaler-zid skill

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: secsilab
• Source: secsilab/zscaler-claude-skills
• License: MIT

Install and usage instructions live in the source repository linked above.