# Zscaler

> Use when managing ANY Zscaler component and you need to determine which product API to use, or when working across multiple products. Routes to the appropriate product skill.

- **Type:** Skill
- **Install:** `agentstack add skill-secsilab-zscaler-claude-skills-zscaler`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [secsilab](https://agentstack.voostack.com/s/secsilab)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [secsilab](https://github.com/secsilab)
- **Source:** https://github.com/secsilab/zscaler-claude-skills/tree/main/skills/zscaler

## Install

```sh
agentstack add skill-secsilab-zscaler-claude-skills-zscaler
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Zscaler Platform — Orchestrator

This skill routes requests to the correct product skill. It does NOT contain detailed MCP tool lists or API endpoint tables — those live in each product skill.

## Product Map

| Product | Skill | Endpoints | MCP Tools | Use For |
|---------|-------|-----------|-----------|---------|
| ZIA | @zscaler-zia | 428 | 77 | Firewall, URL filtering, DLP, SSL, locations, sandbox, ATP |
| ZPA | @zscaler-zpa | 328 | 70 | App segments, access policies, PRA, BA, connectors |
| ZTB | @zscaler-ztb | 674 | 0 (AirGap API) | Branch sites, gateways, PBR, IPsec, VRRP, IPAM, SNMP |
| ZCBC | @zscaler-zcbc | 97 | 0 | Cloud/Branch Connector via OneAPI (also known as ZTC/ZTW) |
| ZCC | @zscaler-zcc | 33 | 4 | Client Connector devices, forwarding |
| ZDX | @zscaler-zdx | 42 | 17 | Digital experience monitoring, alerts |
| ZID | @zscaler-zid | 31 | 10 | Users, groups, API clients |
| EASM | @zscaler-easm | 7 | 7 | External attack surface, findings |
| ZWA | @zscaler-zwa | 19 | 0 | DLP incident lifecycle |
| AI Guard | @zscaler-aiguard | 2 | 0 | Content detection, policy execution, AI Gateway |
| ZInsights | @zscaler-zinsights | 16 | 16 | Analytics, shadow IT, threat intel |
| ZMS | @zscaler-zms | — | zms_* | Microsegmentation — agents, resources, policy rules, app zones |
| ZBI | @zscaler-zbi | — | 0 | Business Insights — custom apps, report configs, reports |
| Terraformer | @zscaler-terraformer | — | CLI | Brownfield Terraform import for ZIA/ZPA/ZTC |

## Operational Skills

| Skill | Use For |
|-------|---------|
| @zscaler-setup | Initial MCP server setup and credential wizard |
| @zscaler-onboard | Full tenant onboarding (setup > discover > audit > snapshot) |
| @zscaler-discover | Tenant inventory and auto-discovery |
| @zscaler-audit | Security posture audit (22 checks) |
| @zscaler-snapshot | Config backup, compare, and restore |
| @zscaler-deploy | Deployment templates (web app, SSH/RDP, location, site, DLP, extranet) |
| @zscaler-troubleshoot | Interactive diagnostic flows (6 scenarios) |
| @zscaler-migrate | Competitive migration (assessment, 6 vendor playbooks, API execution) |
| @zscaler-bridge | Translate design documents into executable API call sequences |

## Resolution Strategy

**Always follow this priority order:**

```
1. MCP tool (mcp__zscaler__*)         → preferred, fastest
2. OneAPI v2 (api.zsapi.net)          → when MCP has no tool for it
3. AirGap API (*.goairgap.com)        → ZTB management (no MCP tools exist)
4. Legacy API (zsapi..net)     → specific fields only exposed here
5. Python SDK (zscaler package)       → ZIdentity write ops (MCP is read-only)
```

**Routing logic:**
- If the task targets a single product, invoke that product skill directly.
- If the task spans multiple products (e.g., create ZIA location + ZPA segment + ZTB site), orchestrate by calling each product skill in sequence.
- If unsure which product owns a feature, check the Product Map above.

## OneAPI Authentication

All Zscaler APIs (except AirGap) share the same OAuth2 token.

| Method | Endpoint | Usage |
|--------|----------|-------|
| MCP | Auto (configured in `.mcp.json`) | All MCP tool calls |
| OneAPI OAuth2 | `https://.zslogin.net/oauth2/v1/token` | `client_credentials` grant |
| AirGap (ZTB) | `https://-api.goairgap.com` | Same OAuth2 token |
| Legacy | `https://zsapi..net/api/v1` | Only for fields missing from OneAPI |

**Cloud domains:** `zscaler.net`, `zscalerone.net`, `zscalertwo.net`, `zscalerthree.net`, `zscloud.net`, `zscalerbeta.net`, `zscalergov.net`

### Python API Call Pattern (when MCP has no tool)

```python
import urllib.request, urllib.parse, json, ssl

# Load credentials from .env
env = {}
with open(".env") as f:
    for line in f:
        line = line.strip()
        if "=" in line and not line.startswith("#"):
            k, v = line.split("=", 1)
            env[k] = v

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

# Get OAuth2 token
token_data = urllib.parse.urlencode({
    "client_id": env["ZSCALER_CLIENT_ID"],
    "client_secret": env["ZSCALER_CLIENT_SECRET"],
    "grant_type": "client_credentials"
}).encode()
req = urllib.request.Request("https://.zslogin.net/oauth2/v1/token", data=token_data)
req.add_header("Content-Type", "application/x-www-form-urlencoded")
token = json.loads(urllib.request.urlopen(req, context=ctx).read())["access_token"]

# OneAPI call
req = urllib.request.Request("https://api.zsapi.net/zia/api/v1/")
req.add_header("Authorization", f"Bearer {token}")
result = json.loads(urllib.request.urlopen(req, context=ctx).read())

# Legacy API call (same token)
req = urllib.request.Request("https://zsapi..net/api/v1/")
req.add_header("Authorization", f"Bearer {token}")
result = json.loads(urllib.request.urlopen(req, context=ctx).read())

# AirGap API call (same token)
req = urllib.request.Request("https://-api.goairgap.com/api/v2/")
req.add_header("Authorization", f"Bearer {token}")
result = json.loads(urllib.request.urlopen(req, context=ctx).read())
```

### ZIA Activation Reminder

**Every ZIA write operation requires activation to take effect.**
After any ZIA create/update/delete, call `zia_activate_configuration` (MCP) or `POST /status/activate` (API).
ZPA changes are instant — no activation needed.

## Common Mistakes

1. **Forgetting ZIA activation** — write ops are staged until `zia_activate_configuration`
2. **Using search param on firewall rules** — `zia_list_cloud_firewall_rules(search=...)` returns 400. List all and filter client-side.
3. **ZIA DNS Control not in MCP** — must use OneAPI directly for DNS policy rules
4. **DLP `receiver` field** — only exposed by legacy API, not OneAPI
5. **ZPA rule reordering** — MCP creates rules at bottom, must reorder via direct API
6. **ZPA domain overlap** — update existing segments, don't create new overlapping ones
7. **ZIdentity write** — MCP is read-only, use Python SDK for group/user management
8. **Location profile mismatch** — SERVER profiles don't log DNS; use CORPORATE for full inspection
9. **ZTB dns_servers silent failure** — PUT returns 200 but doesn't change the value; field is effectively read-only via API
10. **ZTB transparent DNS proxy** — intercepts ALL port 53 at L7 before PBR; to bypass, move traffic outside ZTB VLANs or use DoH
11. **ZTB PBR requires gateway_id** — all PBR endpoints need `?gateway_id=` query param
12. **ZTB API versioning** — some endpoints moved from v2 to v3; if you get 404, try the other version

## General Utilities

| Tool | Description |
|------|-------------|
| `zscaler_check_connectivity` | Test API connectivity to all services |
| `zscaler_get_available_services` | List accessible services for current credentials |

## Naming Aliases

Zscaler product names differ across SDKs, Terraform providers, and documentation. Use this table to resolve cross-tool references:

| This Skill | SDK (Python/Go) | Terraform Provider | Notes |
|------------|-----------------|-------------------|-------|
| `zscaler-zcbc` | `ztw` | `terraform-provider-ztc` | ZCBC rebranded to ZTC (Zero Trust Cloud); ztw in SDKs |
| `zscaler-aiguard` | `zguard` | n/a | AIGuard module in Python SDK is `zguard` |
| `zscaler-zinsights` | `zins` | n/a | ZInsights module in SDKs is `zins` |
| `zscaler-zid` | `zidentity` | `terraform-provider-zpa` (partial) | ZIdentity uses its own portal and SDK module |
| `zscaler-zms` | `zms` | n/a | Microsegmentation SDK module |

**Search tip:** When looking up SDK source or documentation, use the SDK alias, not the skill name. For example, ZCBC SDK code lives under `zscaler/ztw/`, not `zscaler/zcbc/`.

## Context7 Documentation Lookup

**Before calling any MCP tool you haven't used before**, fetch the exact parameters and examples:

1. Resolve library: `resolve-library-id` with query "zscaler" — pick the matching library
2. Query docs: `query-docs` with the library ID and your question

| Library | Context7 ID | Use for |
|---------|-------------|---------|
| MCP Server | `/zscaler/zscaler-mcp-server` | MCP tool parameters, required fields, examples |
| Python SDK | `/zscaler/zscaler-sdk-python` | Direct API calls, SDK methods, field formats |

**Example:** before calling `zpa_create_application_segment`, query:
> "How to create a ZPA application segment with all required parameters"

This avoids trial-and-error on parameter names, port range formats, required vs optional fields, etc.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [secsilab](https://github.com/secsilab)
- **Source:** [secsilab/zscaler-claude-skills](https://github.com/secsilab/zscaler-claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-secsilab-zscaler-claude-skills-zscaler
- Seller: https://agentstack.voostack.com/s/secsilab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.