Skip to main content

Zscaler Workload Segmentation MCP Server

Create a powerful Model Context Protocol (MCP) server for Zscaler Workload Segmentation in minutes with our AI Gateway. This guide walks you through setting up seamless workload microsegmentation integration with enterprise-grade security and instant OAuth authentication.

About Zscaler Workload Segmentation API​

Zscaler Workload Segmentation provides identity-based microsegmentation for workloads across data centers and clouds. It enables zero trust security by creating software-defined perimeters around applications, preventing lateral movement and reducing attack surface without network changes.

Key Capabilities​

  • Identity-Based Segmentation: Workload fingerprinting
  • Application Dependency Mapping: Auto-discovery
  • Policy Simulation: Risk-free policy testing
  • Zero Trust Architecture: Default deny policies
  • Multi-Environment: Cloud and on-premises
  • Agentless Option: Network-based protection
  • DevOps Integration: CI/CD pipeline support
  • Compliance: Regulatory requirement support

API Features​

  • Workload API: Identity management
  • Policy API: Segmentation rules
  • Discovery API: App dependency mapping
  • OAuth 2.0: Secure authentication
  • Simulation API: Policy testing
  • Analytics API: Traffic insights
  • Compliance API: Audit support
  • Integration API: DevOps tools

What You Can Do with Zscaler Workload Segmentation MCP Server​

The MCP server transforms Workload Segmentation API into a natural language interface, enabling AI agents to:

Workload Identity Management​

  • Workload Discovery

    • "Discover all workloads"
    • "Identify unprotected services"
    • "Find workload dependencies"
    • "Map application topology"

  • Identity Assignment

    • "Create workload identities"
    • "Tag by application tier"
    • "Group by business unit"
    • "Classify by data sensitivity"

  • Fingerprinting

    • "Generate workload fingerprints"
    • "Verify workload identity"
    • "Track identity changes"
    • "Monitor drift"

Application Dependency Mapping​

  • Auto-Discovery

    • "Map application communications"
    • "Discover service dependencies"
    • "Identify data flows"
    • "Track API calls"

  • Visualization

    • "Show application topology"
    • "Display traffic patterns"
    • "Highlight critical paths"
    • "Map east-west traffic"

  • Dependency Analysis

    • "Find single points of failure"
    • "Identify redundant paths"
    • "Assess impact radius"
    • "Calculate dependencies"

Microsegmentation Policies​

  • Policy Creation

    • "Create zero trust policies"
    • "Build allow lists"
    • "Define service boundaries"
    • "Set communication rules"

  • Policy Templates

    • "Apply PCI compliance template"
    • "Use three-tier app template"
    • "Deploy microservices policies"
    • "Implement DMZ rules"

  • Granular Controls

    • "Control by port/protocol"
    • "Restrict by process"
    • "Limit by user context"
    • "Filter by metadata"

Policy Simulation​

  • What-If Analysis

    • "Simulate policy changes"
    • "Preview blocked connections"
    • "Test before deployment"
    • "Validate rules"

  • Impact Assessment

    • "Show affected workloads"
    • "Calculate disruption risk"
    • "Identify dependencies"
    • "Measure blast radius"

  • Safe Deployment

    • "Stage policy rollout"
    • "Monitor mode first"
    • "Gradual enforcement"
    • "Rollback capability"

Traffic Analytics​

  • Flow Analysis

    • "Show traffic patterns"
    • "Monitor data volumes"
    • "Track connection counts"
    • "Analyze protocols"

  • Anomaly Detection

    • "Detect unusual traffic"
    • "Find policy violations"
    • "Identify new connections"
    • "Monitor behavioral changes"

  • Performance Metrics

    • "Measure latency impact"
    • "Track throughput"
    • "Monitor connection health"
    • "Assess overhead"

Threat Prevention​

  • Lateral Movement

    • "Block unauthorized connections"
    • "Prevent service hopping"
    • "Stop attack propagation"
    • "Contain breaches"

  • Zero Day Protection

    • "Default deny stance"
    • "Whitelist only approach"
    • "Process-level control"
    • "Behavior monitoring"

  • Breach Containment

    • "Isolate compromised workloads"
    • "Emergency lockdown"
    • "Quarantine mode"
    • "Forensic preservation"

Compliance Management​

  • Regulatory Compliance

    • "Enforce PCI segmentation"
    • "Meet HIPAA requirements"
    • "Satisfy SOX controls"
    • "GDPR data isolation"

  • Audit Support

    • "Generate compliance reports"
    • "Document segmentation"
    • "Prove policy enforcement"
    • "Track changes"

  • Continuous Compliance

    • "Monitor compliance drift"
    • "Alert on violations"
    • "Auto-remediate issues"
    • "Maintain evidence"

DevOps Integration​

  • CI/CD Pipeline

    • "Integrate with Jenkins"
    • "GitOps workflows"
    • "Infrastructure as Code"
    • "Policy as Code"

  • Container Security

    • "Segment Kubernetes pods"
    • "Protect microservices"
    • "Secure service mesh"
    • "Container runtime protection"

  • Automation

    • "Auto-apply policies"
    • "Dynamic segmentation"
    • "Scaling support"
    • "Self-healing rules"

Prerequisites​

  • Access to Cequence AI Gateway
  • Zscaler Workload Segmentation license
  • API credentials
  • Workload agents deployed (or agentless setup)

Step 1: Generate API Credentials​

1.1 Access Workload Segmentation Console​

  1. Log in to Zscaler Workload Segmentation
  2. Navigate to Settings > API Keys
  3. Click Generate New Key

1.2 Create API Key​

  1. Configure key:
    • Name: "AI Gateway Workload MCP"
    • Description: "Microsegmentation automation"
    • Permissions: Select required access

1.3 Set Permissions​

Select permissions:

  • Workloads: Read/Write
  • Policies: Read/Write
  • Analytics: Read
  • Simulation: Execute
  • Compliance: Read

1.4 Save Credentials​

  1. Click Generate
  2. Copy API Key
  3. Copy API Secret
  4. Note Organization ID

Step 2-4: Standard Setup​

Follow standard steps to access AI Gateway, find Zscaler Workload Segmentation API, and create MCP server.

Step 5: Configure API Endpoints​

  1. Base URL: https://api.workload.zscaler.com
  2. Select endpoints:
    • Workload endpoints
    • Policy endpoints
    • Analytics endpoints
    • Simulation endpoints
  3. Click Next

Step 6: MCP Server Configuration​

  1. Name: "Zscaler Workload Segmentation"
  2. Description: "Zero trust workload protection"
  3. Configure production mode
  4. Click Next

Step 7: Configure Authentication​

  1. Authentication Type: API Key
  2. Header Name: X-API-Key
  3. Secret Header: X-API-Secret
  4. Enter credentials
  5. Add Organization ID

Available Workload Segmentation API Scopes​

Workload Management​

  • Workload Operations

    • Workload discovery
    • Identity management
    • Fingerprinting
    • Metadata tagging

  • Application Mapping

    • Dependency discovery
    • Traffic analysis
    • Service mapping
    • Topology visualization

Policy Management​

  • Segmentation Policies

    • Policy creation
    • Rule management
    • Template library
    • Enforcement control

  • Policy Simulation

    • What-if analysis
    • Impact assessment
    • Testing mode
    • Validation reports

Analytics & Compliance​

  • Traffic Analytics

    • Flow monitoring
    • Anomaly detection
    • Performance metrics
    • Behavioral analysis

  • Compliance

    • Audit reports
    • Compliance checks
    • Evidence collection
    • Violation tracking

For Security Teams:

Workload Operations (Read)
Policy Management (Read/Write)
Policy Simulation (Execute)
Analytics (Read)
Compliance (Read)

For DevOps Teams:

Workload Operations (Read/Write)
Policy Management (Read/Write)
Policy Simulation (Execute)
Analytics (Read)
Integration (Read/Write)

Step 8-10: Complete Setup​

Configure security, choose deployment, and deploy.

Using Your Zscaler Workload Segmentation MCP Server​

With Claude Desktop​

{
  "servers": {
    "zscaler-workload": {
      "url": "your-mcp-server-url",
      "auth": {
        "type": "api_key",
        "api_key": "your-api-key",
        "api_secret": "your-api-secret",
        "org_id": "your-org-id"
      }
    }
  }
}

Natural Language Commands​

  • "Map dependencies for payment processing app"
  • "Create PCI compliance segmentation policy"
  • "Simulate blocking all database access"
  • "Show anomalous traffic in production"
  • "Isolate compromised web server immediately"

API Integration Example​

// Initialize MCP client
const mcpClient = new MCPClient({
  serverUrl: 'your-mcp-server-url',
  auth: {
    type: 'api_key',
    apiKey: 'your-api-key',
    apiSecret: 'your-api-secret',
    orgId: 'your-org-id'
  }
});

// Discover workloads
const workloadDiscovery = await mcpClient.zscaler.workload.discoverWorkloads({
  environments: ['production', 'staging'],
  platforms: ['aws', 'vmware', 'kubernetes'],
  autoClassify: true
});

console.log(`Discovered ${workloadDiscovery.total} workloads`);
console.log("\nWorkload Summary:");
for (const env of workloadDiscovery.environments) {
  console.log(`\n${env.name}:`);
  console.log(`  Total: ${env.workloadCount}`);
  console.log(`  Protected: ${env.protectedCount}`);
  console.log(`  Unprotected: ${env.unprotectedCount}`);
}

// Application dependency mapping
const appDependencies = await mcpClient.zscaler.workload.mapApplicationDependencies({
  applicationName: "E-Commerce Platform",
  depth: 3, // Levels of dependency to explore
  includeExternal: true,
  timeRange: 'last_7_days'
});

console.log(`\nApplication: ${appDependencies.name}`);
console.log(`Total Components: ${appDependencies.components.length}`);
console.log(`External Dependencies: ${appDependencies.externalServices.length}`);

// Visualize dependencies
const topology = appDependencies.generateTopology();
console.log("\nCritical Paths:");
for (const path of topology.criticalPaths) {
  console.log(`${path.source} -> ${path.destination}`);
  console.log(`  Protocol: ${path.protocol}`);
  console.log(`  Port: ${path.port}`);
  console.log(`  Volume: ${path.trafficVolume} MB/day`);
}

// Create microsegmentation policy
const segmentationPolicy = await mcpClient.zscaler.workload.createPolicy({
  name: "Three-Tier App Segmentation",
  description: "Isolate web, app, and database tiers",
  template: "three_tier_application",
  tiers: {
    web: {
      workloads: ["web-server-*"],
      allowedInbound: [
        { source: "internet", ports: [443], protocol: "tcp" }
      ],
      allowedOutbound: [
        { destination: "app-tier", ports: [8080], protocol: "tcp" }
      ]
    },
    app: {
      workloads: ["app-server-*"],
      allowedInbound: [
        { source: "web-tier", ports: [8080], protocol: "tcp" }
      ],
      allowedOutbound: [
        { destination: "db-tier", ports: [5432], protocol: "tcp" }
      ]
    },
    database: {
      workloads: ["db-server-*"],
      allowedInbound: [
        { source: "app-tier", ports: [5432], protocol: "tcp" }
      ],
      allowedOutbound: []
    }
  },
  defaultAction: "DENY"
});

// Simulate policy before applying
const simulation = await mcpClient.zscaler.workload.simulatePolicy({
  policyId: segmentationPolicy.id,
  duration: '1_hour',
  compareWithCurrent: true
});

console.log("\nPolicy Simulation Results:");
console.log(`Flows that would be blocked: ${simulation.blockedFlows}`);
console.log(`Flows that would be allowed: ${simulation.allowedFlows}`);
console.log(`Potential service impact: ${simulation.impactScore}/10`);

if (simulation.blockedFlows > 0) {
  console.log("\nBlocked Connections:");
  for (const flow of simulation.blockedConnections.slice(0, 5)) {
    console.log(`${flow.source} -> ${flow.destination}:${flow.port}`);
    console.log(`  Reason: ${flow.blockReason}`);
    console.log(`  Frequency: ${flow.connectionCount} connections/hour`);
  }
}

// Apply policy with monitoring mode first
if (simulation.impactScore < 3) {
  const deployment = await mcpClient.zscaler.workload.deployPolicy({
    policyId: segmentationPolicy.id,
    mode: 'monitor', // Start in monitor mode
    rolloutStrategy: {
      type: 'gradual',
      stages: [
        { percentage: 10, duration: '1h' },
        { percentage: 50, duration: '2h' },
        { percentage: 100, duration: '24h' }
      ]
    },
    alertOnViolation: true
  });
  
  console.log(`Policy deployed in monitor mode: ${deployment.id}`);
}

// Traffic analytics
const trafficAnalytics = await mcpClient.zscaler.workload.analyzeTraffic({
  timeRange: 'last_24_hours',
  groupBy: ['application', 'environment'],
  metrics: ['volume', 'connections', 'uniqueFlows', 'protocols']
});

console.log("\nTraffic Analysis:");
for (const app of trafficAnalytics.applications) {
  console.log(`\n${app.name}:`);
  console.log(`  Total Volume: ${app.volume / 1024 / 1024 / 1024} GB`);
  console.log(`  Connections: ${app.connectionCount}`);
  console.log(`  Unique Flows: ${app.uniqueFlows}`);
  console.log(`  Top Protocols: ${app.protocols.map(p => p.name).join(', ')}`);
}

// Anomaly detection
const anomalies = await mcpClient.zscaler.workload.detectAnomalies({
  baseline: 'last_30_days',
  sensitivity: 'medium',
  types: ['new_connections', 'traffic_spike', 'protocol_change', 'behavioral']
});

if (anomalies.count > 0) {
  console.log(`\nDetected ${anomalies.count} anomalies:`);
  for (const anomaly of anomalies.items) {
    console.log(`\n${anomaly.type}: ${anomaly.description}`);
    console.log(`  Severity: ${anomaly.severity}`);
    console.log(`  Affected: ${anomaly.affectedWorkloads.join(', ')}`);
    console.log(`  Recommendation: ${anomaly.recommendation}`);
    
    if (anomaly.severity === 'critical') {
      // Auto-respond to critical anomalies
      await respondToAnomaly(anomaly);
    }
  }
}

// Compliance validation
const complianceCheck = await mcpClient.zscaler.workload.validateCompliance({
  framework: 'PCI-DSS',
  scope: {
    environments: ['production'],
    tags: { 'data-classification': 'cardholder' }
  }
});

console.log(`\nPCI-DSS Compliance Check:`);
console.log(`Overall Score: ${complianceCheck.score}%`);
console.log(`Segmentation Requirements: ${complianceCheck.segmentationStatus}`);

if (complianceCheck.violations.length > 0) {
  console.log("\nViolations Found:");
  for (const violation of complianceCheck.violations) {
    console.log(`- ${violation.requirement}: ${violation.description}`);
    console.log(`  Affected Resources: ${violation.resources.length}`);
    console.log(`  Remediation: ${violation.remediation}`);
  }
}

// Emergency breach response
const breachResponse = async (compromisedWorkload) => {
  // Immediate isolation
  const isolation = await mcpClient.zscaler.workload.isolateWorkload({
    workloadId: compromisedWorkload,
    mode: 'quarantine',
    allowedConnections: [
      { destination: 'security-tools', ports: [443], purpose: 'forensics' }
    ]
  });
  
  // Ring-fence connected workloads
  const connectedWorkloads = await mcpClient.zscaler.workload.getConnectedWorkloads({
    workloadId: compromisedWorkload,
    depth: 2
  });
  
  for (const workload of connectedWorkloads) {
    await mcpClient.zscaler.workload.applyPolicy({
      workloadId: workload.id,
      policy: 'heightened-security',
      duration: '48h'
    });
  }
  
  // Generate incident report
  const report = await mcpClient.zscaler.workload.generateIncidentReport({
    workloadId: compromisedWorkload,
    includeForensics: true
  });
  
  return {
    isolation: isolation,
    affectedCount: connectedWorkloads.length,
    report: report
  };
};

// DevOps integration
const cicdIntegration = await mcpClient.zscaler.workload.configureCICD({
  platform: 'jenkins',
  stages: [
    {
      name: 'pre-deployment',
      actions: ['validate_workload_identity', 'check_policy_compliance']
    },
    {
      name: 'deployment',
      actions: ['apply_segmentation_policy', 'enable_monitoring']
    },
    {
      name: 'post-deployment',
      actions: ['verify_connectivity', 'run_security_tests']
    }
  ],
  policyAsCode: {
    repository: 'https://github.com/company/segmentation-policies',
    branch: 'main',
    path: '/policies'
  }
});

// Real-time monitoring
const monitor = await mcpClient.zscaler.workload.startMonitoring({
  events: [
    'policy_violation',
    'new_workload',
    'configuration_change',
    'anomaly_detected',
    'compliance_drift'
  ],
  filters: {
    environments: ['production'],
    severity: ['high', 'critical']
  }
});

monitor.on('event', async (event) => {
  console.log(`Event: ${event.type}`);
  console.log(`Details: ${event.description}`);
  console.log(`Affected: ${event.affectedResources}`);
  
  if (event.type === 'policy_violation' && event.severity === 'critical') {
    await handlePolicyViolation(event);
  }
});

Common Use Cases​

Application Segmentation​

  • Multi-tier application isolation
  • Microservices protection
  • Database segmentation
  • API gateway security

Compliance​

  • PCI DSS segmentation
  • HIPAA data isolation
  • SOX controls
  • GDPR compliance

DevSecOps​

  • CI/CD integration
  • Policy as Code
  • Automated deployment
  • Container security

Incident Response​

  • Breach containment
  • Workload isolation
  • Forensic analysis
  • Recovery procedures

Security Best Practices​

  1. Zero Trust Implementation:

    • Default deny policies
    • Least privilege access
    • Identity verification
    • Continuous validation

  2. Policy Management:

    • Test before enforce
    • Gradual rollout
    • Monitor mode first
    • Regular reviews

  3. Operational Security:

    • Anomaly monitoring
    • Change tracking
    • Audit logging
    • Incident response

Troubleshooting​

Common Issues​

  1. Discovery Problems

    • Verify agent deployment
    • Check network visibility
    • Review workload tags
    • Validate credentials

  2. Policy Issues

    • Test in simulation
    • Check rule conflicts
    • Verify workload identity
    • Review dependencies

  3. Performance Impact

    • Monitor latency
    • Check CPU usage
    • Optimize rules
    • Review logging

Getting Help​