Your entire Zscaler stack.
One Slack command.

Zmate is a Slack bot that wraps your Zscaler security stack — ZIA, ZPA, ZDX, ZCC, ZID, and ZINS — in /zmate slash commands. Security teams can execute incident response, policy management, and reporting directly from Slack. Every write operation goes through a confirm/cancel flow so nothing changes without explicit approval.

Run /zmate lockdown user@company.com in Slack. Zmate queues a full lockdown — a ZPA DENY rule at rank 1 scoped to the user's SAML email, disabling all ZPA app segments, and a ZIA URL filtering rule blocking all categories for that user only. Because lockdown is a high-impact action, it requires double confirmation: type /zmate confirm <6-digit code> where the code comes from your authenticator app (Google Authenticator, Authy, or 1Password). The whole flow takes under 30 seconds.

Zmate has a Starter tier that is free and covers all read operations — listing rules, viewing ZDX scores, and querying policies. The Pro tier unlocks all write operations including lockdown, firewall blocking, URL filtering, and policy management. Contact hello@zmate.io for Pro pricing.

Initial setup takes under 10 minutes. You need four Zscaler API credentials (client ID, client secret, customer ID, vanity domain), a Slack bot token, and a Slack app token. Once configured, the bot connects and all 60+ commands are immediately available. No Zscaler configuration changes are required.

Zmate connects directly to your Zscaler tenant using the official Zscaler MCP server. No command data is stored or processed by third parties. The Enterprise Runner option lets you self-host Zmate entirely within your own infrastructure with zero data egress, including air-gapped deployment options.

Yes. The Enterprise Runner option lets you run the Zmate Docker container entirely within your own infrastructure. Your Zscaler credentials and command data never leave your environment. This is ideal for organizations with strict data residency or air-gap requirements.

Yes. Lockdown and unlock have built-in two-factor protection. Every write command already requires an explicit /zmate confirm — but for lockdown and unlock specifically, that confirm step also requires a 6-digit MFA code from the admin's authenticator app (Google Authenticator, Authy, or 1Password). This means executing a lockdown requires both access to the Slack workspace and physical possession of the admin's phone. Admins set this up once with /zmate mfa setup, which generates a secret and walks through the Fly secrets registration. Each admin has an independent secret — one admin's key never affects another's.

Zmate supports ZIA (Internet Access) for URL filtering, firewall rules, DNS blocking, and DLP; ZPA (Private Access) for app segments, access policy, and connectors; ZDX (Digital Experience) for monitoring, alerts, and deep traces; ZCC (Client Connector) for device inventory; ZID (Identity) for user and group lookup; and ZINS for threat intelligence and CASB reporting.

Run /zmate unlock user@company.com to reverse a lockdown. Zmate deletes the ZPA DENY rule, re-enables all ZPA app segments, and removes the ZIA URL filtering rule. If the bot has restarted since the lockdown, it falls back to a name-based search to find and remove the rules automatically.

Zmate does not intercept or proxy your Zscaler traffic — it only issues API commands when you explicitly request them. If the bot is offline, your Zscaler policies remain exactly as last configured. No automated rollbacks occur. Pending confirmations expire after 5 minutes and are discarded on restart.