OpenWAF Egress is now open source under the Apache License 2.0. Agents hold a placeholder token instead of the provider key; the gateway checks every request against the agent's allowed targets, an SSRF check, 27 prompt-injection detectors and data-leak patterns, and only then injects the real key from OpenBao or HashiCorp Vault. It ships as a container for linux/amd64 and linux/arm64 and as Linux and macOS binaries.
Put your own MCP server behind OpenWAF and declare its path as an MCP endpoint: the edge reads every JSON-RPC message, applies a method and tool allowlist, inspects tool arguments and tool results for prompt injection and leaked credentials, and limits requests per token. Blocks are JSON-RPC errors with the id of the blocked request, so the session keeps working. It is part of AI Crawl Control, opt-in per endpoint, and starts in log mode.
The MCP server now lives at https://mcp.openwaf.dev/mcp and supports MCP authorization (OAuth 2.1). Give your client the URL; it opens the dashboard, where you sign in and choose the organization, a role no higher than yours and an expiry of 7, 30 or 90 days. The connection shows up in API tokens with the «OAuth app» badge and is revoked there. API tokens keep working, and the older https://dash.openwaf.dev/v1/mcp keeps answering with API tokens.
OpenWAF Cloud now runs the egress gateway for you at https://egress.openwaf.dev, in early access. From the new AI egress page, the API or the MCP server, an organization admin creates one agent per app with its own token (shown once), stores provider keys that can only be replaced, never read back, and adds custom HTTPS targets next to a catalog of 13 providers. Every refused call appears in Blocked requests, live. Write to [email protected] to join.
OpenWAF now has typed SDKs generated from its OpenAPI description: a TypeScript client built on fetch with no dependencies and a Python client that only uses the standard library. They cover the operations an API token can call and are served by the API itself at /v1/sdk/openwaf.ts and /v1/sdk/openwaf.py.
An API token can now be created as purge-only: it is limited to one zone and can only purge that zone's cache and list its purges. Any other route, MCP included, answers 403 token_scope. It is the token to give a CI job that purges after each deploy.
The full tool list of the MCP server costs about 12,500 tokens of context in every conversation. The new lite profile (?profile=lite or the X-OpenWAF-MCP-Profile: lite header) lists only search_tools, describe_tool, call_tool, execute and the everyday reads, in about 1,300 tokens; every other tool still works by name. execute runs a read-only JavaScript script on the server with the token's permissions: it can simulate writes but never apply them. Without the parameter nothing changes.
AI Crawl Control is now in the dashboard, in beta: opt-in per site and starting in log mode. It classifies every request against a catalog of 31 AI bots from 18 operators, verified by published IP ranges, reverse DNS and Web Bot Auth signatures, flags crawlers that only claim to be someone, and lets you allow, log, challenge, block or tarpit per category or per bot. It also manages robots.txt with Content-Signal, serves Markdown to agents, protects your own AI endpoints and scores how ready a site is for AI agents. The MCP tools ai_agents_report, ai_agents_settings, ai_agents_catalog and agent_readiness_scan cover the same ground.
OpenWAF can now measure Core Web Vitals in your visitors' browsers: LCP, INP, CLS, FCP and TTFB, with a script the edge adds to your pages and without storing IP addresses. It is off by default and is switched on per domain with a sample rate. The dashboard's Real performance page shows the p75 of each metric with its rating, and the MCP tool rum_report reads the same data.
Sites can now limit requests per path with up to 25 rate limiting rules, each keyed by IP, header, cookie or a JSON body field, and answering with block, a proof-of-work challenge or log only. A name can have its own list instead of the domain's. Rules are managed from the dashboard (with templates for login and one-time-code forms), the CLI, the API and MCP.
Origin TLS is now set per name: full encrypts without verifying, full_strict verifies the origin's certificate. New domains start in full_strict; existing ones stay in full. The OpenWAF Origin CA issues free origin certificates valid for up to 15 years, from a key it generates (returned once, never kept) or from your own CSR. With authenticated origin pulls the edge presents a client certificate, so your server can refuse every connection that does not come through OpenWAF.
The OpenWAF edge can now cache your sites. The cache is in beta and off by default; you switch it on per site, with templates for WordPress, Next.js and static sites, Cache-Status, stale-while-revalidate and stale-if-error. The WAF always runs first. A purge by URL, prefix, host or Cache-Tag, or of everything, reaches every edge node in about a second, from the dashboard, the API or the MCP tool purge_cache.
Sites can now send 103 Early Hints: the edge learns the resources a page needs and hints them to the browser while the origin is still building the response. Early Hints are off by default and are switched on per domain or per name, from the dashboard, the CLI, the API or MCP (early_hints.enabled).
OpenWAF Cloud now has a remote MCP server, so Claude Code, Cursor and other MCP clients can read and change your zones through the same API, roles and audit log as the CLI. Every configuration write is simulated first and returns a diff; it is applied only on a second call with confirm=true and the version you saw, and refused with version_conflict if the zone changed in between. Read-only tokens only see the read tools, and every change is audited with "channel": "mcp".
Sites can now redirect at the edge, before the request reaches the origin: up to 50 redirect rules per site, with status codes 301 to 308, keeping the path and the query string if you want. They are part of the site's versioned settings, so every change has a reason, a diff and a one-step revert.
When you add a domain you can now import its records from a BIND file or from its public DNS. Records can be created, changed and deleted in one batch of up to 500 operations, applied as a single version: all or nothing. Records also carry comments and tags.