OpenWAF Cloud now has a remote MCP server, so Claude Code, Cursor and other MCP clients can read and change your zones through the same API, roles and audit log as the CLI. Every configuration write is simulated first and returns a diff; it is applied only on a second call with confirm=true and the version you saw, and refused with version_conflict if the zone changed in between. Read-only tokens only see the read tools, and every change is audited with "channel": "mcp".
See the MCP server overview and making changes.