The MCP server now lives at https://mcp.openwaf.dev/mcp and supports MCP authorization (OAuth 2.1). Give your client the URL; it opens the dashboard, where you sign in and choose the organization, a role no higher than yours and an expiry of 7, 30 or 90 days. The connection shows up in API tokens with the «OAuth app» badge and is revoked there. API tokens keep working, and the older https://dash.openwaf.dev/v1/mcp keeps answering with API tokens.
See connect a client and OAuth and tokens.