https://developers.openwaf.dev/changelog/Customer-facing changes to OpenWAF, newest first.enhttps://developers.openwaf.dev/changelog/2026-10-27-openwaf-egress-open-source/https://developers.openwaf.dev/changelog/2026-10-27-openwaf-egress-open-source/Tue, 27 Oct 2026 00:00:00 +0000An Apache-2.0 gateway that keeps provider keys out of your AI agents and checks every request before injecting the key from OpenBao or Vault.https://developers.openwaf.dev/changelog/2026-10-27-mcp-shield/https://developers.openwaf.dev/changelog/2026-10-27-mcp-shield/Tue, 27 Oct 2026 00:00:00 +0000The OpenWAF edge now reads MCP: method and tool policy, prompt-injection and credential-leak checks on tool calls and results, per-token limits.https://developers.openwaf.dev/changelog/2026-10-27-mcp-oauth/https://developers.openwaf.dev/changelog/2026-10-27-mcp-oauth/Tue, 27 Oct 2026 00:00:00 +0000The MCP server moves to mcp.openwaf.dev/mcp with OAuth 2.1: give your client the URL, sign in and choose the organization, role and expiry.https://developers.openwaf.dev/changelog/2026-10-27-hosted-ai-egress/https://developers.openwaf.dev/changelog/2026-10-27-hosted-ai-egress/Tue, 27 Oct 2026 00:00:00 +0000OpenWAF Cloud runs the egress gateway at egress.openwaf.dev: agents with their own tokens, write-only provider keys and blocked requests in the dashboard.https://developers.openwaf.dev/changelog/2026-10-26-typed-sdks/https://developers.openwaf.dev/changelog/2026-10-26-typed-sdks/Mon, 26 Oct 2026 00:00:00 +0000Typed clients generated from the OpenAPI description: TypeScript on fetch with no dependencies, Python on the standard library.https://developers.openwaf.dev/changelog/2026-10-26-purge-only-tokens/https://developers.openwaf.dev/changelog/2026-10-26-purge-only-tokens/Mon, 26 Oct 2026 00:00:00 +0000API tokens limited to one zone that can only purge its cache and list its purges, for CI jobs.https://developers.openwaf.dev/changelog/2026-10-26-mcp-lite-profile-and-code-mode/https://developers.openwaf.dev/changelog/2026-10-26-mcp-lite-profile-and-code-mode/Mon, 26 Oct 2026 00:00:00 +0000With ?profile=lite the MCP server lists a few tools in about 1,300 tokens instead of 12,500; every other tool stays callable by name.https://developers.openwaf.dev/changelog/2026-10-26-ai-crawl-control/https://developers.openwaf.dev/changelog/2026-10-26-ai-crawl-control/Mon, 26 Oct 2026 00:00:00 +0000Decide what each AI crawler may do per site, catch spoofed crawlers, protect your AI endpoints and scan how ready a site is for AI agents.https://developers.openwaf.dev/changelog/2026-10-25-real-user-monitoring/https://developers.openwaf.dev/changelog/2026-10-25-real-user-monitoring/Sun, 25 Oct 2026 00:00:00 +0000Measure LCP, INP, CLS, FCP and TTFB in your visitors' browsers with a script the edge adds, without storing IP addresses.https://developers.openwaf.dev/changelog/2026-10-25-rate-limiting-rules/https://developers.openwaf.dev/changelog/2026-10-25-rate-limiting-rules/Sun, 25 Oct 2026 00:00:00 +0000Up to 25 rate limiting rules per site, per path and keyed by IP, header, cookie or JSON body field, with block, challenge or log.https://developers.openwaf.dev/changelog/2026-10-25-origin-ca-and-full-strict/https://developers.openwaf.dev/changelog/2026-10-25-origin-ca-and-full-strict/Sun, 25 Oct 2026 00:00:00 +0000Verify the origin's certificate per name, issue free Origin CA certificates for up to 15 years, and let only the edge reach your server.https://developers.openwaf.dev/changelog/2026-10-25-edge-cache-and-purge/https://developers.openwaf.dev/changelog/2026-10-25-edge-cache-and-purge/Sun, 25 Oct 2026 00:00:00 +0000An edge cache in beta, off by default, with stack templates, and purges by URL, prefix, host or Cache-Tag applied on every node.https://developers.openwaf.dev/changelog/2026-10-25-early-hints/https://developers.openwaf.dev/changelog/2026-10-25-early-hints/Sun, 25 Oct 2026 00:00:00 +0000The edge learns the resources a page needs and hints them to the browser with 103 Early Hints while the origin works.https://developers.openwaf.dev/changelog/2026-10-24-remote-mcp-server/https://developers.openwaf.dev/changelog/2026-10-24-remote-mcp-server/Sat, 24 Oct 2026 00:00:00 +0000Manage zones, DNS records, edge settings and rules from an AI assistant, with every change simulated first and audited.https://developers.openwaf.dev/changelog/2026-10-24-redirect-rules/https://developers.openwaf.dev/changelog/2026-10-24-redirect-rules/Sat, 24 Oct 2026 00:00:00 +0000Up to 50 redirect rules per site at the edge, with 301 to 308 status codes, keeping the path and the query string if you want.https://developers.openwaf.dev/changelog/2026-10-24-dns-import-and-batch-changes/https://developers.openwaf.dev/changelog/2026-10-24-dns-import-and-batch-changes/Sat, 24 Oct 2026 00:00:00 +0000Import a BIND file or a domain's public records, and create, change and delete up to 500 records in one version.