What is MCP Shield?
A layer in the OpenWAF edge proxy for MCP servers that use the Streamable HTTP transport. It reads each JSON-RPC message, applies a method and tool policy, inspects tool arguments and tool results for prompt injection and leaked credentials, and limits requests per token. See the overview.
Does it use a language model to detect prompt injection?
No. It uses the same deterministic detectors as OpenWAF’s AI endpoint protection, regular expressions in English and Spanish. They stop known shapes of injection and credential leaks, not every possible one. See what is and isn’t detected.
Will it break my MCP clients?
It is designed not to. Session headers, streams and DELETE requests pass untouched, and blocks are JSON-RPC errors with the id of the blocked request, so the client sees the error for that call and the session continues. It also starts in log mode, where nothing is blocked. See errors and events.
What does it not inspect?
Notifications, the client’s answers to server requests, responses or SSE events over 2 MiB, responses that arrive still compressed, headers and query strings. Requests the server sends to the client are inspected but only logged.
Do I need to change my MCP server?
No. You declare its path as an MCP endpoint in the domain’s Bots and AI agents settings, from the dashboard, the CLI, the API or the OpenWAF MCP server. See enable MCP Shield.
Does MCP Shield check my server's tokens?
No. Your MCP server still authenticates its clients. The edge only uses a SHA-256 hash of the Authorization header to count requests per token and to fingerprint events; the token itself is never stored.
Is the per-token limit exact?
No. Each edge node counts on its own, so with N nodes serving the site one token can reach up to N times the limit. Use it as a ceiling against runaway agents. See per-token rate.