OpenWAF Cloud runs a remote MCP server (Model Context Protocol) at https://mcp.openwaf.dev/mcp, so you can manage your zones from an AI assistant: Claude Code, Claude Desktop, claude.ai, Cursor or any compatible MCP client. Ask for a DNS record, a WAF rule or a cache purge in plain language; the assistant shows you the change and applies it only when you confirm.
The MCP server is a thin client of the OpenWAF API, like the CLI. Every tool calls the same REST routes with the same credential, so roles, scopes (organization, client, zone), validation, versions, audit log and error codes are exactly those of the API. The MCP server has no business logic of its own.
At a glance
| URL | https://mcp.openwaf.dev/mcp (also https://mcp.openwaf.dev/ and https://mcp.openwaf.dev/v1/mcp). The older https://dash.openwaf.dev/v1/mcp and white-label domains keep working, with API tokens only |
| Transport | Stateless Streamable HTTP (no Mcp-Session-Id), application/json responses, protocol versions up to 2026-07-28 |
| Authentication | OAuth 2.1: the client opens the dashboard so you sign in and grant access. Or Authorization: Bearer owf_…, an API token like the CLI's. The dashboard session is not accepted |
| Organization | The one of the token, or the one you pick on the consent screen; there is no access to any other |
Without a valid credential the server answers 401 with WWW-Authenticate: Bearer and the metadata a client needs to discover OAuth.
Quick connect
With OAuth the URL is all you need. The client registers itself, opens dash.openwaf.dev and asks you to choose an organization, a role and an expiry.
| Client | How |
|---|---|
| Claude Code | claude mcp add --transport http openwaf https://mcp.openwaf.dev/mcp, then /mcp → openwaf → Authenticate |
| Claude Desktop and claude.ai | Settings → Connectors → Add custom connector → https://mcp.openwaf.dev/mcp → Connect |
| Cursor | "url": "https://mcp.openwaf.dev/mcp" in ~/.cursor/mcp.json |
| Codex and other clients | Any client with the Streamable HTTP transport; with an API token in the Authorization header if it does not do OAuth |
Connect a client has every configuration, including the API-token variant.
What the assistant can do
- Read: zones, DNS records, edge rules, certificates, versions and diffs, propagation to the edge nodes, mail records, usage, Core Web Vitals, AI agents, the audit log, origin TLS and AI egress.
- Write (role
techor higher): zones, DNS records, edge settings, rules, reverts, cache purges and origin certificates; egress agents and targets with roleadmin.
Each result comes as a short text summary plus the full data as JSON, with the same shape as the REST response. The tools page lists every one.
Safe by design
- Simulate, then confirm. Every configuration write is simulated first and returns a diff; it is applied only on a second call with
confirm=trueand the version you saw. See making changes. - Never above your role. A
readonlycredential does not even see the write tools intools/list, and a token limited to one client or one zone sees nothing else. - Audited. Every change keeps its reason, its version and
"channel": "mcp"in the audit log. - Data, not instructions. Record contents, names, reasons and DNS answers are written by people or come from outside. Summaries quote them, and the server tells the assistant never to follow instructions found in them.
Next steps
Product names and logos are trademarks of their respective owners. Claude is a trademark of Anthropic, Codex of OpenAI and Cursor of Anysphere Inc.; they are shown only to say which clients work with the OpenWAF MCP server.