Changelog

The MCP server now lives at https://mcp.openwaf.dev/mcp and supports MCP authorization (OAuth 2.1). Give your client the URL; it opens the dashboard, where you sign in and choose the organization, a role no higher than yours and an expiry of 7, 30 or 90 days. The connection shows up in API tokens with the «OAuth app» badge and is revoked there. API tokens keep working, and the older https://dash.openwaf.dev/v1/mcp keeps answering with API tokens.

See connect a client and OAuth and tokens.

OpenWAF Cloud now runs the egress gateway for you at https://egress.openwaf.dev, in early access. From the new AI egress page, the API or the MCP server, an organization admin creates one agent per app with its own token (shown once), stores provider keys that can only be replaced, never read back, and adds custom HTTPS targets next to a catalog of 13 providers. Every refused call appears in Blocked requests, live. Write to [email protected] to join.

See get started with hosted egress.

The full tool list of the MCP server costs about 12,500 tokens of context in every conversation. The new lite profile (?profile=lite or the X-OpenWAF-MCP-Profile: lite header) lists only search_tools, describe_tool, call_tool, execute and the everyday reads, in about 1,300 tokens; every other tool still works by name. execute runs a read-only JavaScript script on the server with the token's permissions: it can simulate writes but never apply them. Without the parameter nothing changes.

See the lite profile.

OpenWAF Cloud now has a remote MCP server, so Claude Code, Cursor and other MCP clients can read and change your zones through the same API, roles and audit log as the CLI. Every configuration write is simulated first and returns a diff; it is applied only on a second call with confirm=true and the version you saw, and refused with version_conflict if the zone changed in between. Read-only tokens only see the read tools, and every change is audited with "channel": "mcp".

See the MCP server overview and making changes.