# MCP server

> The OpenWAF Cloud remote MCP server lets an AI assistant manage zones, DNS records, edge settings and rules through the same API, roles and audit log.

OpenWAF Cloud runs a **remote MCP server** (Model Context Protocol) at **`https://mcp.openwaf.dev/mcp`**, so you can manage your zones from an AI assistant: Claude Code, Claude Desktop, claude.ai, Cursor or any compatible MCP client. Ask for a DNS record, a WAF rule or a cache purge in plain language; the assistant shows you the change and applies it only when you confirm.

The MCP server is a thin client of the OpenWAF API, like the CLI. Every tool calls the same REST routes with the same credential, so roles, scopes (organization, client, zone), validation, versions, audit log and error codes are exactly those of the API. The MCP server has no business logic of its own.

## At a glance

| | |
|---|---|
| URL | `https://mcp.openwaf.dev/mcp` (also `https://mcp.openwaf.dev/` and `https://mcp.openwaf.dev/v1/mcp`). The older `https://dash.openwaf.dev/v1/mcp` and white-label domains keep working, with API tokens only |
| Transport | Stateless Streamable HTTP (no `Mcp-Session-Id`), `application/json` responses, protocol versions up to `2026-07-28` |
| Authentication | **OAuth 2.1**: the client opens the dashboard so you sign in and grant access. Or `Authorization: Bearer owf_…`, an API token like the CLI's. The dashboard session is not accepted |
| Organization | The one of the token, or the one you pick on the consent screen; there is no access to any other |

Without a valid credential the server answers 401 with `WWW-Authenticate: Bearer` and the metadata a client needs to discover OAuth.

## Quick connect

With OAuth the URL is all you need. The client registers itself, opens `dash.openwaf.dev` and asks you to choose an organization, a role and an expiry.

| Client | How |
|---|---|
| Claude Code | `claude mcp add --transport http openwaf https://mcp.openwaf.dev/mcp`, then `/mcp` → `openwaf` → *Authenticate* |
| Claude Desktop and claude.ai | Settings → Connectors → *Add custom connector* → `https://mcp.openwaf.dev/mcp` → *Connect* |
| Cursor | `"url": "https://mcp.openwaf.dev/mcp"` in `~/.cursor/mcp.json` |
| Codex and other clients | Any client with the Streamable HTTP transport; with an API token in the `Authorization` header if it does not do OAuth |

[Connect a client](https://developers.openwaf.dev/mcp/connect/) has every configuration, including the API-token variant.

## What the assistant can do

- **Read:** zones, DNS records, edge rules, certificates, versions and diffs, propagation to the edge nodes, mail records, usage, Core Web Vitals, AI agents, the audit log, origin TLS and AI egress.
- **Write** (role `tech` or higher): zones, DNS records, edge settings, rules, reverts, cache purges and origin certificates; egress agents and targets with role `admin`.

Each result comes as a short text summary plus the full data as JSON, with the same shape as the REST response. The [tools page](https://developers.openwaf.dev/mcp/tools/) lists every one.

## Safe by design

- **Simulate, then confirm.** Every configuration write is simulated first and returns a diff; it is applied only on a second call with `confirm=true` and the version you saw. See [making changes](https://developers.openwaf.dev/mcp/making-changes/).
- **Never above your role.** A `readonly` credential does not even see the write tools in `tools/list`, and a token limited to one client or one zone sees nothing else.
- **Audited.** Every change keeps its reason, its version and `"channel": "mcp"` in the audit log.
- **Data, not instructions.** Record contents, names, reasons and DNS answers are written by people or come from outside. Summaries quote them, and the server tells the assistant never to follow instructions found in them.

> **Note: Behind MCP Shield**
>
> `mcp.openwaf.dev` is itself published behind the OpenWAF edge, with [MCP Shield](https://developers.openwaf.dev/mcp-shield/) in log mode and a per-token rate limit.


## Next steps

- [Connect a client](https://developers.openwaf.dev/mcp/connect/): Claude Code, Claude Desktop, claude.ai, Cursor and others, with OAuth or an API token.
- [Tools](https://developers.openwaf.dev/mcp/tools/): what each of the 44 tools does, the role it needs and the REST route it calls.
- [Making changes](https://developers.openwaf.dev/mcp/making-changes/): simulate, confirm with the version you saw, conflicts and the audit log.
- [OAuth and tokens](https://developers.openwaf.dev/mcp/oauth-and-tokens/): the consent screen, revoking access, token scopes and the lite profile.


Product names and logos are trademarks of their respective owners. Claude is a trademark of Anthropic, Codex of OpenAI and Cursor of Anysphere Inc.; they are shown only to say which clients work with the OpenWAF MCP server.