How do I install the waf mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `WAF_COMPOSE_DIR`, `WAF_DOMAIN`, `IPINFO_TOKEN` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Waf MCP Server

MCP server for ModSecurity WAF management — monitor, analyze, and configure OWASP CRS via AI assistants

Local serverstdioTypeScript

What is the Waf MCP Server?

MCP server for ModSecurity WAF management — monitor, analyze, and configure OWASP CRS via AI assistants

The short version

An MCP (Model Context Protocol) server for managing OWASP ModSecurity CRS via Docker. Gives AI assistants like Claude direct access to WAF monitoring, analysis, and configuration through a structured drill-down pipeline.

What it needs from you

Docker with a running owasp/modsecurity-crs container - Docker Compose managing the ModSecurity container - Node.js 18+ - ModSecurity configured with JSON Serial audit log (SecAuditLogFormat JSON)

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
waf_overview	Dashboard: total events, unique IPs/rules, events last hour
waf_top_ips	Top IPs by event count with geo enrichment (ipinfo.io)
waf_top_rules	Most triggered rules with severity and description
waf_fp_candidates	Rules that fired on HTTP 2xx responses (false positive candidates)
waf_events_by_ip	Events filtered by source IP
waf_events_by_rule	Events filtered by rule ID
waf_event_detail	Full event: headers, request body, all rule matches with matched data
waf_status	Container health, engine mode, rules loaded, paranoia level
waf_set_engine	Switch between On, Off, DetectionOnly
waf_set_paranoia	Set CRS paranoia level (1–4)
waf_disable_rule	Disable a rule by ID (adds SecRuleRemoveById to exclusions)
waf_enable_rule	Re-enable a previously disabled rule
waf_allow_ip	Whitelist an IP (bypass WAF entirely)
waf_deny_ip	Remove an IP from whitelist
waf_test	Run test suite: scanner detection, SQLi, XSS, path traversal

How to install the Waf MCP Server

{
  "mcpServers": {
    "waf": {
      "type": "stdio",
      "command": "node",
      "args": [
        "/path/to/waf_mcp/dist/index.js"
      ],
      "env": {
        "WAF_COMPOSE_DIR": "/path/to/your/compose/dir",
        "WAF_DOMAIN": "https://your-domain.com"
      }
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

Docker with a running owasp/modsecurity-crs container - Docker Compose managing the ModSecurity container - Node.js 18+ - ModSecurity configured with JSON Serial audit log (SecAuditLogFormat JSON)

Variable	Description	Required
WAF_COMPOSE_DIR	Declared in the maintainer’s client configuration.	Check documentation
WAF_DOMAIN	Declared in the maintainer’s client configuration.	Check documentation

Example prompts to try

“Use Waf MCP to Actions.”

Frequently asked questions

MCP server for ModSecurity WAF management — monitor, analyze, and configure OWASP CRS via AI assistants Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.