Tool calls and tool results, checked at the edge.

Inspected

• inspect_requestsClient to server: the arguments of tools/call and prompts/get, and the parameters of resources/read.
• inspect_responsesServer to client: every string in result and error of the responses to requests with an id, tool descriptions of tools/list included, and the params of the server’s own requests (sampling/createMessage, elicitation/create).

Detector families

• pi.*Instruction overrides, system-prompt extraction, jailbreaks, forged system messages, tool calls and turns, approval bypass, orders in HTML comments or encoded text.
• agent.*Destructive commands such as rm -rf / or DROP TABLE.
• exfil.*Remote scripts piped to a shell, secret harvesting, exfiltration through a rendered image or link.
• hidden.*Zero-width characters, Unicode tag characters, CSS-hidden text.
• dlp.*AWS, GitHub, Stripe, Slack, SendGrid, Mailgun, OpenAI, Anthropic and OpenWAF keys, private keys and database URLs, stored redacted to their first four characters.
• mcp.*Policy hits: method not allowed, tool denied or not allowed, rate, parse error, invalid request, too large.

The same 27 injection detectors as OpenWAF’s AI-endpoint protection, in English and Spanish. Each runs only when one of its keywords appears in the text.

Not inspected

• Anything a pattern does not describe: paraphrases, other languages and encodings the detectors do not cover. There is no semantic classifier and no language model.
• The content of notifications, in either direction. Client notifications still go through the allowed methods.
• The client’s answers to sampling/createMessage and elicitation/create. The server’s requests themselves are inspected but only logged, never replaced.
• JSON responses and SSE events over 2 MiB, and responses that still arrive compressed. They pass unchanged and are counted as uninspected.
• Request bodies over max_request_kb in log mode (in enforce they get 413).
• The parameters of other methods, such as completion/complete, logging/setLevel and the list methods.
• Headers and query strings. Resource URIs and prompt names have no allow or deny list.
• The token itself: MCP Shield never validates it, your server does.

Every answer in enforce

• 200 · -32601Method not in the allowed methods
• 200 · -32602Tool denied, or missing from a non-empty allowed list
• 200 · -32001Injection or credential in the request, with request inspection on block
• -32001Injection or credential in the response, with response inspection on block: that message, or that SSE event, is replaced with the same id and your server’s status
• 429 · -32000Over the per-token limit, with Retry-After
• 413 · -32600Body over max_request_kb
• 400 · -32700Body is not JSON (id null)
• 400 · -32600JSON but not JSON-RPC 2.0, or an empty batch (id null)
• 202A blocked notification, with an empty body

What the client receives

blocked by OpenWAF MCP Shield: followed by the detection ids. error.data.openwaf repeats the event kind and the ids, so a client can tell a shield block from an error of your server.

{"jsonrpc": "2.0", "id": 7,
 "error": {"code": -32602,
   "message": "blocked by OpenWAF MCP Shield: mcp.tool_denied",
   "data": {"openwaf": {"kind": "mcp_blocked_tool",
                        "detections": ["mcp.tool_denied"]}}}}

Batches: if any message is blocked, the edge answers the whole batch and nothing reaches your server. Blocked messages get their own error; every other request with an id gets -32600 batch rejected by OpenWAF MCP Shield.