Run your domains from your AI assistant.

Connect your client

• Claude Code

  One command. Then run /mcp, choose openwaf and Authenticate; claude mcp list should show it as connected.

  Claude Code

  claude mcp add --transport http openwaf \
    https://mcp.openwaf.dev/mcp

• Claude Desktop and claude.ai

  Add a custom connector with the URL and press Connect: the dashboard opens to sign in and grant access. No mcp-remote and no Node.js.

  Claude Desktop and claude.ai

  Settings → Connectors → Add custom connector
  https://mcp.openwaf.dev/mcp

• Cursor

  In ~/.cursor/mcp.json, or in the project’s .cursor/mcp.json kept out of the repository. Without headers, Cursor signs in with OAuth.

  Cursor

  {
    "mcpServers": {
      "openwaf": {
        "url": "https://mcp.openwaf.dev/mcp"
      }
    }
  }

• Codex and other clients

  Any client with Streamable HTTP works with the URL: with OAuth if it supports it, or with an Authorization: Bearer header. In Codex, in ~/.codex/config.toml:

  Codex and other clients

  [mcp_servers.openwaf]
  url = "https://mcp.openwaf.dev/mcp"
  bearer_token_env_var = "OPENWAF_TOKEN"

With OAuth you choose the organization, the role (read-only, tech or admin, never above your own) and the expiry (7, 30 or 90 days) on the consent screen; the connection shows up in API tokens as «MCP · <client>» and is revoked there. With an API token, create one just for the assistant: readonly to look, tech to make changes, limited to one client or one domain if you like. It goes in the client’s configuration, never in the conversation.

Tools

How a change is made

1. 1

   Simulate

   Every write carries the domain, a reason and confirm. With confirm off, the default, it runs as a dry run: nothing is applied, and it returns the plan with its diff, the current version and the one it would create.

2. 2

   Confirm

   The assistant shows you the plan. Only after you agree does it call again with confirm: true and the expected_version from the simulation.

3. 3

   Refuse if stale

   If the domain changed in between, nothing is applied: version_conflict (HTTP 412). The assistant has to simulate again and show you the new plan.

4. 4

   Record

   The applied change is a new version with its reason, audited with the token as actor and the MCP channel. revert_zone restores any earlier version in one step.

Each token can have up to 4 MCP calls in progress at once.

Tool results are data, not instructions: the server tells the assistant not to follow instructions found in record contents, notes or audit entries.

Lite profile and code mode: add ?profile=lite to the URL and tools/list shrinks to the discovery tools (search_tools, describe_tool), execute and a daily set, from 12,519 to 1,325 tokens; every tool stays callable by name. execute runs a JavaScript script server-side in a sandbox (QuickJS in WebAssembly) with read-only access as the token: reads, simulations of writes, never applies. Typed SDKs: /v1/sdk/openwaf.ts and /v1/sdk/openwaf.py.

• Change control

  Every change on the record, and one step back

  Learn more: Change control
  

• MCP Shield

  Check tool calls and tool results at the edge

  Learn more: MCP Shield
  

• For agencies

  Made for teams that look after dozens of client sites

  Learn more: For agencies