WAF (ModSecurity)

An MCP (Model Context Protocol) server for managingOWASP ModSecurity CRSvia Docker. Gives AI assistants like Claude direct access to WAF monitoring, analysis, and configuration through a structured drill-down pipeline.

Built forClaude Codebut works with any MCP-compatible client.

waf_overview(since: "7d") # last 7 days waf_events_by_ip(ip: "1.2.3.4", since: "1h") # last hour

- Dockerwith a runningowasp/modsecurity-crscontainer
- Docker Composemanaging the ModSecurity container
- Node.js18+
- ModSecurity configured withJSON Serial audit log(SecAuditLogFormat JSON)

git clone https://github.com/KratosUAE/waf_mcp.git cd waf_mcp npm install npm run build

claude mcp add --transport stdio --scope user \ -e WAF_COMPOSE_DIR=/path/to/your/compose/dir \ -e WAF_DOMAIN=https://your-domain.com \ waf -- node /path/to/waf_mcp/dist/index.js

{ "mcpServers": { "waf": { "type": "stdio", "command": "node", "args": ["/path/to/waf_mcp/dist/index.js"], "env": { "WAF_COMPOSE_DIR": "/path/to/your/compose/dir", "WAF_DOMAIN": "https://your-domain.com" } } } }

The server expects a ModSecurity container managed by Docker Compose. Example service definition:

modsecurity: image: owasp/modsecurity-crs:nginx-alpine environment: - BACKEND=http://your-app:8080 - MODSEC_RULE_ENGINE=DetectionOnly - MODSEC_AUDIT_LOG=/dev/stderr - MODSEC_AUDIT_LOG_FORMAT=JSON - MODSEC_AUDIT_LOG_TYPE=Serial - MODSEC_AUDIT_ENGINE=RelevantOnly - MODSEC_REQ_BODY_ACCESS=On - MODSEC_REQ_BODY_LIMIT=52428800 - MODSEC_RESP_BODY_ACCESS=Off - PARANOIA=1 - ANOMALY_INBOUND=5 volumes: - ./modsecurity/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf:/etc/modsecurity.d/owasp-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf:ro

- MODSEC_AUDIT_LOG=/dev/stderr— sends audit log to Docker logs (required for the MCP server to read events)
- MODSEC_AUDIT_LOG_FORMAT=JSON— JSON format for structured parsing
- Exclusions file mount— allows hot-reload of rule exclusions vianginx -s reload

LLM API endpoints receive prompts containing code, SQL, HTML, and shell commands — all legitimate content that triggers WAF rules. Create an exclusions file to disable content-inspection rules on API paths:

# modsecurity/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf SecRule REQUEST_URI "@rx ^(/v1/)?(chat/completions|completions|embeddings|responses|messages)|^/anthropic/" \ "id:1000,phase:1,nolog,pass,\ ctl:ruleRemoveById=921000-944999"

This disables rules 921000–944999 (all content-inspection categories: SQLi, XSS, RCE, LFI, RFI, etc.) on LLM API endpoints while keeping protocol enforcement, scanner detection, DoS protection, and IP reputation checks active.

You: "Check the WAF — anything suspicious?" Claude: [calls waf_overview] → 332 events, 4 unique IPs, 12 rules triggered Claude: [calls waf_top_ips] → 135.237.83.23 (Washington, US, Microsoft) — 320 events Claude: [calls waf_events_by_ip, ip: "135.237.83.23", count: 5] → All POST /chat/completions, HTTP 200, rules: 942360, 932100... Claude: [calls waf_event_detail, index: 42] → User-Agent: OpenAI/JS 6.26.0, body contains tool descriptions → Rule 942360 matched "update" in cron action descriptions Claude: "This is your OpenClaw bot — all false positives. Want me to whitelist this IP?" You: "Yes" Claude: [calls waf_allow_ip, ip: "135.237.83.23"] → Done. IP whitelisted.

You: "Check IP 185.206.249.230 — it was flagged yesterday" Claude: [calls waf_events_by_ip, ip: "185.206.249.230", since: "7d"] → 2 events from Apr 7, GET /v1/skills, HTTP 401, no rules triggered → Apple Private Relay IP (Singapore), just unauthorized API probes

npm run build # Compile TypeScript npm test # Run tests (43 tests) npm run test:watch # Watch mode WAF_DEBUG=1 npm start # Run with debug logging

src/ ├── index.ts # MCP server setup, tool registration ├── waf-manager.ts # Core service: Docker exec, log parsing, config management ├── types.ts # TypeScript interfaces ├── config.ts # Environment-based configuration ├── logger.ts # stderr-only logger (stdout reserved for MCP protocol) └── tools/ ├── overview.ts # L0: dashboard ├── top-ips.ts # L1: IP aggregation ├── top-rules.ts # L1: rule aggregation ├── fp-candidates.ts # L1: false positive detection ├── events-by-ip.ts # L2: drill-down by IP ├── events-by-rule.ts # L2: drill-down by rule ├── event-detail.ts # L3: full event inspection ├── status.ts # Container status ├── set-engine.ts # Engine mode control ├── set-paranoia.ts # Paranoia level control ├── disable-rule.ts # Rule management ├── enable-rule.ts # Rule management ├── allow-ip.ts # IP whitelist ├── deny-ip.ts # IP whitelist ├── test.ts # WAF test suite └── utils.ts # Shared utilities

Events are parsed from Docker logs and cached for 30 seconds. Rapid drill-down calls (overview → top IPs → events by IP → event detail) hit the cache instead of re-parsing. The cache is invalidated when thesinceparameter changes.

Civilian situational awareness for AI deployments — real-time risk dashboards, multi-source threat correlation, anomaly detection, and automated alerting for critical infrastructure and enterprise AI systems.

MCP server to Automate Exposure Management

Provides a unified interface to AWS services for security investigations and incident response.

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

Self-hosted MCP governance runtime in Rust — audit trail, policy enforcement, and cost controls for MCP servers.

Integrate with Tailscale's CLI and API for automated network management and monitoring.

Secure Zero-Trust SSH Gateway for AI Agents. A Go-based Model Context Protocol (MCP) server featuring runtime Regex Command Firewalls and multi-host isolation.

Secure every MCP server with one governed gateway. Give each AI agent its own scoped MCP access, contain credentials at the gateway, and audit every MCP tool call without wiring agents directly to each server.

Read-only MCP server inside a self-hosted homelab dashboard — explore hosts, Docker containers, GPU/VRAM, systemd services, AI models, alerts and disk.

A server that allows MCP clients to use Suricata for network traffic analysis.