waf_overviewLABSCO SUMMARY
False positives found and cleared without leaving the thread.
The drill-down is the design: it starts from the rules that fired on successful responses — the false-positive shape — and ends with the exclusion actually written, so tuning is not a loop of greps and config edits.
What it is
An MCP server for an OWASP ModSecurity CRS instance running in Docker. It runs a drill-down — overview, then events filtered by IP or rule, then one event in full with headers, request body and every rule match — and it can change engine mode, paranoia level, rule exclusions and the IP whitelist.
What you get
- An overview of total events, unique IPs and rules, and events in the last hour
- Top IPs by event count with geo enrichment, and the most-triggered rules with severity and description
- Rules that fired on HTTP 2xx responses, surfaced as false-positive candidates
- Events filtered by source IP or by rule ID, and a single event in full
- Container health, engine mode, rules loaded and paranoia level
- Engine mode switched between On, Off and DetectionOnly, paranoia set 1 to 4, rules disabled or re-enabled, IPs whitelisted or removed
- A test run against the WAF covering scanner detection, SQLi, XSS and path traversal
Requirements
A ModSecurity CRS container the server can reach through Docker. Analysis tools take a since window written in Docker duration syntax — minutes, hours or days — and fall back to a default window when you do not give one.
Setup effort
Build from source — git clone https://github.com/KratosUAE/waf_mcp.git
USE CASES
01
Working out why legitimate traffic is being blocked
Start from the overview, take the rules that fired on 2xx responses, and read one event in full to confirm.
02
Clearing a rule that keeps firing on your own content
Find the top offending rule and disable it by ID, which writes the exclusion for you.
03
Deciding whether an IP is an attacker or a colleague
Read the top IPs with their geo enrichment, then that IP's events, then the matched data on one of them.
04
Loosening the engine while you tune
Check the current state, switch to DetectionOnly, and set the paranoia level you want to test at.
05
Letting a known-good source straight through
Whitelist the IP, and take it back off the list when the work is finished.
06
Confirming the WAF still catches real attacks after tuning
Run the test suite and check the engine state, rather than assuming the exclusions were narrow.
15 tools
Listed in project docs. Your client may show a different list.
waf_top_ipswaf_top_ruleswaf_fp_candidateswaf_events_by_ipwaf_events_by_rulewaf_event_detailwaf_statuswaf_set_enginewaf_set_paranoiawaf_disable_rulewaf_enable_rulewaf_allow_ipwaf_deny_ipwaf_testBEFORE YOU INSTALL
What to know first
Tools you get
15 tools named in the project's documentation.
Requires
Node.js 18+
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
git clone https://github.com/KratosUAE/waf_mcp.git
cd waf_mcp
npm install
npm run buildMCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"waf": {
"type": "stdio",
"command": "node",
"args": [
"<YOUR_PATH_TO_WAF_MCP>/dist/index.js"
],
"env": {
"WAF_COMPOSE_DIR": "<YOUR_WAF_COMPOSE_DIR>",
"WAF_DOMAIN": "<YOUR_WAF_DOMAIN>"
}
}
}
}
