set_credentialsLABSCO SUMMARY
A WAF you can talk to while you are still reading the attack.
Rule authoring, IP lists and the event feed sit behind one connection, so noticing a pattern and blocking it are the same sitting rather than two dashboards apart. The tools reach corporation scope, which makes changes wide by default — set the context you mean to work in first.
What it is
A management surface for the Fastly NGWAF API. It covers a corporation and the sites under it — security rules, IP lists, alerts, events and traffic analytics — so a firewall change happens where you are already describing the threat.
What you get
- Corporation-level security rules: read what is in force, add one, remove one
- Allow lists, block lists, and the shared lists that rules refer to
- The security event stream, and the ability to expire an event once it has been handled
- Traffic analytics, a corporation overview, and a ranked view of suspicious IPs
- Alert configuration, Cloud WAF settings and user administration
- A credential check and an environment walk-through, so you can confirm access and find the corp and site names before touching anything
Requirements
Node.js 18 or newer and a Fastly NGWAF account with API access. Set FASTLY_NGWAF_EMAIL and FASTLY_NGWAF_TOKEN in the environment, or hand them over at runtime with set_credentials; a default corp and site can be set alongside them, so you do not name them on every call.
Setup effort
Build from source — git clone https://github.com/purpleax/FastlyMCP.git
USE CASES
01
Blocking a source that is hammering one of your sites
Read the recent events, pull the ranked suspicious IPs behind them, and add the ones you agree with to the block list.
02
Writing a rule for a pattern you just spotted
Describe the request shape in words and put the resulting rule in place at corporation level, so every site inherits it.
03
Clearing a false positive out of the way
Find the event that fired, expire it, and put the address on the allow list so the same customer is not caught twice.
04
Getting oriented in an account you did not set up
Confirm the credentials work, then walk the corporations and sites to find the names everything else needs.
05
Reporting on what the firewall actually stopped
Pull traffic analytics for the period and read them next to the rules that were in force.
22 tools
Listed in project docs. Your client may show a different list.
test_connectionset_contextdiscover_environmentlist_corp_ruleslist_site_rulescreate_corp_rulecreate_site_ruledelete_corp_ruledelete_site_rulelist_eventssearch_requestsget_suspicious_ipsexpire_eventmanage_whitelistmanage_blacklistmanage_listsget_analyticsget_corp_overviewmanage_alertsmanage_cloudwafmanage_usersBEFORE YOU INSTALL
What to know first
Tools you get
22 tools named in the project's documentation.
Requires
- node on PATH
- Node.js 18+
- FASTLY_NGWAF_TOKEN in your environment
- FASTLY_NGWAF_EMAIL in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
TERMINAL
git clone https://github.com/purpleax/FastlyMCP.git
cd FastlyMCP
npm installMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"fastly-ngwaf": {
"command": "node",
"args": [
"<YOUR_PATH_TO_FASTLY_MCP>/server.js"
],
"env": {
"FASTLY_NGWAF_EMAIL": "<YOUR_FASTLY_NGWAF_EMAIL>",
"FASTLY_NGWAF_TOKEN": "<YOUR_FASTLY_NGWAF_TOKEN>"
}
}
}
}
