Docs

Connect AI Agents to Your WAF (MCP)

Overview

Expedited WAF has a built-in MCP (Model Context Protocol) server, so AI agents like Claude can check your WAF’s status, look up blocked traffic, and answer questions about your configuration for you. Agents can also make changes for you: the same changes you can make yourself in the dashboard, from IP and path rules to traffic, caching, and content-security settings. The agent’s tools mirror the pages in your dashboard, so anything it reports or changes maps to a place you can open and check yourself. Every change an agent makes is recorded in your Audit Log, along with who made it.

Any MCP-capable client connects with just one URL:

https://app.expeditedsecurity.com/api/mcp

There are no API keys to create or copy. The client registers itself and opens a browser window where you approve the connection.

Connect from Claude Desktop

  1. Open Settings, then Connectors.
  2. Click Add custom connector and paste the URL above.
  3. A browser window opens to approve the connection. See “Signing In” below.

Connect from claude.ai

  1. Open Settings, then Connectors.
  2. Click Add custom connector and paste the URL above.
  3. Approve the connection when the consent screen appears.

Connect from Claude Code

  1. Add the server from your terminal:

    claude mcp add --transport http expedited-waf https://app.expeditedsecurity.com/api/mcp
  2. Inside Claude Code, run /mcp and choose the server to authenticate.
  3. Approve the connection in the browser window that opens.

Signing In

Your identity comes from your Heroku dashboard session. If your browser has opened your Expedited WAF dashboard from Heroku within the last 30 days or so, the consent screen recognizes you and the connection completes automatically.

If it does not recognize you, it will ask you to open your dashboard first: go to your app in the Heroku dashboard, open the Expedited WAF add-on from the Resources tab, then retry the connection.

What the Agent Can Do

Once connected, the agent sees exactly the WAF services you can reach from your own dashboard, and nothing more. If you have access to several domains, the agent either passes the domain it wants or gets prompted with your list. The tools mirror the pages in your dashboard, grouped the same way, so the agent uses the same names and concepts you already know.

Status, certificates, and DNS

  • List all your WAF services and see each one’s status and most recent block
  • Check SSL certificate status and CAA records
  • Check whether your DNS is pointing at the firewall correctly
  • View your API access details

Logs and reports

  • Search your blocked-request logs
  • Get blocked-request statistics
  • Search your Audit Log to see recent configuration changes and who made them

Traffic and access rules

  • View and manage IP allow and block rules
  • View and manage URL path allow and block rules
  • View and manage blocked countries, user agents, referrers, cookies, and HTTP methods
  • Toggle anonymous-proxy blocking, the strict bot filter, and HTTP flood protection
  • View and set the maximum upload size

Caching and delivery

  • View and manage non-cached paths, cache mode, and compression
  • Clear the CDN cache, for the whole site or a single path
  • View and set rate limiting

Protection

  • View and set content-security options
  • View and manage password- and CAPTCHA-protected pages
  • List your origin servers, and add or remove them

Documentation

  • Search and read this documentation, so the agent can answer “how do I…” questions with our actual docs

Every change is recorded in your Audit Log with the name of the person whose agent made it, so agent-made changes are never anonymous. Some traffic-rule and page-protection changes require an advanced plan, exactly as they do in the dashboard. Agents cannot change your plan, manage certificates, or remove the service.

Managing Access

Every teammate who has opened the app’s dashboard through Heroku can connect an agent. To see who that is, pause someone’s agent access, or understand the sign-in freshness rules, see Manage AI Agent Access.