Docs

Connect AI Agents to Your WAF (MCP)

Overview

Expedited WAF has a built-in MCP (Model Context Protocol) server, so AI agents like Claude can check your WAF’s status, look up blocked traffic, and answer questions about your configuration for you. Agents can also make a focused set of changes: managing your IP allow and block rules, clearing the CDN cache, and managing your origin servers. Every change an agent makes is recorded in your Audit Log, along with who made it.

Any MCP-capable client connects with just one URL:

https://app.expeditedsecurity.com/api/mcp

There are no API keys to create or copy. The client registers itself and opens a browser window where you approve the connection.

Connect from Claude Desktop

  1. Open Settings, then Connectors.
  2. Click Add custom connector and paste the URL above.
  3. A browser window opens to approve the connection. See “Signing In” below.

Connect from claude.ai

  1. Open Settings, then Connectors.
  2. Click Add custom connector and paste the URL above.
  3. Approve the connection when the consent screen appears.

Connect from Claude Code

  1. Add the server from your terminal:

    claude mcp add --transport http expedited-waf https://app.expeditedsecurity.com/api/mcp
  2. Inside Claude Code, run /mcp and choose the server to authenticate.
  3. Approve the connection in the browser window that opens.

Signing In

Your identity comes from your Heroku dashboard session. If your browser has opened your Expedited WAF dashboard from Heroku within the last 30 days or so, the consent screen recognizes you and the connection completes automatically.

If it does not recognize you, it will ask you to open your dashboard first: go to your app in the Heroku dashboard, open the Expedited WAF add-on from the Resources tab, then retry the connection.

What the Agent Can Do

Once connected, the agent sees exactly the WAF services you can reach from your own dashboard, and nothing more. If you have access to several domains, the agent either passes the domain it wants or gets prompted with your list.

Status and certificates

  • List all your WAF services and their status
  • Look up app details and current WAF settings
  • Check SSL certificate status and CAA records
  • List your configured origin servers

Traffic and logs

  • Summarize blocked traffic and see the most recent block
  • Get blocked-request statistics
  • Search your blocked-request logs
  • List your IP allow and block rules

Making changes

  • Add and remove IP allow and block rules
  • Clear the CDN cache, for the whole site or a single path
  • Add and remove origin servers

Every change is recorded in your Audit Log with the name of the person whose agent made it, so agent-made changes are never anonymous. Agents cannot change your plan, manage certificates, or remove the service.

Documentation

  • Search and read this documentation, so the agent can answer “how do I…” questions with our actual docs

Managing Access

Every teammate who has opened the app’s dashboard through Heroku can connect an agent. To see who that is, pause someone’s agent access, or understand the sign-in freshness rules, see Manage AI Agent Access.