Your WAFPass data,
inside any MCP host.
WAF++ MCP Bridge exposes the WAFPass REST API as Model Context Protocol tools for AI assistants. Ask Claude to list runs, inspect findings, or explore compliance data — all through the same SSO session and role-based permissions you already trust.
A secure bridge, not a second auth system.
The bridge re-uses WAFPass identity, permissions and audit trails. It validates, proxies, and filters — never stores cloud secrets or IdP passwords.
No direct Keycloak, Entra or Okta integration. The bridge trusts tokens issued by wafpass-server, which already handles OIDC and SAML flows.
Every new SSE connection is validated against GET /auth/me. Instant revocation detection and no JWT secret sharing required.
tools/list is filtered by the authenticated user's role. Admin-only endpoints stay invisible to engineers, and row-level auth applies on every backend call.
The original Authorization: Bearer header is forwarded to WAFPass on every proxied request, preserving user identity and audit attribution.
At startup the bridge fetches /openapi.json and registers safe operations as typed MCP tools with Pydantic-validated arguments.
Run the bridge as a local stdio process for Claude Desktop, or expose it over HTTP/SSE for remote MCP hosts and browser-based clients.
Connect Claude Desktop in minutes.
Install the bridge, log in once, and point Claude Desktop at the stdio command. No certificates, no open ports, no extra auth.
git clone https://github.com/WAF2p/wafpass-mcp.git
cd wafpass-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
wafpass-mcp-configure
# Enter WAFpass API URL, username and password{
"mcpServers": {
"wafpass": {
"command": "/path/to/wafpass-mcp/.venv/bin/wafpass-mcp-stdio"
}
}
}# From the WAF++ repository root
docker compose up -d wafpass-mcp
# SSE endpoint: http://localhost:3001/sse
# Override WAFPASS_TOKEN_MODE or WAFPASS_JWT_SECRET in .envHow the bridge fits in.
The user authenticates through the upstream IdP, exchanges tokens with WAFPass, then brings the same Bearer token to the MCP host. The bridge proxies requests and filters tools by role.
| Variable | Default | Description |
|---|---|---|
WAFPASS_API_BASE_URL | http://localhost:8000 | Upstream WAFpass API. |
WAFPASS_TOKEN_MODE | introspection | introspection or jwt_secret for local HS256. |
WAFPASS_JWT_SECRET | — | Required for jwt_secret mode; must match backend. |
WAFPASS_ACCESS_TOKEN | — | WAF++ token for stdio mode; optional if stored by configure helper. |
WAFPASS_REFRESH_TOKEN | — | Refresh token for automatic access-token refresh in stdio mode. |
WAFPASS_REFRESH_THRESHOLD_SECONDS | 300 | Refresh access token if it expires within this many seconds. |
MCP_HOST | 0.0.0.0 | Bridge bind host in HTTP/SSE mode. |
MCP_PORT | 3001 | Bridge bind port in HTTP/SSE mode. |
LOG_LEVEL | INFO | Logging level. |
Let AI assistants work with your compliance data.
Install the bridge from PyPI or GitHub, connect it to Claude Desktop, and start asking natural-language questions about runs, findings and controls.