Fastly NGWAF MCP Server

Instructions

Implementation Reference

• server.js:210-213 (handler)

  Core handler function in FastlyNGWAFClient class that executes the API POST request to expire the specified event, effectively unblocking associated IPs.
  async expireEvent(corpName, siteName, eventId) { const response = await this.api.post(`/corps/${corpName}/sites/${siteName}/events/${eventId}/expire`); return response.data; }
• server.js:1018-1024 (handler)

  MCP tool call handler in the main switch statement that resolves context, validates siteName, and delegates to the client.expireEvent method.
  case 'expire_event': const { corpName: corpForExpire, siteName: siteForExpire } = resolveContext(typedArgs); if (!siteForExpire) { throw new Error('Site name is required. Please set context or provide siteName parameter.'); } result = await client.expireEvent(corpForExpire, siteForExpire, typedArgs.eventId); break;
• server.js:659-671 (schema)

  Tool schema definition including name, description, and input schema for parameters corpName, siteName, and required eventId.
  { name: 'expire_event', description: 'Manually expire an event (unblock IP)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, eventId: { type: 'string', description: 'Event ID' }, }, required: ['eventId'], }, },
• server.js:396-812 (registration)

  The tools array containing the expire_event tool definition, returned by ListToolsRequest handler for MCP tool registration/discovery.
  const tools = [ { name: 'set_credentials', description: 'Set Fastly NGWAF API credentials (email and access token)', inputSchema: { type: 'object', properties: { email: { type: 'string', description: 'Your Fastly NGWAF email address' }, token: { type: 'string', description: 'Your Fastly NGWAF API access token' }, }, required: ['email', 'token'], }, }, { name: 'test_connection', description: 'Test the API connection and validate credentials', inputSchema: { type: 'object', properties: {}, }, }, { name: 'set_context', description: 'Set the default corporation and site context for subsequent operations', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Default corporation name' }, siteName: { type: 'string', description: 'Default site name' }, }, required: ['corpName'], }, }, { name: 'get_context', description: 'Get the current context (corp and site names)', inputSchema: { type: 'object', properties: {}, }, }, { name: 'discover_environment', description: 'Discover available corporations and sites for the authenticated user', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Specific corporation to explore (optional)' }, }, }, }, { name: 'list_corps', description: 'List all corporations accessible to the authenticated user', inputSchema: { type: 'object', properties: {}, }, }, { name: 'get_corp_overview', description: 'Get attack overview for a corporation', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, from: { type: 'string', description: 'Start date (e.g., "-7d")' }, until: { type: 'string', description: 'End date (e.g., "-1d")' }, }, }, }, { name: 'list_sites', description: 'List sites in a corporation', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, query: { type: 'string', description: 'Search query to filter sites' }, page: { type: 'number', description: 'Page number' }, limit: { type: 'number', description: 'Results per page' }, }, }, }, { name: 'get_site', description: 'Get details of a specific site', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, }, }, }, { name: 'create_site', description: 'Create a new site in a corporation', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name' }, displayName: { type: 'string', description: 'Display name' }, agentLevel: { type: 'string', enum: ['block', 'log', 'off'], description: 'Agent action level' }, blockDurationSeconds: { type: 'number', description: 'Block duration in seconds' }, blockHTTPCode: { type: 'number', description: 'HTTP response code for blocked requests' }, blockRedirectURL: { type: 'string', description: 'Redirect URL for blocked requests' }, }, required: ['siteName'], }, }, { name: 'update_site', description: 'Update site configuration', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, displayName: { type: 'string', description: 'Display name' }, agentLevel: { type: 'string', enum: ['block', 'log', 'off'], description: 'Agent action level' }, blockDurationSeconds: { type: 'number', description: 'Block duration in seconds' }, blockHTTPCode: { type: 'number', description: 'HTTP response code for blocked requests' }, blockRedirectURL: { type: 'string', description: 'Redirect URL for blocked requests' }, }, }, }, { name: 'delete_site', description: 'Delete a site', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, }, }, }, { name: 'list_corp_rules', description: 'List rules at corporation level', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, type: { type: 'string', enum: ['request', 'signal'], description: 'Rule type' }, page: { type: 'number', description: 'Page number' }, limit: { type: 'number', description: 'Results per page' }, }, }, }, { name: 'list_site_rules', description: 'List rules for a specific site', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, type: { type: 'string', enum: ['request', 'signal', 'rateLimit'], description: 'Rule type' }, page: { type: 'number', description: 'Page number' }, limit: { type: 'number', description: 'Results per page' }, }, }, }, { name: 'create_corp_rule', description: 'Create a corporation-level rule', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, type: { type: 'string', enum: ['request', 'signal'], description: 'Rule type' }, enabled: { type: 'boolean', description: 'Whether rule is enabled' }, groupOperator: { type: 'string', enum: ['all', 'any'], description: 'Condition group operator' }, conditions: { type: 'array', description: 'Rule conditions' }, actions: { type: 'array', description: 'Rule actions' }, reason: { type: 'string', description: 'Description of the rule' }, signal: { type: 'string', description: 'Signal ID for exclusion rules' }, corpScope: { type: 'string', enum: ['global', 'specificSites'], description: 'Rule scope' }, siteNames: { type: 'array', items: { type: 'string' }, description: 'Site names for specific scope' }, }, required: ['type', 'groupOperator', 'conditions', 'actions'], }, }, { name: 'create_site_rule', description: 'Create a site-level rule', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, type: { type: 'string', enum: ['request', 'signal', 'rateLimit'], description: 'Rule type' }, enabled: { type: 'boolean', description: 'Whether rule is enabled' }, groupOperator: { type: 'string', enum: ['all', 'any'], description: 'Condition group operator' }, conditions: { type: 'array', description: 'Rule conditions' }, actions: { type: 'array', description: 'Rule actions' }, reason: { type: 'string', description: 'Description of the rule' }, signal: { type: 'string', description: 'Signal ID for exclusion/rate limit rules' }, thresholdCount: { type: 'number', description: 'Threshold count for rate limit rules' }, thresholdInterval: { type: 'number', description: 'Threshold interval for rate limit rules' }, blockDurationSeconds: { type: 'number', description: 'Block duration for rate limit rules' }, }, required: ['type', 'groupOperator', 'conditions', 'actions'], }, }, { name: 'delete_corp_rule', description: 'Delete a corporation-level rule', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, ruleId: { type: 'string', description: 'Rule ID to delete' }, }, required: ['ruleId'], }, }, { name: 'delete_site_rule', description: 'Delete a site-level rule', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, ruleId: { type: 'string', description: 'Rule ID to delete' }, }, required: ['ruleId'], }, }, { name: 'search_requests', description: 'Search requests with advanced filtering', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, query: { type: 'string', description: 'Search query (e.g., "tag:SQLI")' }, page: { type: 'number', description: 'Page number' }, limit: { type: 'number', description: 'Results per page' }, }, }, }, { name: 'list_events', description: 'List security events (attacks, blocks, etc.)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, from: { type: 'number', description: 'Unix timestamp start' }, until: { type: 'number', description: 'Unix timestamp end' }, action: { type: 'string', enum: ['flagged', 'info'], description: 'Filter by action' }, tag: { type: 'string', description: 'Filter by tag' }, ip: { type: 'string', description: 'Filter by IP address' }, }, }, }, { name: 'expire_event', description: 'Manually expire an event (unblock IP)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, eventId: { type: 'string', description: 'Event ID' }, }, required: ['eventId'], }, }, { name: 'get_suspicious_ips', description: 'Get list of suspicious IP addresses', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, limit: { type: 'number', description: 'Maximum number of IPs to return' }, }, }, }, { name: 'manage_whitelist', description: 'Manage IP whitelist (allowlist)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, action: { type: 'string', enum: ['list', 'add', 'remove'], description: 'Action to perform' }, ip: { type: 'string', description: 'IP address (for add action)' }, note: { type: 'string', description: 'Note for IP (for add action)' }, expires: { type: 'string', description: 'Expiration date (RFC3339 format)' }, entryId: { type: 'string', description: 'Entry ID (for remove action)' }, }, required: ['action'], }, }, { name: 'manage_blacklist', description: 'Manage IP blacklist (blocklist)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, action: { type: 'string', enum: ['list', 'add', 'remove'], description: 'Action to perform' }, ip: { type: 'string', description: 'IP address (for add action)' }, note: { type: 'string', description: 'Note for IP (for add action)' }, expires: { type: 'string', description: 'Expiration date (RFC3339 format)' }, entryId: { type: 'string', description: 'Entry ID (for remove action)' }, }, required: ['action'], }, }, { name: 'manage_lists', description: 'Manage custom lists (IP, country, string, etc.)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (optional for corp-level lists, uses context default if not provided)' }, action: { type: 'string', enum: ['list', 'create', 'update', 'delete'], description: 'Action to perform' }, listId: { type: 'string', description: 'List ID (for update/delete actions)' }, name: { type: 'string', description: 'List name (for create action)' }, type: { type: 'string', enum: ['ip', 'country', 'string', 'wildcard', 'signal'], description: 'List type' }, description: { type: 'string', description: 'List description' }, entries: { type: 'array', items: { type: 'string' }, description: 'List entries' }, additions: { type: 'array', items: { type: 'string' }, description: 'Entries to add (for update)' }, deletions: { type: 'array', items: { type: 'string' }, description: 'Entries to remove (for update)' }, }, required: ['action'], }, }, { name: 'manage_alerts', description: 'Manage alerts for monitoring attack patterns', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, action: { type: 'string', enum: ['list', 'create', 'update', 'delete'], description: 'Action to perform' }, alertId: { type: 'string', description: 'Alert ID (for update/delete actions)' }, tagName: { type: 'string', description: 'Tag name to monitor' }, longName: { type: 'string', description: 'Alert description' }, interval: { type: 'number', enum: [1, 10, 60], description: 'Time interval in minutes' }, threshold: { type: 'number', description: 'Threshold count' }, enabled: { type: 'boolean', description: 'Whether alert is enabled' }, action_type: { type: 'string', enum: ['info', 'flagged'], description: 'Action when triggered' }, }, required: ['action'], }, }, { name: 'get_analytics', description: 'Get analytics data (top attacks, timeseries, etc.)', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, siteName: { type: 'string', description: 'Site name (uses context default if not provided)' }, type: { type: 'string', enum: ['top_attacks', 'timeseries'], description: 'Analytics type' }, from: { type: 'number', description: 'Unix timestamp start' }, until: { type: 'number', description: 'Unix timestamp end' }, groupBy: { type: 'string', enum: ['remoteCountryCode', 'remoteIP', 'path', 'userAgent'], description: 'Group by field (for top attacks)' }, tags: { type: 'string', description: 'Filter by tags (for timeseries)' }, rollup: { type: 'number', description: 'Rollup interval in seconds (for timeseries)' }, limit: { type: 'number', description: 'Maximum results' }, }, required: ['type'], }, }, { name: 'manage_cloudwaf', description: 'Manage CloudWAF instances', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, action: { type: 'string', enum: ['list', 'create', 'get', 'update', 'delete'], description: 'Action to perform' }, deploymentId: { type: 'string', description: 'Deployment ID (for get/update/delete)' }, name: { type: 'string', description: 'Instance name' }, description: { type: 'string', description: 'Instance description' }, region: { type: 'string', description: 'AWS region' }, tlsMinVersion: { type: 'string', enum: ['1.0', '1.2'], description: 'Minimum TLS version' }, siteName: { type: 'string', description: 'Site name for configuration' }, domains: { type: 'array', items: { type: 'string' }, description: 'Domains to protect' }, origin: { type: 'string', description: 'Origin server URL' }, }, required: ['action'], }, }, { name: 'manage_users', description: 'Manage corporation users', inputSchema: { type: 'object', properties: { corpName: { type: 'string', description: 'Corporation name (uses context default if not provided)' }, action: { type: 'string', enum: ['list', 'get', 'update', 'invite', 'delete'], description: 'Action to perform' }, userEmail: { type: 'string', description: 'User email address' }, role: { type: 'string', enum: ['owner', 'admin', 'user', 'observer'], description: 'User role' }, memberships: { type: 'array', description: 'Site memberships' }, }, required: ['action'], }, }, ];
• server.js:387-394 (helper)

  Helper function used in expire_event handler to resolve corpName and siteName from args or context.
  function resolveContext(args) { const corpName = args.corpName || context.defaultCorpName; const siteName = args.siteName || context.defaultSiteName; if (!corpName) { throw new Error('Corporation name is required. Please set context or provide corpName parameter.'); } return { corpName, siteName }; }