Imperva Cloud WAF MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| API_ID | Yes | Your Imperva Cloud WAF API ID | |
| API_KEY | Yes | Your Imperva Cloud WAF API Key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_rules_of_account_toolC | Fetches the custom rules details associated with the sites under the given account. The supported type of rules are: rate rules, security rules, forward rules, redirect rules, rewrite rules |
| get_polices_of_account_by_filter_toolC | Fetches all policies of a given account. |
| get_domains_by_filters_toolA | Fetches the domains associated with a specific site under a given account. To get a single domain details provide the domain ID, or the domain name. Use the most effective filter according to the context, for example, if you have the domain ID use it; if you have the domain name use it. If you get an empty list, it means that the domain does not exist, or you do not have access to it, avoid getting all domains and filter on your side. Terminology: CloudWAF site can have multiple domains; Domains that do not match the site name are sometimes referred to as CNAME reuse domains, alternative domains, or vanity domains. |
| get_sites_details_of_a_given_account_toolA | Fetches the list of sites for a given account. To get a single site details provide the site Id or the site name. Use the most effective filter according to the context, for example, if you have the site ID use it; if you have the site name use it; If you get an empty list, it means that the site does not exist, or you do not have access to it, avoid getting all sites and filter on your side. Terminology: The site name is not always the domain name, to get the list of domains use the domains_get_domains_of_specific_site_tool. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool targets a distinct resource (domains, policies, rules, sites) with clear descriptions, so there is no ambiguity about which tool to use for a given purpose.
Tool names are inconsistent: some use 'by_filters', others 'of_account', and one uses 'of_a_given_account'. The 'tool' suffix is unnecessary and varies in placement. Naming pattern is not uniform.
With 4 tools, the set covers the main entities (sites, domains, policies, rules) without being overly numerous or sparse for a read-only WAF information server.
Only read operations are provided; there are no create, update, or delete tools for any resource. Agents cannot manage the WAF configuration, only retrieve existing data.