Overview

SafeLine MCP Server implements the Model Context Protocol (MCP) to provide centralized management and control for SafeLine Web Application Firewalls (WAF). It exposes an MCP-compatible API surface that lets operators and automation systems configure WAF instances, push policies, query logs and attack events, and orchestrate deployments across multiple SafeLine deployments.

By acting as a management layer between orchestration tools (or AI agents) and SafeLine WAFs, the MCP server helps teams automate repetitive tasks such as rule creation, blacklist/whitelist management, captcha challenges, and incident-driven responses. The result is consistent policy enforcement, faster incident response, and simplified integration with CI/CD or SOAR workflows.

Features

Full MCP (Model Context Protocol) server implementation for SafeLine WAF control
API-driven management of SafeLine instances: create applications, rules, and policies
Tools for rule lifecycle: blacklist, whitelist, captcha and brute-force mitigation
Query and analyze attack events and logs for incident investigation
Flexible configuration through config files and environment variables
Container-first deployment with Docker and docker-compose manifests
Secure communication with SafeLine API (token-based) and optional SSE secret for event streaming
Simple extension model for adding custom tools and APIs in Go

Installation / Configuration

Prerequisites:

Docker (recommended) or Go 1.21+ to run from source
SafeLine API token and SafeLine API address (from your SafeLine console)

Environment variables (can be set in docker-compose or host env):

Variable	Description	Default	Required
LISTEN_PORT	Port for MCP server to listen on	5678	No
LISTEN_ADDRESS	Bind address for server	0.0.0.0	No
SAFELINE_SECRET	Secret used for SSE/event signing (optional)	-	No
SAFELINE_ADDRESS	Base URL of your SafeLine API	-	Yes
SAFELINE_API_TOKEN	API token to authenticate to SafeLine	-	Yes

Quick Docker run:

docker run -d \
  --name safeline-mcp \
  -p 5678:5678 \
  -e SAFELINE_API_TOKEN="your_api_token" \
  -e SAFELINE_ADDRESS="https://your.safeline.com" \
  chaitin/safeline-mcp:latest

Example docker-compose service:

version: '3.8'
services:
  mcp:
    image: chaitin/safeline-mcp:latest
    container_name: safeline-mcp
    ports:
      - "5678:5678"
    environment:
      SAFELINE_API_TOKEN: "your_api_token"
      SAFELINE_ADDRESS: "https://your.safeline.com"
      LISTEN_PORT: "5678"
      LISTEN_ADDRESS: "0.0.0.0"

Run from source (Go):

git clone https://github.com/chaitin/SafeLine.git
cd safeline-mcp
go mod download
cp config.yaml.example config.yaml    # adjust values (SafeLine address/token)
go run main.go

API docs and swagger UI (if deployed): https://demo.waf.chaitin.com:9443/swagger/index.html

Available Tools / Resources

Provided tools expose common management tasks via MCP endpoints. Notable tools include:

create_application — Register a new application in SafeLine and associate WAF configuration.
create_blacklist_rule — Add a blacklist rule to block specific IPs/UA/paths.
create_whitelist_rule — Allowlist trusted sources or endpoints.
get_attack_events — Retrieve recent attack events and metadata for triage.

Resources:

Repository: https://github.com/chaitin/SafeLine/tree/main/mcp_server
MCP spec: https://modelcontextprotocol.io/introduction
API docs: Swagger link (if accessible in your deployment)

Use Cases (concrete examples)

Centralized policy rollout: Push a new rate-limit and blacklist rule to 20 SafeLine WAF instances via automation that calls the MCP server, ensuring consistent protection across environments.
Incident response: On detection of a credential stuffing campaign, call get_attack_events to pull IPs and user agents, then create_blacklist_rule and deploy an aggressive captcha policy to affected applications.
CI/CD gates: Integrate the MCP server into a CI pipeline so that application deployment automatically creates or updates the SafeLine application configuration and associated WAF rules.
AI-based defense: Use the MCP server as a control plane for ML/AI agents that analyze logs, generate corrective rules (e.g., temporary blocklists), and apply them programmatically.

Extending and Development

The project is implemented in Go. Extension points are straightforward:

Add a new tool: create a file under internal/tools// with a Tool struct, parameter and result types, Validate and Execute methods.
Add an API wrapper: implement API calls under internal/api// to interact with the SafeLine backend.
Register tools centrally in internal/tools/init.go so they are discovered by the MCP server.

Minimal tool skeleton:

package app

type ToolName struct{}

type ToolParams struct {
    Param1 string `json:"param1" required:"true"`
}

type ToolResult struct {
    ID string `json:"id"`
}

func (t *ToolName) Name() string { return "tool_name" }
func (t *ToolName) Description() string { return "..." }
func (t *ToolName) Validate(p ToolParams) error { return nil }
func (t *ToolName) Execute(ctx context.Context, p ToolParams) (ToolResult, error) {
    // implementation
}

Operational notes:

Treat SAFELINE_API_TOKEN as a secret — use secret stores or container orchestration secrets.
Secure network paths to the SafeLine API and enable TLS.
Monitor logs and metrics for the MCP server itself to ensure reliable deployments and to audit changes.

For API changes or feature requests, open an Issue in the repository and reference your use case and environment.

Tags:api gateway api-gateway application security application-security appsec blueteam bruteforce captcha cve cybersecurity database firewall hackers http flood http-flood

SafeLine MCP Server for WAF Management and Control