# Wallarm MCP for AI Agents AI Agent Connect > Wallarm MCP connects your API security platform to your AI agent. It lets you monitor active attacks, search for malicious payloads, and manage your WAF rules through a chat interface. Use it to triage vulnerabilities, audit your API inventory, and block malicious IPs instantly without digging through complex security consoles. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_wtqoTiRGf7f9vV5ladmPTVkzskQH77LY6DMZ7ltz/ai-agent-connect - **Tags:** api-security, waf, threat-detection, forensics, sql-injection, xss-protection, cybersecurity ## Description Managing API security usually means jumping between different tabs, squinting at logs, and trying to figure out if a specific hit is a real threat or just a false positive. This Connector changes that by bringing your Wallarm data directly into your AI client. Instead of manual hunting, you can just ask your agent to find every SQL injection attempt from the last hour or check the status of your filtering nodes. You can see the full payload of a blocked request to understand exactly what an attacker was trying to do. It handles the heavy lifting of data retrieval so you can focus on fixing the actual problems. Whether you're triaging a new vulnerability or updating your IP allowlist, you're doing it all in one place. It's a lot easier to stay ahead of threats when your security data is actually conversational. You can find this and thousands of other tools in the Vinkius catalog to build out your security stack. If you're tired of the click and wait cycle of traditional security consoles, this is the shortcut. You can move from detection to remediation in a single conversation. This isn't about replacing your security stack; it's about making your existing data actionable. Instead of digging through thousands of lines of raw logs, you get a summarized view of what matters most. You can audit your entire API surface, identify gaps, and enforce rules without ever having to learn a new proprietary dashboard UI. It makes your security posture feel like a conversation rather than a chore. ## Tools ### get_vulnerability_details Pull diagnostic data and exploit evidence for a specific vulnerability ID. This helps you understand exactly how a flaw was triggered. ### list_ip_acl_rules See all your current allowlist and denylist rules in one list. This is great for auditing your current network access controls. ### search_security_attacks Find attacks grouped by type like SQLi or XSS. This makes it easy to see the scope of a broader campaign. ### search_security_hits View full request headers and payloads for blocked traffic. This lets you see the exact data an attacker tried to send. ### search_vulnerabilities List all open security flaws found in your live API traffic. This is your starting point for triage and remediation. ### update_vulnerability_status Mark a vulnerability as closed, open, or a false positive. This helps you keep your security backlog clean and accurate. ### create_ip_acl_rule Add an IP or CIDR range to your global allowlist or denylist. This helps you block bad actors or let in trusted partners quickly. ### get_discovered_api_inventory See every endpoint your WAF has found through passive traffic analysis. This helps you find shadow APIs you didn't know existed. ### get_client_info Get a quick look at your Wallarm account status and subscription details. Use this to check your current feature access. ### list_filtering_nodes Check the status of your deployed WAF and API gateway nodes. Use this to ensure your security edge is actually online. ## Prompt Examples **Prompt:** ``` What's the biggest threat hitting our API right now? ``` **Response:** ``` I've analyzed the recent traffic and identified a high-volume **SQL Injection** campaign targeting your `/api/v1/login` endpoint. **Summary of Attacks:** | Attack Type | Count | Target Endpoint | Severity | | :--- | :--- | :--- | :--- | | SQLi | 42 | `/api/v1/login` | Critical | | XSS | 12 | `/api/v1/search` | Medium | I can pull the specific payloads for these hits if you'd like to see the exact strings they're using. ``` **Prompt:** ``` Block the IP 192.168.1.50 because it's spamming our login. ``` **Response:** ``` Done. I've added **192.168.1.50** to your global denylist. All traffic from this source will now be blocked by your filtering nodes. Would you like me to check if there are other IPs from the same subnet showing similar behavior? ``` **Prompt:** ``` Show me the inventory of our production APIs. ``` **Response:** ``` Here is the current inventory of APIs discovered by the WAF: * **Auth Service**: `/api/v1/auth`, `/api/v1/login` (GET, POST) * **User Profile**: `/api/v1/user/{id}` (GET, PUT) * **Order History**: `/api/v1/orders` (GET) * **Product Catalog**: `/api/v1/products` (GET) I noticed a few endpoints in the **Order History** group that aren't listed in your standard documentation. Should I look into those further? ``` ## Capabilities ### Monitor active security attacks Get real-time updates on attacks grouped by vector like SQLi and XSS. ### Search for malicious payloads View the exact headers and request bodies for blocked traffic. ### Triage API vulnerabilities List and manage security flaws discovered in your live traffic. ### Audit API inventory See all exposed endpoints and methods discovered by the WAF. ### Manage IP rules Add or remove IPs from your global allowlist and denylist via chat. ### Check WAF node health Verify the heartbeat and status of your deployed filtering nodes. ## Use Cases ### Rapid Incident Response A SOC analyst sees a spike in traffic and asks the agent to use `search_security_attacks` to identify the primary attack vector. ### Shadow API Discovery A developer asks for the `get_discovered_api_inventory` to see if any new endpoints were exposed during a last night's deploy. ### Instant IP Blocking An engineer spots a brute force attack and tells the agent to use `create_ip_acl_rule` to block the source IP immediately. ### Vulnerability Triage A DevSecOps lead asks for `get_vulnerability_details` on a specific flaw to see the exploit evidence before assigning it to a developer. ## Benefits - Stop manual log digging by using `search_security_hits` to see exact payloads in seconds. This lets you see the raw data an attacker sent without having to navigate through complex filtering menus or export logs to a spreadsheet. - Triage threats faster by using `search_vulnerabilities` to group and prioritize open flaws. You can see the scope of an attack and the specific CWE mappings immediately, which helps you decide what to fix first. - Secure your perimeter instantly with `create_ip_acl_rule` to block bad IPs from your chat. You can react to a brute force attack in real time by telling your agent to add a specific CIDR range to your denylist. - Find hidden shadow APIs by checking your `get_discovered_api_inventory` regularly. This ensures you have visibility into every endpoint your WAF has found, helping you close gaps before attackers find them. - Keep your security backlog clean by using `update_vulnerability_status` to mark false positives. This keeps your team focused on real threats by allowing you to move issues out of your active triage list with a single command. - Verify your infrastructure health by checking `list_filtering_nodes` with a simple command. You can quickly confirm that your WAF and API gateway nodes are online and active across your entire global network. ## How It Works The bottom line is you turn your AI agent into a functional SOC analyst that can query and act on your Wallarm security data. 1. Subscribe to the Wallarm MCP on Vinkius. 2. Provide your Wallarm API Token and Client ID in the connection settings. 3. Ask your AI agent to list attacks, block IPs, or check your API inventory. ## Frequently Asked Questions **Can the Wallarm MCP block IPs automatically?** Yes, you can tell your agent to add a specific IP to your denylist using the `create_ip_acl_rule` tool. This lets you stop attacks as they happen without leaving your chat. **How does Wallarm find shadow APIs?** It uses passive traffic analysis to see which endpoints are actually being hit. You can see these by asking your agent to pull the `get_discovered_api_inventory`. **Can I see the actual data an attacker sent?** Yes, you can use `search_security_hits` to view the full request headers and payloads. This is vital for understanding the intent behind a blocked request. **Is this Connector good for SOC analysts?** It's built for it. It lets analysts query attack vectors and triage vulnerabilities much faster than clicking through a web console. **How do I manage my vulnerability backlog?** You can use the `update_vulnerability_status` tool to mark issues as closed or false positives. This keeps your security dashboard clean and focused on real problems. **Can I check if my WAF nodes are up?** Yes, you can ask your agent to list your filtering nodes. It will show you the heartbeat status of your deployed security edge. **Can I block a malicious IP address directly from my agent?** Yes. Using the `create_ip_acl_rule` tool, you can immediately add an IP or CIDR range to your global denylist (black list) to mitigate threats as soon as they are identified during your security audit. **How can I see all the API endpoints Wallarm has discovered?** The `get_discovered_api_inventory` tool provides you with the full API inventory automatically discovered through passive traffic analysis, showing exposed endpoints, methods, and parameters without requiring manual specifications. **Is it possible to triage vulnerabilities and change their status via chat?** Absolutely. You can use `update_vulnerability_status` to change a vulnerability's lifecycle status (e.g., to closed or false positive) once you have investigated it or applied remediation steps.