waf mcp-security policy

Use this command to group rules and enable the primary inspection engines (Signature Detection, Poisoning Attack Protection, and JSON Schema Validation).

config waf mcp-security policy

edit <mcp-security_policy_name>

set signature-detection {enable|disable}

set poisoning-attack-scan {enable|disable}

set json-schema-validation {enable|disable}

config rule-list

edit <rule-list_id>

set rule <rule_name>

next

end

next

end

Variable	Description	Default
<mcp-security_policy_name>	Enter a unique name for the policy that can be referenced by other parts of the configuration.	No default.
signature-detection {enable|disable}	Enable to prevent attacks on the MCP server, such as injection or command execution. FortiWeb evaluates MCP fields including methods, tool names, and argument values for indicators of unsafe behavior.	disable
poisoning-attack-scan {enable|disable}	Enable to prevent adversarial attempts to manipulate LLM behavior or steal sensitive information. This scans tool descriptions, tool parameters, and prompt content.	disable
json-schema-validation {enable|disable}	Enable to ensure each streamed MCP message meets the official specification provided by FortiGuard based on the MCP version.	disable
config rule-list
<rule-list_id>	Enter the sequence number of the rule in the rule list.	No default.
rule <rule_name>	Select the created MCP Security Rule name.	No default.

Related topics

waf mcp-security rule

waf mcp-security exception