waf mcp-security exception

Use this command to create exceptions that allow specific tool names or prompt functions to bypass security scanning.

config waf mcp-security exception

edit <mcp-security_exception_name>

config exception-list

edit <exception-list_id>

set exception-type {plain|regular}

set exception-value <string>

set mcp-primitive-type {toolfuncname|promptfuncname}

next

end

next

end

Variable	Description	Default
<mcp-security_exception_name>	Enter a unique name for the exception.	No default.
config exception-list
<exception-list_id>	Enter the sequence number of the exception in the exception list.	No default.
exception-type {plain|regular}	Select whether the value is a Simple String or a Regular Expression. plain — simple string regular — regular expression	plain
exception-value <string>	Enter the specific string or pattern to be excluded from security scanning (for example, the name of a specific tool or prompt function).	No default.
mcp-primitive-type {toolfuncname|promptfuncname}	Select the specific field to which the exception applies. Options include: toolfuncname — This matches the tool name found in the tool->params->arguments->key field. promptfuncname — This matches the name of a specific prompt function within the MCP payload.	No default.

Related topics

waf mcp-security rule

waf mcp-security policy