cognisn/rampart repository overview

⁠Rampart

MCP server for querying and analysing Web Application Firewall (WAF) alerts across multiple providers.

⁠Overview

Rampart provides security teams with a Model Context Protocol (MCP) server that enables querying WAF alerts for a given time period and performing analysis on the observed activity. Designed for use with LLM-powered tools via stdio transport, and distributed as a Docker container.

⁠Supported Providers

• Imperva WAF — initial provider
• Additional providers planned

⁠Quick Start

⁠Prerequisites

• Docker
• Imperva Cloud WAF API credentials (API ID and API Key)
• Imperva account ID

⁠Build

docker build -t rampart .

⁠Run

docker run -i --rm \
  -e RAMPART__IMPERVA__API_ID=your-api-id \
  -e RAMPART__IMPERVA__API_KEY=your-api-key \
  -e RAMPART__IMPERVA__ACCOUNT_ID=your-account-id \
  rampart

⁠MCP Client Configuration

Example configuration for an MCP client:

- name: rampart
  transport: stdio
  command: docker
  args:
    - run
    - -i
    - --rm
    - -e
    - RAMPART__IMPERVA__API_ID=your-api-id
    - -e
    - RAMPART__IMPERVA__API_KEY=your-api-key
    - -e
    - RAMPART__IMPERVA__ACCOUNT_ID=your-account-id
    - rampart

⁠Licence

All rights reserved.