A WAF That Reads the Prompt: OWASP CRS for LLM and MCP

A conventional web application firewall typically examines a URL, headers, and possibly a form body. However, for agent traffic, the actual content of interest lies within the request body, which includes the prompt for an LLM call, and the method, tool name, and arguments for an MCP call. Solo Enterprise for agentgateway utilizes Coraza, the OWASP-maintained rules engine, as a shared extension.

By enabling body inspection, the OWASP Core Rule Set (CRS) that the security team is familiar with can apply to prompts and tool calls, while the SOC can add its own signatures in SecLang without making any changes to the agent, model, or MCP server. The policies are located in the themsquared/agentic-demo under manifests/governance/.

To enable body inspection, two settings are required. Skipping either one results in a WAF that passes every payload while still looking healthy. The first setting configures the WAF to buffer the body, allowing for inspection and analysis. The second setting defines the core ruleset, specifying actions to take when certain conditions are met, such as denying and logging specific types of requests.

Custom signatures for AI-specific cases are added alongside the CRS. These custom rules are designed to detect and block malicious prompts, such as instruction overrides, jailbreak attempts, and system-prompt exfiltration attempts. They are placed within a designated range of rule IDs reserved for AI-related signatures.

Attaching the WAFPolicy to a route is a separate resource, which means a single WAFPolicy can be reused across multiple routes. This allows for consistency in security enforcement across different endpoints. When a request is made to an LLM route, the firewall will inspect the request, enforce the configured policies, and return an appropriate response if any policy is violated.

The response will be a standard HTTP 403 status code, indicating a policy violation, but the detailed reason for the blockage will be logged in the audit log, rather than being included in the response body to prevent potential exploitation by attackers.