Integration

Imperva Cloud WAF integration

Imperva Cloud WAF, formerly Incapsula, site protection API: list protected sites and read their onboarding and protection status, add or remove a site, tune the threat protection settings and access control lists that decide what is blocked, manage custom rules, control caching and purge the cache, list the origin data centres behind a site, and read traffic and security reports. Every operation is a form encoded POST and every failure arrives with a success status code, so the result code in the body is what decides whether a call worked. Requests authenticate with an API identifier and an API key sent as headers.

Connect Imperva Cloud WAF How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Imperva Cloud WAF.Built from the 16 Imperva Cloud WAF tools below, on the connection you add once.

Common Imperva Cloud WAF use cases

removing a domain that has been decommissioned
blocking the addresses seen in an ongoing attack
removing a temporary rule added during an incident
turning caching up to shield an origin that is under load
renaming or retagging a site during a configuration review
finding the custom rule responsible for an unexpected block
confirming which origin a protected site forwards traffic to
clearing stale content after deploying a new version of a site
measuring how much traffic a new blocking rule actually stopped
auditing which domains are protected by the web application firewall

What you can do with Imperva Cloud WAF

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Site, 5 operations

add_siteAdd sitePOSTOnboards a domain into Imperva Cloud WAF and returns the site identifier and the records needed to route traffic.
configure_siteConfigure sitePOSTChanges a single general Imperva site setting, one name and value at a time.
delete_siteDelete sitePOSTRemoves a site from Imperva Cloud WAF so it is no longer protected.
get_site_statusGet site statusPOSTReturns the onboarding and protection status of one Imperva protected site.
list_sitesList sitesPOSTReturns the sites protected by Imperva Cloud WAF, with paging.

Rule, 4 operations

add_incap_ruleAdd incap rulePOSTCreates a custom Imperva rule that acts on requests matching a filter expression.
delete_incap_ruleDelete incap rulePOSTRemoves a custom Imperva rule from a site.
edit_incap_ruleEdit incap rulePOSTChanges the name, action, filter or enabled state of a custom Imperva rule.
list_incap_rulesList incap rulesPOSTReturns the custom Imperva rules that run in addition to the built in threat protection.

Account, 1 operation

get_accountGet accountPOSTReturns the Imperva account the credentials belong to, which is how you confirm they work.

Acl, 1 operation

configure_site_aclConfigure site aclPOSTReplaces an Imperva allow or block list of countries, addresses or paths on a site.

Cache, 1 operation

purge_cachePurge cachePOSTClears Imperva cached content for a site, either everything or only what matches a pattern.

Cache setting, 1 operation

set_cache_modeSet cache modePOSTChanges how aggressively Imperva caches responses for a site.

Data center, 1 operation

list_data_centersList data centersPOSTReturns the origin servers and data centres Imperva forwards traffic to for a site.

Report, 1 operation

get_site_reportGet site reportPOSTReturns Imperva traffic and security report data for a site over a time range.

Security setting, 1 operation

configure_site_securityConfigure site securityPOSTChanges what Imperva does when a built in threat protection rule matches, for example alerting versus blocking.

Use Imperva Cloud WAF from Claude Code, Cursor or Codex

Connect Imperva Cloud WAF in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Imperva Cloud WAF operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Imperva Cloud WAF

Create your workspace
Sign up free. Nothing to install.
Connect Imperva Cloud WAF once
Add your Imperva Cloud WAF connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Imperva Cloud WAF integration FAQ

What can you do with the Imperva Cloud WAF integration?

LiveContext exposes 16 operations on Imperva Cloud WAF, covering site, rule, account and acl. Common uses include removing a domain that has been decommissioned, blocking the addresses seen in an ongoing attack and removing a temporary rule added during an incident.