Answer First
AWS announced Salt Managed Rules for AWS WAF on August 6, 2026. It is a third-party AWS Marketplace managed rule group, not a new universal AWS WAF guarantee. The launch record says it can detect and mitigate named API attacks, identify and label MCP traffic, block unauthenticated MCP access, add MCP observability, and rate-limit selected request parameters.
Use it as one inspected layer in front of covered HTTP endpoints. Keep identity validation, tenant isolation, tool authorization, argument validation, prompt-injection controls, sensitive-action approval, and downstream permissions separate.
What the Rule Group Adds
AWS lists coverage for:
- credential brute force;
- excessive GraphQL queries;
- server-side request forgery patterns;
- prototype pollution;
- JSON Web Token anomalies;
- unauthenticated access to identified MCP endpoints;
- rate limiting tied to sensitive parameters such as user identifiers and email addresses;
- request labels that support AWS WAF observability and downstream analysis.
The AWS announcement says the rule group supports versioning. Salt sets its Marketplace price. Region support must be checked against the current Marketplace and AWS regional surfaces.
What It Does Not Establish
| Boundary | Why another control is needed |
|---|---|
| Web ACL coverage | Traffic that bypasses or never reaches the protected resource is outside that inspection path |
| Authentication | A header’s presence is not proof that the credential is valid, unexpired, intended for this audience, or correctly bound |
| Authorization | An authenticated caller may still lack permission for a tool, resource, tenant, or argument |
| Agent intent | Network rules do not prove that a prompt or tool plan is safe or user-approved |
| Output safety | A permitted MCP call can return sensitive, poisoned, or untrusted data |
| Incident response | A label or block requires ownership, alert routing, investigation context, and retention |
An MCP server also needs least-privilege tool scopes, schema validation, output handling, explicit approval for consequential actions, and an auditable caller-to-action chain.
A Safe Rollout Sequence
1. Inventory the real traffic path
Map public and private hosts, CloudFront or load balancer paths, API stages, MCP routes and methods, authentication schemes, streaming behavior, health checks, clients, and alternate endpoints. Prove which requests traverse the target web ACL.
2. Inspect the current Marketplace contract
Record vendor, product, subscription, Regions, price, capacity use, rule names, default actions, labels, versions, support, and data path. “Managed” does not remove procurement or change-management responsibility.
3. Establish observability first
Send scoped AWS WAF logs and metrics to an approved destination. Confirm what request fields, labels, identifiers, or sampled bodies are retained and redacted. Access to security telemetry should be narrower than access to ordinary application metrics.
4. Replay legitimate and adversarial requests
Test valid MCP initialization and tool calls, expired or missing credentials, alternate authentication formats, batched GraphQL, enumeration patterns, SSRF-like inputs, large bodies, streaming, retries, and non-MCP API traffic. Include partner clients and mobile or browser variations.
5. Define exceptions and ownership
Every exception needs an owner, exact scope, reason, expiry, monitoring, and removal test. Avoid broad path or IP allowlists that silently disable the protection layer.
6. Promote gradually
Use the current AWS WAF override and staging mechanisms to observe before broad blocking where appropriate. Promote one protected surface at a time, measure false blocks and missed attacks, and keep an explicit rollback path.
Version and Change Control
A managed rule group can change independently of application code. Record the evaluated version and current version behavior, then decide whether updates are pinned, scheduled, or automatically adopted under the current product contract. Re-run the traffic suite after every material rule or application change.
The minimum evidence packet should include:
- Marketplace subscription and version;
- web ACL and covered resources;
- rule actions and overrides;
- test corpus and results;
- logging and redaction configuration;
- exceptions with expiry;
- dashboards, alerts, owner, and rollback steps;
- full monthly cost.
Use the AWS WAF MCP threat-detection readiness tool to turn those facts into an evaluation plan.
Frequently Asked Questions
What are Salt Managed Rules for AWS WAF?
They are a third-party Salt Security managed rule group sold through AWS Marketplace for API and AI-agent traffic. AWS says the group detects and mitigates listed API attacks, labels MCP interactions, blocks unauthenticated MCP access, and rate-limits selected sensitive parameters.
Does the Salt rule group protect every MCP server?
No. AWS WAF evaluates traffic that reaches a protected resource through the associated web ACL. Uncovered endpoints, internal paths, alternate hosts, non-HTTP transports, and downstream tool authorization require separate controls.
Can I attach the rule group directly to production?
AWS says subscription and attachment require no additional custom-rule configuration, but production teams should still inspect the current rule actions, test representative and adversarial traffic, review logs, define exceptions, choose a version policy, and exercise rollback before enforcing broadly.
Who sets the Salt managed rule group price?
AWS’s August 6, 2026 announcement says Salt Security sets pricing through AWS Marketplace. Include AWS WAF, logging, storage, analytics, incident response, and operational review in the full cost.
Does blocking unauthenticated MCP access replace authorization?
No. Detecting a missing recognized authentication header does not prove identity, token validity, tenant scope, tool permission, argument safety, or approval for a sensitive action. Enforce those controls in the MCP gateway, server, and downstream systems.