--- title: Salt Security Launches Industry-First AWS WAF Managed... description: Salt Security has launched what it claims is the industry's first AWS WAF managed ruleset built to protect both APIs and AI agents. Available through AWS... canonical: https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection | daily.dev og:description: Salt Security has launched what it claims is the industry's first AWS WAF managed ruleset built to protect both APIs and AI agents. Available through AWS... og:url: https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b og:image: https://api.daily.dev/og/posts/SorVSnk0B.png og:image:alt: Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 3 min read · 0 upvotes · 0 comments ## Summary Salt Security has launched what it claims is the industry's first AWS WAF managed ruleset built to protect both APIs and AI agents. Available through AWS Marketplace, the ruleset adds protections against credential brute force, excessive GraphQL queries, SSRF, prototype pollution, and JWT anomalies. A notable feature is claimed first-in-industry support for the Model Context Protocol (MCP) within AWS WAF, enabling identification and blocking of unauthenticated MCP traffic. The solution also introduces context-aware rate limiting and enriched security telemetry. It can be deployed directly from the AWS Management Console without additional infrastructure and is available across all commercial AWS regions and via Amazon CloudFront. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I add MCP (Model Context Protocol) traffic protection to AWS WAF? Salt Security offers a managed ruleset called Salt Managed Rules for AWS WAF, available through AWS Marketplace, that provides what is described as the first AWS WAF support for MCP. It identifies and labels traffic destined for MCP endpoints, blocks unauthenticated MCP access, and improves visibility into MCP interactions, and can be attached directly to existing web ACLs from the AWS Management Console. _daily.dev surfaces updates like this for teams securing AI agent and API traffic on AWS._ ### What API attacks does the Salt Security managed ruleset for AWS WAF protect against? The ruleset protects against credential brute force attacks, excessive GraphQL queries, server-side request forgery (SSRF), prototype pollution, and JWT-based anomalies. It also adds context-aware rate limiting on sensitive parameters like user IDs and email addresses to prevent enumeration attacks, and enriches telemetry by labelling authentication headers and GraphQL queries. _Track API security tooling updates like this on daily.dev when evaluating WAF protections._ ## Similar posts on daily.dev - [Salt Security adds native AI detection and response to agentic security platform](https://daily.dev/posts/salt-security-adds-native-ai-detection-and-response-to-agentic-security-platform-wwcfsbnvn) · IT Security Guru · 0 upvotes · 0 comments - [AWS WAF adds support for Amazon Bedrock AgentCore Gateway](https://daily.dev/posts/aws-waf-adds-support-for-amazon-bedrock-agentcore-gateway-bb61vowef) · AWS · 0 upvotes · 0 comments - [We tested our own WAF with frontier AI models. Here’s what we found](https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74) · Cloudflare · 0 upvotes · 0 comments - [Everyone Is Deploying AI Agents. Almost Nobody Knows What They’re Doing.](https://daily.dev/posts/everyone-is-deploying-ai-agents-almost-nobody-knows-what-they-re-doing--am8jn3ryd) · Security Boulevard · 1 upvotes · 0 comments - [Salt Security expands CrowdStrike integration to tackle AI agent security](https://daily.dev/posts/salt-security-expands-crowdstrike-integration-to-tackle-ai-agent-security-r7mtc5bzy) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp) [View this post on daily.dev](https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection","url":"https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b"},"datePublished":"2026-08-05T17:07:43.309Z","dateModified":"2026-09-14T07:05:27.034Z","description":"Salt Security has launched what it claims is the industry's first AWS WAF managed ruleset built to protect both APIs and AI agents. Available through AWS...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e2859c3d5bb88889c5c427c3691e16d4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e2859c3d5bb88889c5c427c3691e16d4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,ai-agents,mcp","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b#faq","mainEntity":[{"@type":"Question","name":"How can I add MCP (Model Context Protocol) traffic protection to AWS WAF?","acceptedAnswer":{"@type":"Answer","text":"Salt Security offers a managed ruleset called Salt Managed Rules for AWS WAF, available through AWS Marketplace, that provides what is described as the first AWS WAF support for MCP. It identifies and labels traffic destined for MCP endpoints, blocks unauthenticated MCP access, and improves visibility into MCP interactions, and can be attached directly to existing web ACLs from the AWS Management Console. daily.dev surfaces updates like this for teams securing AI agent and API traffic on AWS."}},{"@type":"Question","name":"What API attacks does the Salt Security managed ruleset for AWS WAF protect against?","acceptedAnswer":{"@type":"Answer","text":"The ruleset protects against credential brute force attacks, excessive GraphQL queries, server-side request forgery (SSRF), prototype pollution, and JWT-based anomalies. It also adds context-aware rate limiting on sensitive parameters like user IDs and email addresses to prevent enumeration attacks, and enriches telemetry by labelling authentication headers and GraphQL queries. Track API security tooling updates like this on daily.dev when evaluating WAF protections."}}]} ```