Wazuh MCP Server

@gbrigandi

About Wazuh MCP Server

MCP Server for Wazuh SIEM

#mcp #siem #wazuh #security-operations #llm #wazuh-integration #mcp-server #model-context-protocol-servers #model-context-pro

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-server-wazuh": {
      "command": "docker",
      "args": [
        "pull",
        "ghcr.io/gbrigandi/mcp-server-wazuh:latest"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Wazuh MCP Server?

A Rust-based server that bridges Wazuh SIEM data with MCP-compatible AI assistants like Claude Desktop. It transforms complex Wazuh API responses into structured security context, enabling natural language queries for alerts, agents, vulnerabilities, rules, and compliance data.

How to use Wazuh MCP Server?

Install via pre-built binary, Docker image, or build from source with Rust. Configure environment variables for Wazuh API and Indexer credentials, then point your MCP client (e.g., Claude Desktop) to the server executable or Docker container.

Key features of Wazuh MCP Server

Real-time access to security alerts and events
Agent management and health status monitoring
Vulnerability assessment for risk management
Security rules and configuration access
System statistics and performance metrics
Compliance monitoring for PCI-DSS, HIPAA, etc.

Use cases of Wazuh MCP Server

Triage and prioritize security alerts using natural language queries
Assess agent vulnerabilities and prioritize patching efforts
Investigate running processes and open ports for threat hunting
Monitor cluster health and manager performance metrics
Automate compliance reporting and gap analysis for audits

FAQ from Wazuh MCP Server

What are the requirements for running the server?

A running Wazuh server (v4.12 recommended) with API enabled, network connectivity, and an MCP-compatible LLM client like Claude Desktop.

How do I install and configure the server?

You can download a pre-built binary, pull a Docker image, or build from source with Rust. Configuration is done through environment variables for Wazuh API/Indexer host, port, and credentials.

Can I use this server with other MCP security tools?

Yes, it can be combined with Cortex MCP Server, TheHive MCP Server, and MISP MCP Server for enhanced threat intelligence, case management, and IOC enrichment.

What data sources does the server access?

It accesses data from both the Wazuh Indexer (alerts) and the Wazuh Manager (agents, rules, vulnerabilities, cluster health, logs, and statistics).

Frequently asked questions

What are the requirements for running the server?

A running Wazuh server (v4.12 recommended) with API enabled, network connectivity, and an MCP-compatible LLM client like Claude Desktop.

How do I install and configure the server?

You can download a pre-built binary, pull a Docker image, or build from source with Rust. Configuration is done through environment variables for Wazuh API/Indexer host, port, and credentials.

Can I use this server with other MCP security tools?

Yes, it can be combined with Cortex MCP Server, TheHive MCP Server, and MISP MCP Server for enhanced threat intelligence, case management, and IOC enrichment.

What data sources does the server access?

It accesses data from both the Wazuh Indexer (alerts) and the Wazuh Manager (agents, rules, vulnerabilities, cluster health, logs, and statistics).

Comments

Basic information

More Other MCP servers

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.