Wazuh MCP Server

@unmuktoai

リポジトリホームページ

基本情報

カテゴリ

開発者ツール

ライセンス

MIT

トランスポート

stdio

作者

unmuktoai

Wazuh MCP Server について

AI-powered security operations for Wazuh SIEM—use any MCP-compatible client to ask security questions in plain English. Faster threat detection, incident triage, and compliance checks with real-time monitoring and anomaly spotting. Production-ready MCP server for conversational S

#python #ai #mcp #wazuh #claude #claude-ai #genai #wazuh-integration #model-context-protocol #mcp-server #model-context-protocol-servers #mcpserver

Wazuh MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "Wazuh-MCP-Server": {
      "command": "docker",
      "args": [
        "compose",
        "up",
        "-d"
      ]
    }
  }
}

Wazuh MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Wazuh MCP Server?

A Model Context Protocol server that turns Wazuh SIEM workflows into natural conversation with any AI assistant. It provides 54 security tools for querying alerts, hunting threats, checking vulnerabilities, triggering active responses, and running compliance checks — through cloud LLMs like Claude or fully local LLMs via Ollama.

How to use Wazuh MCP Server?

Deploy with Docker Compose, configure WAZUH_HOST, WAZUH_USER, and WAZUH_PASS in .env, then connect any MCP-compliant client (Claude Desktop, Open WebUI, mcphost) to the /mcp endpoint. Quick start: git clone, cp .env.example .env, edit, docker compose up -d. For local LLMs, use mcphost with --model ollama/qwen2.5:7b. For multi-user SOC, add as an MCP tool server in Open WebUI Admin Settings.

Key features of Wazuh MCP Server

54 security tools across alerts, agents, vulnerabilities, compliance, and active response
Works with cloud LLMs (Claude, GPT) and local LLMs (Llama, Qwen)
Fully air-gappable — data never leaves your network with local mode
RBAC with opt-in wazuh:write scope for state‑changing tools
Audit logging for every destructive action
Rate limiting, circuit breakers, and input validation

Use cases of Wazuh MCP Server

SOC analyst queries critical alerts from the last hour and blocks a malicious IP
Threat hunter searches for rootkit detections and isolates infected agents
Compliance officer runs ISO 27001 gap analysis and retrieves control details
Security engineer checks agent health, open ports, and running processes via chat
Team investigates vulnerabilities by agent and packages, then generates a security report

よくある質問

What are the prerequisites?

Docker 20.10+ with Compose v2, and a Wazuh deployment version 4.8.0–4.14.4 with API access enabled.

Can it run fully offline without sending data to the cloud?

Yes. Use a local LLM via Ollama with Open WebUI or mcphost. In this mode no SIEM data leaves your network — fully air-gappable.

How does security work?

RBAC enforces per‑tool scopes (fail‑closed), all destructive actions are audit‑logged, output is sanitized to prevent credential leakage, inputs are validated (regex, shell metacharacter blocking, Elasticsearch DSL), rate limiting uses a sliding window, circuit breakers auto‑recover, and the container runs with non‑root user, read‑only filesystem, and dropped capabilities.

What authentication modes are supported?

Bearer token (default), OAuth 2.0 with Dynamic Client Registration, or authless mode (read‑only unless `AUTHLESS_ALLOW_WRITE=true`). API keys can be scoped to `wazuh:read` or `wazuh:write`.

What Wazuh versions are supported?

Wazuh 4.8.0 through 4.14.4.

「開発者ツール」の他のコンテンツ

Modelglass

Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott

Yocoolab

MCP server for AI Agents — exposes Yocoolab feedback threads and design selections as tools

DocBin

Give an agent a place to put large output. Instead of returning 40k characters of a build log into the conversation, it posts the file to DocBin and hands back one short URL. Docs render with syntax highlighting and mark

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.