Advertise
MCP.so
Sign In

Wazuh MCP Server

@unmuktoai

RepositoryHomepage

Basic information

Category

Developer Tools

License

MIT

Transports

stdio

Author

unmuktoai

About Wazuh MCP Server

AI-powered security operations for Wazuh SIEM—use any MCP-compatible client to ask security questions in plain English. Faster threat detection, incident triage, and compliance checks with real-time monitoring and anomaly spotting. Production-ready MCP server for conversational S

#python#ai#mcp#wazuh#claude#claude-ai#genai#wazuh-integration#model-context-protocol#mcp-server#model-context-protocol-servers#mcpserver

Wazuh MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "Wazuh-MCP-Server": {
      "command": "docker",
      "args": [
        "compose",
        "up",
        "-d"
      ]
    }
  }
}

Wazuh MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Wazuh MCP Server?

A Model Context Protocol server that turns Wazuh SIEM workflows into natural conversation with any AI assistant. It provides 54 security tools for querying alerts, hunting threats, checking vulnerabilities, triggering active responses, and running compliance checks — through cloud LLMs like Claude or fully local LLMs via Ollama.

How to use Wazuh MCP Server?

Deploy with Docker Compose, configure WAZUH_HOST, WAZUH_USER, and WAZUH_PASS in .env, then connect any MCP-compliant client (Claude Desktop, Open WebUI, mcphost) to the /mcp endpoint. Quick start: git clone, cp .env.example .env, edit, docker compose up -d. For local LLMs, use mcphost with --model ollama/qwen2.5:7b. For multi-user SOC, add as an MCP tool server in Open WebUI Admin Settings.

Key features of Wazuh MCP Server

  • 54 security tools across alerts, agents, vulnerabilities, compliance, and active response
  • Works with cloud LLMs (Claude, GPT) and local LLMs (Llama, Qwen)
  • Fully air-gappable — data never leaves your network with local mode
  • RBAC with opt-in wazuh:write scope for state‑changing tools
  • Audit logging for every destructive action
  • Rate limiting, circuit breakers, and input validation

Use cases of Wazuh MCP Server

  • SOC analyst queries critical alerts from the last hour and blocks a malicious IP
  • Threat hunter searches for rootkit detections and isolates infected agents
  • Compliance officer runs ISO 27001 gap analysis and retrieves control details
  • Security engineer checks agent health, open ports, and running processes via chat
  • Team investigates vulnerabilities by agent and packages, then generates a security report

Frequently asked questions

1

What are the prerequisites?

Docker 20.10+ with Compose v2, and a Wazuh deployment version 4.8.0–4.14.4 with API access enabled.

2

Can it run fully offline without sending data to the cloud?

Yes. Use a local LLM via Ollama with Open WebUI or mcphost. In this mode no SIEM data leaves your network — fully air-gappable.

3

How does security work?

RBAC enforces per‑tool scopes (fail‑closed), all destructive actions are audit‑logged, output is sanitized to prevent credential leakage, inputs are validated (regex, shell metacharacter blocking, Elasticsearch DSL), rate limiting uses a sliding window, circuit breakers auto‑recover, and the container runs with non‑root user, read‑only filesystem, and dropped capabilities.

4

What authentication modes are supported?

Bearer token (default), OAuth 2.0 with Dynamic Client Registration, or authless mode (read‑only unless `AUTHLESS_ALLOW_WRITE=true`). API keys can be scoped to `wazuh:read` or `wazuh:write`.

5

What Wazuh versions are supported?

Wazuh 4.8.0 through 4.14.4.

Comments

More Developer Tools MCP servers

ArtiBot Cloud MCP - Zhijiangyun 智匠云

bofob

ArtiBot Cloud MCP (Zhijiangyun 智匠云) — cloud MCP server for robot manipulation data & GPU workloads. 15 tools: robot fleet management, data collection & video recording, post-processing pipelines, and benchmark evaluation

1

LastPing

LastPing

Know when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci

offprompt

offprompt

MCP server that lets Claude Code, Cursor or Codex ask you for API keys on a local page and write them to .env. The agent only ever sees key names.

2

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

12

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

3
Advertise