What are the requirements for running the server?
A running Wazuh server (v4.12 recommended) with API enabled, network connectivity, and an MCP-compatible LLM client like Claude Desktop.
Wazuh MCP Server
@gbrigandi
Basic information
About Wazuh MCP Server
MCP Server for Wazuh SIEM
Wazuh MCP Server config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"mcp-server-wazuh": {
"command": "docker",
"args": [
"pull",
"ghcr.io/gbrigandi/mcp-server-wazuh:latest"
]
}
}
}Wazuh MCP Server tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is Wazuh MCP Server?
A Rust-based server that bridges Wazuh SIEM data with MCP-compatible AI assistants like Claude Desktop. It transforms complex Wazuh API responses into structured security context, enabling natural language queries for alerts, agents, vulnerabilities, rules, and compliance data.
How to use Wazuh MCP Server?
Install via pre-built binary, Docker image, or build from source with Rust. Configure environment variables for Wazuh API and Indexer credentials, then point your MCP client (e.g., Claude Desktop) to the server executable or Docker container.
Key features of Wazuh MCP Server
- Real-time access to security alerts and events
- Agent management and health status monitoring
- Vulnerability assessment for risk management
- Security rules and configuration access
- System statistics and performance metrics
- Compliance monitoring for PCI-DSS, HIPAA, etc.
Use cases of Wazuh MCP Server
- Triage and prioritize security alerts using natural language queries
- Assess agent vulnerabilities and prioritize patching efforts
- Investigate running processes and open ports for threat hunting
- Monitor cluster health and manager performance metrics
- Automate compliance reporting and gap analysis for audits
Frequently asked questions
How do I install and configure the server?
You can download a pre-built binary, pull a Docker image, or build from source with Rust. Configuration is done through environment variables for Wazuh API/Indexer host, port, and credentials.
Can I use this server with other MCP security tools?
Yes, it can be combined with Cortex MCP Server, TheHive MCP Server, and MISP MCP Server for enhanced threat intelligence, case management, and IOC enrichment.
What data sources does the server access?
It accesses data from both the Wazuh Indexer (alerts) and the Wazuh Manager (agents, rules, vulnerabilities, cluster health, logs, and statistics).
More Other MCP servers
MCP Toolbox for Databases
googleapisMCP Toolbox for Databases is an open source MCP server for databases.
15.9K
Senso MCP for Joomla
sensomediaSenso MCP turns a Joomla 5 or 6 site into a remote MCP server. It runs inside Joomla itself (no extra server, no Node.js bridge) and is secured with OAuth 2.1 and Joomla's own ACL. The free pack lets an AI assistant crea
Lemon.io
lemon-ioRequest dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3
ICSS
chokcoco不止于 CSS
20.7K
🚀 Model Context Protocol (MCP) Curriculum for Beginners
microsoftThis open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,
16.7K
Comments