广告合作
MCP.so
登录

Wazuh MCP Server

@unmuktoai

代码仓库主页

基本信息

分类

开发工具

许可证

MIT

传输方式

stdio

作者

unmuktoai

关于 Wazuh MCP Server

AI-powered security operations for Wazuh SIEM—use any MCP-compatible client to ask security questions in plain English. Faster threat detection, incident triage, and compliance checks with real-time monitoring and anomaly spotting. Production-ready MCP server for conversational S

#python#ai#mcp#wazuh#claude#claude-ai#genai#wazuh-integration#model-context-protocol#mcp-server#model-context-protocol-servers#mcpserver

Wazuh MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "Wazuh-MCP-Server": {
      "command": "docker",
      "args": [
        "compose",
        "up",
        "-d"
      ]
    }
  }
}

Wazuh MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Wazuh MCP Server?

A Model Context Protocol server that turns Wazuh SIEM workflows into natural conversation with any AI assistant. It provides 54 security tools for querying alerts, hunting threats, checking vulnerabilities, triggering active responses, and running compliance checks — through cloud LLMs like Claude or fully local LLMs via Ollama.

How to use Wazuh MCP Server?

Deploy with Docker Compose, configure WAZUH_HOST, WAZUH_USER, and WAZUH_PASS in .env, then connect any MCP-compliant client (Claude Desktop, Open WebUI, mcphost) to the /mcp endpoint. Quick start: git clone, cp .env.example .env, edit, docker compose up -d. For local LLMs, use mcphost with --model ollama/qwen2.5:7b. For multi-user SOC, add as an MCP tool server in Open WebUI Admin Settings.

Key features of Wazuh MCP Server

  • 54 security tools across alerts, agents, vulnerabilities, compliance, and active response
  • Works with cloud LLMs (Claude, GPT) and local LLMs (Llama, Qwen)
  • Fully air-gappable — data never leaves your network with local mode
  • RBAC with opt-in wazuh:write scope for state‑changing tools
  • Audit logging for every destructive action
  • Rate limiting, circuit breakers, and input validation

Use cases of Wazuh MCP Server

  • SOC analyst queries critical alerts from the last hour and blocks a malicious IP
  • Threat hunter searches for rootkit detections and isolates infected agents
  • Compliance officer runs ISO 27001 gap analysis and retrieves control details
  • Security engineer checks agent health, open ports, and running processes via chat
  • Team investigates vulnerabilities by agent and packages, then generates a security report

常见问题

1

What are the prerequisites?

Docker 20.10+ with Compose v2, and a Wazuh deployment version 4.8.0–4.14.4 with API access enabled.

2

Can it run fully offline without sending data to the cloud?

Yes. Use a local LLM via Ollama with Open WebUI or mcphost. In this mode no SIEM data leaves your network — fully air-gappable.

3

How does security work?

RBAC enforces per‑tool scopes (fail‑closed), all destructive actions are audit‑logged, output is sanitized to prevent credential leakage, inputs are validated (regex, shell metacharacter blocking, Elasticsearch DSL), rate limiting uses a sliding window, circuit breakers auto‑recover, and the container runs with non‑root user, read‑only filesystem, and dropped capabilities.

4

What authentication modes are supported?

Bearer token (default), OAuth 2.0 with Dynamic Client Registration, or authless mode (read‑only unless `AUTHLESS_ALLOW_WRITE=true`). API keys can be scoped to `wazuh:read` or `wazuh:write`.

5

What Wazuh versions are supported?

Wazuh 4.8.0 through 4.14.4.

评论

开发工具 分类下的更多 MCP 服务器

Foremerge

naw103

Catch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.

50

Crawl Readiness

Grubbomatic

AI SEO tools for MCP clients — audit whether AI crawlers can read a website, validate JSON-LD and robots.txt, and generate llms.txt, AI-crawler-aware robots.txt, and JSON-LD schema without leaving the conversation.

Codex Pets

astandrik

Public read-only MCP server for discovering, inspecting, installing, and sharing approved Codex-compatible animated pet packs.

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

3

PuzzleTide Puzzle Generator

Caravaca-Labs

Word search generator, crossword generator, and sudoku generator + solver as a local-first MCP server. 15 deterministic tools: printable PDF puzzle worksheets, themed word banks, and verifiable LLM evals. From the makers

广告合作