hotwash

Active

A Wazuh alert fires at 3am and your IR playbook is a Markdown doc nobody executes, so steps get skipped and the ticket is a guess. Hotwash makes the same playbook a live, audited run that an analyst and an AI agent can both drive step by step.

10 MCP toolsReact + FastAPIWazuh ingestconfirm-gatedself-hostedMIT

See it work

one question, the tools it calls, the answer

representative session · claude + hotwash-mcp
A Wazuh alert flagged repeated SSH auth failures on web-01. Start our brute-force runbook against it and isolate the host.
hotwash_list_playbooks{ search: "brute force", category: "Incident Response" }
1 playbook ir-ssh-bruteforce SSH Brute Force Response IR 14 nodes
hotwash_start_run{ playbook_id: "ir-ssh-bruteforce", incident: "web-01 SSH auth failures (198.51.100.7)" }
execution e-4192 started step 1/9 Detection: confirm source IP status active
hotwash_advance_step{ execution_id: "e-4192", step: "containment.isolate", status: "done", note: "isolate_host web-01, source 198.51.100.7" }
step 4/9 Containment: isolate host -> done run 44% complete
Run e-4192 is live against web-01 and the isolate step is recorded. Next open step is evidence collection. I have not cancelled anything, so the full timeline stays in the audit log.

Representative session. Illustrative values, RFC 5737 addresses. Runs stay on your self-hosted backend; destructive tools require confirm: true.

What it does

Hotwash is a self-hosted incident-response runbook tool that parses structured Markdown or Mermaid playbooks into an interactive React Flow graph and runs them on a real FastAPI execution engine, so a SOC analyst builds a runbook once and then executes it against a live incident with per-step status, timestamps, assignees, decisions, and attached evidence. It matters because a playbook in a wiki is read-only prose that someone re-types into a ticket, while every Hotwash run is queryable state and an audit trail. What sets it apart is that the same run is drivable by an LLM: the bundled hotwash-mcp Model Context Protocol server exposes the engine as tools, and a Wazuh ingest path turns alerts into an auto-started run or a human-review suggestion, so the design is human-and-agent-in-the-loop rather than a static diagram or a black-box SOAR.

Capabilities

10 MCP tools plus the run engine

Playbooks2 tools
List the library with category/tag/search filters and fetch one playbook's full node-edge graph.
Runs3 tools
Start a run against an incident, query live step state and timeline, and advance a single step (status, assignee, note, decision).
Suggestion queue3 tools
List, accept, or dismiss Wazuh ingest suggestions from mode=suggest mappings; accept and dismiss are confirm-gated.
Artifacts & lifecycle2 tools
Attach a text or base64 artifact to a step, and cancel a run into the audit log (confirm-gated).
Authoring & canvas
Parse Markdown/Mermaid into Phase, Step, Decision, Execute, and Merge nodes on an interactive React Flow canvas with 5 themes.
Wazuh ingest & SOAR
HMAC-authenticated alert webhook with auto/suggest/log mappings, plus a template action library (isolate_host, block_ioc, and friends; TheHive live).
Full reference on GitHub →

Set it up

npx -y hotwash-mcp # points at a running Hotwash backend; web app runs from source (npm run dev + uvicorn)

MCP server reads HOTWASH_URL (default http://localhost:8000), optional HOTWASH_API_KEY, and HOTWASH_TIMEOUT (default 30s).

MCP client config
{ "mcpServers": { "hotwash": { "command": "npx", "args": ["-y", "hotwash-mcp"], "env": { "HOTWASH_URL": "http://localhost:8000" } } } }
[ shield ]

Self-hosted: runs live on your own FastAPI backend, nothing leaves the box. The three destructive MCP tools (cancel_run, accept_suggestion, dismiss_suggestion) refuse to act unless the caller passes confirm: true, so an agent cannot abandon a run or burn the suggestion queue by accident. Wazuh mode=suggest mappings route to a human-review queue by design, and the ingest webhook is HMAC-authenticated.

10
MCP tools
3
confirm-gated writes
5
node types
self-hosted
local-first
MIT
license