hotwash

Active

A Wazuh alert fires at 3am and your IR playbook is a Markdown doc nobody executes, so steps get skipped and the ticket is a guess. Hotwash makes the same playbook a live, audited run that an analyst and an AI agent can both drive step by step.

GitHub repo →
$npx -y hotwash-mcp
React + FastAPIWazuh ingestconfirm-gatedself-hosted

See it workrepresentative session

you
A Wazuh alert flagged repeated SSH auth failures on web-01. Start our brute-force runbook against it and isolate the host.
tool
hotwash_list_playbooks{ search: "brute force", category: "Incident Response" }
result
1 playbook ir-ssh-bruteforce SSH Brute Force Response IR 14 nodes
tool
hotwash_start_run{ playbook_id: "ir-ssh-bruteforce", incident: "web-01 SSH auth failures (198.51.100.7)" }
result
execution e-4192 started step 1/9 Detection: confirm source IP status active
tool
hotwash_advance_step{ execution_id: "e-4192", step: "containment.isolate", status: "done", note: "isolate_host web-01, source 198.51.100.7" }
result
step 4/9 Containment: isolate host -> done run 44% complete
agent
Run e-4192 is live against web-01 and the isolate step is recorded. Next open step is evidence collection. I have not cancelled anything, so the full timeline stays in the audit log.

Representative session. Illustrative values, RFC 5737 addresses. Runs stay on your self-hosted backend; destructive tools require confirm: true.

What it does

Hotwash is a self-hosted incident-response runbook tool that parses structured Markdown or Mermaid playbooks into an interactive React Flow graph and runs them on a real FastAPI execution engine, so a SOC analyst builds a runbook once and then executes it against a live incident with per-step status, timestamps, assignees, decisions, and attached evidence. It matters because a playbook in a wiki is read-only prose that someone re-types into a ticket, while every Hotwash run is queryable state and an audit trail. What sets it apart is that the same run is drivable by an LLM: the bundled hotwash-mcp Model Context Protocol server exposes the engine as tools, and a Wazuh ingest path turns alerts into an auto-started run or a human-review suggestion, so the design is human-and-agent-in-the-loop rather than a static diagram or a black-box SOAR.

Capabilities10 MCP tools plus the run engine

Playbooks

2 tools

List the library with category/tag/search filters and fetch one playbook's full node-edge graph.

Runs

3 tools

Start a run against an incident, query live step state and timeline, and advance a single step (status, assignee, note, decision).

Suggestion queue

3 tools

List, accept, or dismiss Wazuh ingest suggestions from mode=suggest mappings; accept and dismiss are confirm-gated.

Artifacts & lifecycle

2 tools

Attach a text or base64 artifact to a step, and cancel a run into the audit log (confirm-gated).

Authoring & canvas

Parse Markdown/Mermaid into Phase, Step, Decision, Execute, and Merge nodes on an interactive React Flow canvas with 5 themes.

Wazuh ingest & SOAR

HMAC-authenticated alert webhook with auto/suggest/log mappings, plus a template action library (isolate_host, block_ioc, and friends; TheHive live).

Full tool reference on GitHub →

Setup

01 · install
npx -y hotwash-mcp   # points at a running Hotwash backend; web app runs from source (npm run dev + uvicorn)
02 · configure

MCP server reads HOTWASH_URL (default http://localhost:8000), optional HOTWASH_API_KEY, and HOTWASH_TIMEOUT (default 30s).

03 · mcp client config
{ "mcpServers": { "hotwash": { "command": "npx", "args": ["-y", "hotwash-mcp"], "env": { "HOTWASH_URL": "http://localhost:8000" } } } }

Safety

how it stays safe
Self-hosted: runs live on your own FastAPI backend, nothing leaves the box. The three destructive MCP tools (cancel_run, accept_suggestion, dismiss_suggestion) refuse to act unless the caller passes confirm: true, so an agent cannot abandon a run or burn the suggestion queue by accident. Wazuh mode=suggest mappings route to a human-review queue by design, and the ingest webhook is HMAC-authenticated.

More in Security / SOC8 tools

wazuh-mcpRead your Wazuh SIEM from your agent: alerts, agents, and CVEs, read-only. misp-mcpTurn MISP threat intel into answers: events, correlations, and IOC exports on demand. suricata-mcpHunt Suricata and Zeek NSM logs from your agent: alerts, flows, and C2 analytics. thehive-mcpDrive TheHive incident response from your agent: cases, alerts, tasks, observables. cortex-mcpDetonate an indicator and get one verdict: Cortex analyzers, confirm-gated. mitre-mcpMap alerts to ATT&CK and profile threat groups without leaving your agent. zeek-mcpQuery and correlate Zeek and Suricata NSM logs from your agent. soc-stackOne command stands up a full SOC on Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata.