hotwash
ActiveA Wazuh alert fires at 3am and your IR playbook is a Markdown doc nobody executes, so steps get skipped and the ticket is a guess. Hotwash makes the same playbook a live, audited run that an analyst and an AI agent can both drive step by step.
See it work
one question, the tools it calls, the answer
Representative session. Illustrative values, RFC 5737 addresses. Runs stay on your self-hosted backend; destructive tools require confirm: true.
What it does
Hotwash is a self-hosted incident-response runbook tool that parses structured Markdown or Mermaid playbooks into an interactive React Flow graph and runs them on a real FastAPI execution engine, so a SOC analyst builds a runbook once and then executes it against a live incident with per-step status, timestamps, assignees, decisions, and attached evidence. It matters because a playbook in a wiki is read-only prose that someone re-types into a ticket, while every Hotwash run is queryable state and an audit trail. What sets it apart is that the same run is drivable by an LLM: the bundled hotwash-mcp Model Context Protocol server exposes the engine as tools, and a Wazuh ingest path turns alerts into an auto-started run or a human-review suggestion, so the design is human-and-agent-in-the-loop rather than a static diagram or a black-box SOAR.
Capabilities
10 MCP tools plus the run engine
Set it up
MCP server reads HOTWASH_URL (default http://localhost:8000), optional HOTWASH_API_KEY, and HOTWASH_TIMEOUT (default 30s).
MCP client config
{ "mcpServers": { "hotwash": { "command": "npx", "args": ["-y", "hotwash-mcp"], "env": { "HOTWASH_URL": "http://localhost:8000" } } } }Self-hosted: runs live on your own FastAPI backend, nothing leaves the box. The three destructive MCP tools (cancel_run, accept_suggestion, dismiss_suggestion) refuse to act unless the caller passes confirm: true, so an agent cannot abandon a run or burn the suggestion queue by accident. Wazuh mode=suggest mappings route to a human-review queue by design, and the ingest webhook is HMAC-authenticated.