wazuh-mcp

Active

Your Wazuh console answers one query at a time, and only if you know how to ask. wazuh-mcp hands the whole SIEM to your agent: alerts, agents, CVEs, rules, and CIS posture, answered in plain language over stdio.

GitHub repo → npm →

$npm i -g wazuh-mcp

read-onlyNode 20+

See it workrepresentative session

you

Any critical alerts on the DMZ hosts in the last hour, and is anything misconfigured?

tool

search_alerts{ level: ">=10", group: "dmz", range: "1h" }

result

3 alerts 5710 sshd: 47 authentication failures dmz-web-01 (192.0.2.24) level 10 02:14Z 92053 Suricata ET SCAN nmap probe dmz-fw-01 level 12 03:02Z 5402 successful sudo to root dmz-web-01 level 12 03:05Z

tool

get_sca_checks{ agent: "dmz-web-01", result: "failed" }

result

CIS 5.2.5 SSH MaxAuthTries not set fix: set MaxAuthTries 4 in /etc/ssh/sshd_config

agent

dmz-web-01 is the one to look at. 47 SSH failures, then a successful root sudo three minutes after an nmap scan from dmz-fw-01. Its SSH config also fails CIS 5.2.5, which is what let the brute force run. I would isolate dmz-web-01 and cap auth tries.

Representative session. Illustrative values, RFC 5737 addresses. Your data never leaves the box.

What it does

Point any MCP client at wazuh-mcp and your Wazuh SIEM/XDR becomes tools the agent can call: enumerate agents, search alerts against the Indexer, review the CVE backlog, read detection rules and decoders, and run CIS and File Integrity posture checks. It is read-only and speaks stdio, so there is no new network surface and nothing to write back into Wazuh. Compliance mappings (PCI-DSS, HIPAA, NIST 800-53, MITRE ATT&CK) ride along on every rule lookup.

Capabilities28 tools across the deployment

Agents & inventory

9 tools

Enumerate agents and pull Syscollector OS, packages, processes, ports, and hotfixes.

Alerts & vulnerabilities

5 tools

Search alerts by time, level, agent, and rule via the Indexer. Query the CVE inventory by severity and package.

Detection content

4 tools

Browse rules and decoders with level/group filters and full compliance mappings.

Posture & integrity

4 tools

SCA policies and per-check remediation, File Integrity Monitoring, and rootcheck findings.

Manager & diagnostics

6 tools

Manager logs and config (secrets redacted), agent groups, version, and a sanitized connection check.

Full tool reference on GitHub →

Setup

01 · install

npm i -g wazuh-mcp        # or: npx wazuh-mcp

02 · configure

Configure with WAZUH_URL, WAZUH_USERNAME, WAZUH_PASSWORD. Add WAZUH_INDEXER_URL to enable alert and vulnerability search.

03 · mcp client config (claude desktop, claude code, openclaw, codex)

{
  "mcpServers": {
    "wazuh": {
      "command": "wazuh-mcp",
      "env": {
        "WAZUH_URL": "https://wazuh.example.net:55000",
        "WAZUH_USERNAME": "wazuh-wui",
        "WAZUH_PASSWORD": "...",
        "WAZUH_INDEXER_URL": "https://wazuh.example.net:9200"
      }
    }
  }
}

Safety

how it stays safe

Built for pointing an LLM at security data. Sensitive fields (IPs, full logs, hashes, command lines, secrets) are minimized by default and returned only on explicit opt-in. Alert content that originated on a monitored endpoint is wrapped in untrusted-data markers, so a malicious log line cannot hijack the agent reading it.

More in Security / SOC8 tools

misp-mcpTurn MISP threat intel into answers: events, correlations, and IOC exports on demand. suricata-mcpHunt Suricata and Zeek NSM logs from your agent: alerts, flows, and C2 analytics. thehive-mcpDrive TheHive incident response from your agent: cases, alerts, tasks, observables. cortex-mcpDetonate an indicator and get one verdict: Cortex analyzers, confirm-gated. mitre-mcpMap alerts to ATT&CK and profile threat groups without leaving your agent. zeek-mcpQuery and correlate Zeek and Suricata NSM logs from your agent. hotwashBuild IR playbooks as flowcharts and run them step by step, agent-drivable. soc-stackOne command stands up a full SOC on Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata.