# wazuh-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/lidless-labs/wazuh-mcp  
**GitHub Stars:** 8  
**npm Downloads (last month):** 287  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/wazuh-mcp

## Description
Your SIEM answers live behind a console you babysit. wazuh-mcp reads Wazuh alerts, agents, and CVEs straight into your AI client. Read-only, nothing leaves the box.

## Tools
Capabilities this server exposes over MCP:

- **list_agents** — List all agents with optional status filtering (active, disconnected, never_connected, pending)
- **get_agent** — Get detailed info for a specific agent by ID
- **get_agent_stats** — Get CPU, memory, and disk statistics for an agent
- **get_alerts** — Retrieve recent alerts with filtering by time range, level, agent, rule, and text search
- **get_alert** — Retrieve a single alert by ID
- **search_alerts** — Full-text search across alerts with optional time range filtering
- **list_vulnerabilities** — List vulnerability inventory with optional CVE, agent, severity, and package filters
- **search_vulnerabilities** — Search vulnerability inventory by CVE, package, agent, or description
- **list_rules** — List detection rules with level and group filtering
- **get_rule** — Get full rule details including compliance mappings
- **search_rules** — Search rules by description text
- **get_sca_policies** — List SCA policies and scores for an agent (CIS benchmarks, etc.)
- **get_sca_checks** — Get individual check results with remediation steps and compliance mappings
- **get_agent_os** — Get OS information (name, version, architecture, hostname)
- **get_agent_packages** — List installed software packages with versions
- **get_agent_processes** — List running processes with PIDs and command lines
- **get_agent_ports** — List open network ports with associated processes
- **get_agent_network** — List network interfaces and IP addresses
- **get_agent_hotfixes** — List installed Windows hotfixes/patches
- **get_fim_files** — Get File Integrity Monitoring results (files, registry keys, hashes)
- **get_rootcheck** — Get rootkit detection scan findings
- **get_manager_logs** — Get Wazuh manager logs filtered by level and module
- **get_manager_config** — Get active manager configuration by section with secret-like values redacted by default
- **list_groups** — List all agent groups
- **get_group_agents** — List agents in a specific group
- **list_decoders** — List log decoders with optional name filtering
- **get_wazuh_version** — Get Wazuh manager version and API info
- **diagnose_wazuh_connection** — Check sanitized configuration, URL/TLS settings, manager auth/version, and indexer readiness

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "wazuh-mcp": {
    "command": "npx",
    "args": ["-y","--package","wazuh-mcp","wazuhctrl"],
    "env": {
      "WAZUH_URL": "",
      "WAZUH_USERNAME": "",
      "WAZUH_PASSWORD": "",
      "WAZUH_CA_FILE": "",
      "WAZUH_INDEXER_URL": "",
      "WAZUH_INDEXER_USERNAME": "",
      "WAZUH_INDEXER_PASSWORD": "",
      "WAZUH_INDEXER_CA_FILE": ""
    }
  }
}
```

**Requires environment variables:** `WAZUH_URL`, `WAZUH_USERNAME`, `WAZUH_PASSWORD`, `WAZUH_CA_FILE`, `WAZUH_INDEXER_URL`, `WAZUH_INDEXER_USERNAME`, `WAZUH_INDEXER_PASSWORD`, `WAZUH_INDEXER_CA_FILE` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What wazuh-mcp does

wazuh-mcp connects MCP clients to a Wazuh SIEM/XDR deployment. It reads from the Wazuh manager API and, when configured, the Wazuh Indexer. The exposed operations cover agent status and details, recent and searchable alerts, vulnerability inventory, detection rules, SCA results, endpoint system inventory, File Integrity Monitoring, rootcheck findings, manager logs, configuration, groups, decoders, version information, and connection diagnostics.

The package is read-only for Wazuh data. Manager access performs JWT authentication, while Indexer access uses search queries. It is suited to investigation, triage, compliance review, and inventory questions where the calling agent should not modify the deployment.

## How it works

The server can run as a local stdio process or as a shared Streamable HTTP process. The stdio mode is appropriate for a client that launches the command directly. HTTP mode listens on `/mcp` and requires a separate bearer token; `/healthz` provides an unauthenticated health response. HTTP sessions have independent MCP state, while the manager client and cached authentication token are shared.

Wazuh manager credentials provide access to manager-backed tools. Alert and vulnerability operations use the optional Indexer credentials. Without the Indexer, manager, agent, rule, decoder, and version tools remain available, while alert and vulnerability operations return a configuration message.

## Setup and configuration

The published npm package can be started with `npx`; source installations use `npm install` followed by `npm run build`. Configure the manager URL, username, password, and CA file as needed. Indexer URL, username, password, and CA file are optional as a group. Use least-privilege Wazuh accounts rather than the Wazuh web administrator or Indexer superuser.

For HTTP mode, build the repository and run `dist/mcp-bin.js --http`. Set `WAZUH_MCP_HTTP_TOKEN` to an independent token of at least 32 characters. `WAZUH_MCP_HTTP_HOST` controls the bind address and defaults to IPv4 loopback; `WAZUH_MCP_HTTP_PORT` defaults to 3120. The listener does not provide TLS, OAuth, or browser CORS support, so remote deployments need a trusted proxy or tunnel and network controls.

## Tools and capabilities

- Filter agents by active, disconnected, never-connected, or pending status.
- Retrieve alerts and search them by time, level, agent, rule, or text.
- Find vulnerabilities by CVE, severity, package, agent, or description.
- Inspect rules, decoders, SCA checks, compliance mappings, and remediation steps.
- Review operating systems, packages, processes, ports, interfaces, IP addresses, and Windows hotfixes.
- Read FIM, rootcheck, manager log, configuration, group, and diagnostic data.

Sensitive values such as agent IPs, full logs, hashes, and command lines are hidden unless enabled for an individual call. Manager configuration secret-like values are redacted by default.

## Limitations and notes

All HTTP-token holders share the configured upstream account's read privileges; session IDs do not represent separate users. Keep HTTP mode bound to loopback for local use. The server limits HTTP request bodies to 1 MiB, applies request and header timeouts, and expires idle sessions after 30 minutes. An open idle SSE channel does not prevent expiry. TLS verification remains enabled by default.

_Full upstream README: https://allmcps.com/mcp/wazuh-mcp/readme_