MCP Server Wazuh

What gbrigandi/mcp-server-wazuh MCP server does

The gbrigandi/mcp-server-wazuh MCP server makes Wazuh security and operations data available to an MCP-compatible LLM client. It is intended for environments where an assistant needs contextual access to a Wazuh deployment for alert review, vulnerability work, agent monitoring, incident investigation, and compliance checks.

The server covers data from both the Wazuh Indexer and Wazuh Manager. Indexer access supports alert and event analysis, while Manager access covers agents, rules, vulnerabilities, logs, statistics, and related operational information. Responses are converted into MCP-compatible data for use in conversational workflows.

How it works

A compatible client sends a natural-language request through MCP. The server queries the accessible Wazuh components and returns structured information that the assistant can use in its response. Example questions described by the project include finding critical vulnerabilities on web servers, inspecting processes on a particular agent, and checking PCI-DSS logging requirements.

The gbrigandi/mcp-server-wazuh MCP server can support investigations that combine multiple Wazuh data sources. For example, an analyst can review an alert, inspect the affected agent, check its open ports and processes, and examine relevant manager logs. The README also describes combining this server with separate Cortex, TheHive, or MISP MCP servers, but those are complementary projects rather than included capabilities.

Setup and configuration

You need an MCP-compatible LLM client, such as Claude Desktop, and a running Wazuh server with its API enabled and reachable. The project recommends Wazuh version 4.12. Network connectivity is required between the MCP server and the Wazuh API when API interaction is used.

The documented installation paths are a pre-built release binary or Docker. Release assets are provided for Linux amd64, macOS amd64, macOS arm64, and Windows amd64. A downloaded binary may need executable permissions on Unix-like systems and can optionally be placed on the system PATH. The supplied material does not include the Docker command, MCP client configuration block, or Wazuh credential variable names.

Tools and capabilities

Named tools in the README include:

• get_wazuh_alert_summary for reviewing recent alert information.
• get_wazuh_vulnerability_summary and get_wazuh_critical_vulnerabilities for vulnerability assessment.
• get_wazuh_agent_processes, get_wazuh_agent_ports, and get_wazuh_running_agents for agent investigation and health monitoring.
• get_wazuh_rules_summary for examining detection rules.
• get_wazuh_weekly_stats, get_wazuh_remoted_stats, and get_wazuh_log_collector_stats for manager statistics.
• get_wazuh_cluster_health and get_wazuh_cluster_nodes for cluster status.
• search_wazuh_manager_logs and get_wazuh_manager_error_logs for log investigation.

These capabilities support alert triage, vulnerability prioritization, process and network analysis, rule review, performance monitoring, compliance assessment, and forensic work.

Limitations and notes

The project is a bridge to an existing Wazuh deployment; it does not replace Wazuh or provide a standalone SIEM. The README requires the Wazuh API to be enabled and accessible, but the supplied material does not specify authentication settings or environment variable names. It also does not establish support for clients beyond stating MCP compatibility and describing Claude Desktop integration. Tools or workflows belonging to the separately listed Cortex, TheHive, and MISP servers should not be treated as built into this server.