Wazuh MCP Server
MCP access to Wazuh for investigating alerts and vulnerabilities, checking SIEM health and invoking response tools
- 264 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Write tools block IPs, isolate hosts, kill processes, disable users and quarantine files
- The server holds manager and Indexer passwords and reads alerts, vulnerabilities and agent configuration
- The token grants access to data and operations within its assigned permissions; without a reverse proxy the server uses plain HTTP
Install
- Works in
Manual install
git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git
cd Wazuh-MCP-Server
cp .env.example .envBefore starting, fill .env with your Manager, Indexer and authentication settings. Then run docker compose up -d. /health reports process liveness; /ready checks Wazuh component connectivity.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Write tools block IPs, isolate hosts, kill processes, disable users and quarantine files
- The server holds manager and Indexer passwords and reads alerts, vulnerabilities and agent configuration
- The token grants access to data and operations within its assigned permissions; without a reverse proxy the server uses plain HTTP
This is third-party code. Review the repository files before installing.
What it does
Wazuh MCP Server gives an MCP client access to your Wazuh system through 55 tools in eight toolsets: alerts, agents, vulnerabilities, threat analysis, compliance, manager and cluster health, external context and active response. The server speaks Streamable HTTP at `/mcp` and calls no model itself, it only executes tools. 41 tools are read-only: alert summaries and search, agent processes and ports, critical vulnerabilities, PCI-DSS, HIPAA, SOX, GDPR, NIST and ISO 27001 checks, cluster statistics. The other 14 change state: IP blocking, host isolation, process kill, user disabling, file quarantine and the matching rollbacks. They need the `wazuh:write` scope, which is never granted by default, and in production every call requires `confirm=true`. The server also offers five ready prompts for investigation, threat hunting, compliance audit, vulnerability assessment and ISO 27001 review. It runs through Docker Compose or a prebuilt image, supports several clusters and can pair with a local model through vLLM and Open WebUI.
Who it is for. For SOC engineers and Wazuh administrators who want to triage alerts and vulnerabilities through Claude or a local model while keeping control over response actions.
Good fit when
- You need to triage a stream of alerts quickly: group them, find patterns and check indicator reputation
- Before an audit you need a PCI-DSS, HIPAA, GDPR, NIST or ISO 27001 report with a gap analysis
- You want a list of critical vulnerabilities per agent to prioritize fixes
- SIEM data must not leave your network, so you pair a local model through vLLM and Open WebUI from the ready Compose set
- You want to delegate incident response only partly: reading is allowed and writing is opened selectively with confirmation
Not a fit when
- You require independent proof of human approval for each action: the agent can supply the confirmation flag itself
- Your Wazuh version is outside 4.8.0 to 4.14.7: compatibility with other versions is not claimed
- You have no access to the Wazuh Indexer: alert, vulnerability and some compliance tools do not work without it
- You need a public server with no TLS reverse proxy: the server speaks plain HTTP and does not terminate TLS
Example request
Show high-level alerts from the last day, group them by agent and check the reputation of the most frequent IPs, but block nothingMCP
- Transport
- http
- Authentication
- API key
Environment variables
WAZUH_HOSTrequired- Wazuh manager address.
WAZUH_USERrequired- Manager API user.
WAZUH_PASSrequired, secret- Manager API user password.
WAZUH_INDEXER_HOST- Wazuh Indexer address, needed for alerts and vulnerabilities.
WAZUH_INDEXER_PASSsecret- Indexer user password.
AUTH_SECRET_KEYrequired, secret- Token signing key, required in production.
MCP_API_KEYrequired, secret- API key of the wazuh_ form from which access tokens are minted.
Limitations
Wazuh versions 4.8.0 through 4.14.7 are supported. Alert, vulnerability and some compliance tools need the Wazuh Indexer. Running it takes Docker with Compose v2 and a Wazuh manager API user. The server speaks plain HTTP, so put a TLS reverse proxy in front before external access. Claude as a custom connector needs a public HTTPS address.
The manager certificate is verified by default. A fresh Wazuh install has a self-signed certificate, and for a first try you can set `WAZUH_ALLOW_SELF_SIGNED=true`, which turns verification off. An active response result only confirms delivery of the command to the agent. Confirm execution with the `wazuh_check_*` tools. Blocks stay until removed, and the server refuses a positive duration. When upgrading from 4.x read UPGRADING.md first. The license is MIT. The confirm=true flag does not prove human approval because the agent can set it. Start with a read-only token.
How to disable. Run `docker compose down` in the server folder and remove the connector from the client. To keep it read-only, do not add `wazuh:write` to `MCP_API_KEY_SCOPES` and hide dangerous tools with `WAZUH_DISABLED_TOOLS`.
FAQ
How do I connect Wazuh MCP Server to Claude?
A Claude custom connector needs an HTTPS address behind a TLS proxy and OAuth with AUTH_MODE=oauth and OAUTH_ISSUER_URL configured. Other HTTP clients need token acquisition and an Authorization header. Starting the container alone does not complete client setup.
Can the agent block an IP or isolate a host?
Only if the token has the `wazuh:write` scope. Without it the 14 write tools do not even show in the tool list. The server refuses to block loopback, the manager address and protected addresses from `WAZUH_PROTECTED_IPS`, and in production it requires `confirm=true`.
Can I use a local model?
Yes. The `compose.local-llm.yml` file adds vLLM with the Qwen3.6-35B-A3B FP8 model, which needs about 42 GB of VRAM on one NVIDIA GPU, and Open WebUI. For smaller models you cut the tool list with `WAZUH_TOOLSETS` and `WAZUH_DISABLED_TOOLS`.
Does SIEM data go to external services?
Yes, when MCP is connected to a cloud model: SIEM results enter its context. A separate optional search tool sends queries to You.com and requires YDC_API_KEY. A local-model setup must be configured separately.
How does the audit log work?
Every write tool call that passes the scope and confirmation checks is logged before and after execution with the principal, session, arguments and outcome. Credentials and tokens are redacted from output and logs.
Discussion
No questions or reviews yet.
Related
MCP serversSecurity scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
An MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
A bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code
README in short
The repository holds a server for Python 3.11 and newer on FastAPI, images for amd64 and arm64, and a set of documents: configuration, Claude integration, local models, multi-cluster, operations and hardening. It includes a tool-selection check, `evals/tool_selection.py`, with 25 SOC scenarios, two of them prompt injection attempts.