Retrieves security alerts from Elasticsearch indices containing Wazuh data, transforming them into standardized MCP messages.
Uses Flask to expose an HTTP endpoint for serving transformed security event data to clients.
A production-grade, open-source MCP server for integrating Wazuh security data with LLMs (such as the Claude Desktop App). This service authenticates with the Wazuh RESTful API, retrieves alerts from Elasticsearch indices, transforms events into an MCP-compliant JSON format, and exposes an HTTP endpoint for Claude Desktop to fetch real-time security context.
/mcp endpoint for Claude Desktop integration.Create and Activate a Virtual Environment:
Install Dependencies:
Configuration Set the following environment variables to configure the MCP server:
Example (MacOS):
Running the Server Start the MCP server with:
The server will listen on all interfaces at the port specified by
Integration with Claude Desktop To integrate with Claude Desktop, update its configuration file:
MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json Add the following entry under mcpServers:
License This project is licensed under the MIT License.
Contributing Contributions are welcome! Please open issues or submit pull requests for improvements or bug fixes.
This server cannot be installed
remote-capable server
The server can be hosted and run remotely because it primarily relies on remote services or has no dependency on the local environment.
Securely integrates Wazuh security data with LLMs (such as Claude Desktop) by retrieving alerts from Elasticsearch indices and transforming them into MCP-compliant format, enabling real-time security context in LLM applications.