Skip to main content
Glama
VitexSoftware

mcp-server-wazuh

by VitexSoftware
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

mcp-server-wazuh

stdio MCP server for Wazuh 5. It reads the manager API on port 55000 (agents, groups, cluster, MITRE) and the indexer on port 9200 (events, findings, vulnerability state).

Wazuh 5 removed the 4.x manager paths /manager, /rules, /syscheck, /sca and /vulnerability. Existing public servers such as gbrigandi/mcp-server-wazuh still call those paths, so this package talks to the 5.0 API instead of forking them. Rule matches are findings in wazuh-findings-v5*, not wazuh-alerts-*.

Install

apt install mcp-server-wazuh
apt install mcprack-mcp-server-wazuh

Related MCP server: wazuh-mcp

Environment

Variable

Secret

Default

Meaning

WAZUH_API_URL

no

https://127.0.0.1:55000

Manager API base URL

WAZUH_API_USER

yes

–

API user. Used once to obtain a JWT

WAZUH_API_PASSWORD

yes

–

API password

WAZUH_INDEXER_URL

no

https://127.0.0.1:9200

Indexer base URL

WAZUH_INDEXER_USER

yes

–

Indexer user

WAZUH_INDEXER_PASSWORD

yes

–

Indexer password

WAZUH_READ_ONLY

no

true

Hide restart_agents

WAZUH_VERIFY_TLS

no

true

Verify manager and indexer certificates

WAZUH_TIMEOUT

no

30

Seconds per request

WAZUH_MAX_CHARS

no

100000

Truncate larger tool output

WAZUH_EVENTS_INDEX

no

wazuh-events-v5*

Events data stream

WAZUH_FINDINGS_INDEX

no

wazuh-findings-v5*

Findings data stream

WAZUH_VULN_INDEX

no

wazuh-states-vulnerabilities

Vulnerability state index

The JWT is refreshed in-process and is never printed. A 401 fetches a new token once.

Tools

Tool

Title

Annotation

Backend

get_api_info

API Info

read-only

manager GET /

list_agents

List Agents

read-only

manager GET /agents

get_agent

Get Agent

read-only

manager GET /agents/{id}

get_agents_summary

Agents Summary

read-only

manager GET /agents/summary

list_groups

List Groups

read-only

manager GET /groups

get_cluster_status

Cluster Status

read-only

manager GET /cluster/status

list_cluster_nodes

List Cluster Nodes

read-only

manager GET /cluster/nodes

search_mitre

Search MITRE

read-only

manager GET /mitre/techniques

search_events

Search Events

read-only

indexer

search_findings

Search Findings

read-only

indexer

search_vulnerabilities

Search Vulnerabilities

read-only

indexer

restart_agents

Restart Agents

destructive

manager, only when WAZUH_READ_ONLY=false

restart_agents interrupts agents. Ask before calling it. Wazuh 5 may reject the restart endpoint.

Development

PYTHONPATH=src python3 -m pytest

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Wazuh Servidor MCP

    nks1097
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables natural language interaction with Wazuh SIEM for alert querying, threat hunting, vulnerability scanning, and active response actions.
    MIT

  • wazuh-mcp

    matchboxdesigngroup
    F
    license
    A
    quality
    C
    maintenance
    Enables querying a remote Wazuh deployment via MCP, covering Manager API (agents, rules, inventory, configuration) and Indexer (alerts, vulnerabilities) with 34 tools and reports, read-only by default.
    34
    -

  • Wazuh MCP Server

    salepassionate
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to converse in plain language with a Wazuh SIEM deployment, querying and aggregating alerts, hunting threats, triaging vulnerabilities, running compliance checks, and executing or rolling back active responses across multi-cluster environments. Works with both cloud and fully local, air-gapped LLM clients while enforcing scoped, audited access to the security tools.
    MIT

  • Wazuh 5 MCP Server (Wrapper)

    rnd-rtcyber
    A
    license
    Not graded
    quality
    B
    maintenance
    Exposes Wazuh SIEM data and actions—including agents, alerts, vulnerabilities, rules, decoders, active response, and Wazuh 5 Sigma rules, Detectors, and content promotion—as Model Context Protocol tools that LLM clients can call over HTTP.
    MIT