Skip to main content
Glama
lidless-labs

wazuh-mcp

by lidless-labs
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

Related Servers

Alternatives to wazuh-mcp

No user-submitted related servers found.

    Related Servers

    • wazuh-mcp-server

      Sbharadwaj05
      A
      license
      A
      quality
      C
      maintenance
      AI-powered MCP server that enables security analysts to query Wazuh SIEM/XDR for alert triage, threat hunting, compliance audits, and incident response through natural language prompts.
      28
      13
      MIT

    • AI Detection Engineering

      Simoon896
      A
      license
      Not graded
      quality
      D
      maintenance
      An MCP server that enables conversational interaction with Wazuh SIEM, allowing users to investigate alerts, hunt threats, tune false positives, edit rules, and run security actions via natural language.
      MIT

    • Wazuh SIEM Agent System

      flybfree
      F
      license
      Not graded
      quality
      D
      maintenance
      A Claude-powered MCP tool suite for interacting with a Wazuh SIEM manager, enabling triage, health monitoring, threat hunting, rule management, and active response execution.
      -

    • wazuh-mcp-soc

      cisse-lalya
      F
      license
      Not graded
      quality
      C
      maintenance
      Enables natural-language security operations by connecting Wazuh SIEM to Claude Desktop via MCP, allowing querying of alerts, agents, vulnerabilities, and generating security reports with Slack integration.
      1
      -

    • klaxon

      sec73
      A
      license
      A
      quality
      A
      maintenance
      An MCP server that connects language models to a Wazuh SIEM cluster, enabling read-only plain-language queries, schema inspection, field coverage analysis, and decoder testing.
      10
      Apache 2.0

    • Wazuh MCP Server

      RayaSatriatama
      A
      license
      Not graded
      quality
      D
      maintenance
      Enables integration between Wazuh security platform and AI applications through the MCP framework, providing tools for security analysis, agent management, and system monitoring.
      4
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.4/5.0

    Scored across 28 tools

    Disambiguation4/5

    Most tools are clearly distinct by resource type (agents, alerts, rules, SCA, vulnerabilities). Minor overlap exists between list_alerts/get_alerts/search_alerts and list_vulnerabilities/search_vulnerabilities, but their descriptions clarify list vs. search vs. single-item retrieval.

    Naming Consistency4/5

    The set predominantly follows a get_/list_/search_ verb + noun pattern, which is consistent and predictable. Minor deviations like diagnose_wazuh_connection and get_wazuh_version are acceptable but break the strict resource-oriented pattern.

    Tool Count4/5

    28 tools is on the heavier side but justified for a security platform covering agents, alerts, rules, decoders, SCA, FIM, vulnerabilities, and manager configuration. It is slightly above the ideal range but not bloated.

    Completeness4/5

    The surface covers the main Wazuh domains well: agent inventory, alerts, rules, decoders, SCA, FIM, vulnerabilities, and manager status. Notable gaps include no agent action tools (restart, remove, add) and no rule/decoder management, but read-only coverage is strong.

    Maintenance

    ActivityStale
    ResponsivenessNo issues

    Resources