List Wazuh security detection rules filtered by severity level and group name.
List all Wazuh rules with optional level and group filtering
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort field with direction prefix (e.g., '-level') | |
| group | No | Filter by rule group name | |
| level | No | Filter by rule severity level | |
| limit | No | Maximum number of items to return (1-100) | |
| offset | No | Pagination offset |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.1.0Input schema / $schemaRemoved value: -"http://json-schema.org/draft-07/schema#"Input schema / properties / group / maxLengthAdded value: +256Input schema / properties / group / minLengthAdded value: +1Input schema / properties / group / patternAdded value: +"^[\\p{L}\\p{N}\\s._:@/+,\\-#()[\\]]+$"Input schema / properties / limit / descriptionPrevious value: -"Maximum number of rules to return (1-100)"New value: +"Maximum number of items to return (1-100)"Input schema / properties / offset / maximumPrevious value: -9007199254740991New value: +100000Input schema / properties / sort / enumAdded value: +[
+ "level",
+ "-level",
+ "+level",
+ "id",
+ "-id",
+ "+id"
+]Input schema / additionalPropertiesRemoved value: -falseInput schema / properties / level / maximumAdded value: +9007199254740991Input schema / properties / offset / maximumAdded value: +9007199254740991v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must cover behavior. Does not mention pagination, sorting, or read-only nature, leaving gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence conveys core purpose but omits important behavioral details; too brief for full clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Does not address pagination, sorting, or result structure despite having limit/offset/sort params. Incomplete given lack of output schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. Description adds no new info beyond schema descriptions for level and group filtering.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states 'List all Wazuh rules' with filtering options, clearly distinguishing from get_rule (single) and search_rules (full-text).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this vs. alternatives like search_rules. Implies filtering use but lacks explicit context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/lidless-labs/wazuh-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server