Skip to main content
Glama
nks1097

Wazuh Servidor MCP

by nks1097
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

Wazuh Servidor MCP

License: MIT Python 3.11+ MCP

Talk to your SIEM. Query alerts, hunt threats, check vulnerabilities, and trigger active responses across your Wazuh deployment through natural conversation with any AI assistant via Model Context Protocol (MCP).

Features & Capabilities

  • Alert & Event Search: Query Elasticsearch/Indexer alerts, filter by severity, rule ID, or agent.

  • Agent Management: Monitor agent statuses, active processes, open ports, and configurations.

  • Vulnerability Management: Scan unpatched CVEs across agents.

  • Active Response: Block malicious IPs, isolate compromised hosts, terminate processes, and manage file quarantine.

  • Verification & Rollback: Check status of active response actions and undo them when needed.

  • Security & RBAC: Rate limiting, token-based authentication, log sanitization, and audit logging.

Related MCP server: Wazuh MCP Server

Ferramentas de Segurança Disponíveis (56 Ferramentas em Português)

Categoria

Ferramentas

Descrição

Alertas e Eventos

obter_alertas_wazuh obter_resumo_alertas_wazuh analisar_padroes_alertas buscar_eventos_seguranca

Consulta, filtragem e análise comportamental de alertas e eventos

Agentes e Grupos

obter_agentes_wazuh obter_agentes_ativos_wazuh verificar_saude_agente obter_processos_agente obter_portas_agente obter_configuracao_agente obter_pacotes_agente obter_alteracoes_fim_agente gerenciar_grupos_agente

Monitoramento de agentes, processos, portas, FIM/syscheck, pacotes instalados e gestão/criação/exclusão de grupos

Vulnerabilidades

obter_vulnerabilidades_wazuh obter_vulnerabilidades_criticas_wazuh obter_resumo_vulnerabilidades_wazuh

Consulta de CVEs e pacotes vulneráveis por severidade

Regras e Testes

obter_resumo_regras_wazuh obter_detalhes_regra_wazuh testar_mensagem_log_wazuh criar_regra_customizada_wazuh modificar_regra_customizada_wazuh excluir_regra_customizada_wazuh

Inspeção, simulação (wazuh-logtest), criação, modificação e exclusão de regras XML customizadas

Análise e Relatórios

analisar_ameaca_seguranca verificar_reputacao_ioc executar_avaliacao_risco obter_principais_ameacas_seguranca gerar_relatorio_seguranca executar_teste_conformidade

Análise de ameaças, reputação de IOCs, cálculo de risco e conformidade (PCI-DSS, CIS, NIST)

Resposta Ativa

resposta_ativa_wazuh bloquear_ip_wazuh isolar_host_wazuh encerrar_processo_wazuh desabilitar_usuario_wazuh quarentena_arquivo_wazuh bloquear_firewall_wazuh negar_host_wazuh reiniciar_servico_wazuh

Execução de ações defensivas diretas no ambiente

Verificação e Desfazer

verificar_ip_bloqueado_wazuh verificar_isolamento_agente_wazuh verificar_processo_wazuh verificar_status_usuario_wazuh verificar_quarentena_arquivo_wazuh desisolar_host_wazuh habilitar_usuario_wazuh restaurar_arquivo_wazuh permitir_firewall_wazuh permitir_host_wazuh

Confirmação e rollback de remediações defensivas

Quick Start

Prerequisites

  • Python 3.11+

  • Wazuh Manager (v4.8.0+) with API credentials enabled

  • Docker & Docker Compose (optional, for containerized run)

Installation

  1. Clone repository and configure environment:

    git clone https://github.com/nks1097/Wazuh_Servidor_MCP.git
cd Wazuh_Servidor_MCP
cp .env.example .env

  2. Configure .env:

    WAZUH_HOST=https://your-wazuh-manager
WAZUH_USER=wazuh-api-user
WAZUH_PASS=wazuh-api-password
WAZUH_PORT=55000
MCP_HOST=127.0.0.1
MCP_PORT=3000
AUTH_MODE=bearer
MCP_API_KEY=your-secure-api-key

  3. Run with Python:

    python -m venv venv
source venv/bin/activate  # Or `venv\Scripts\activate` on Windows
pip install -r requirements.txt
python -m wazuh_mcp_server

    Or run via Docker:

    docker compose up -d

  4. Verify Health:

    curl http://localhost:3000/health

Connecting to MCP Clients

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "wazuh": {
      "command": "python",
      "args": ["-m", "wazuh_mcp_server"],
      "env": {
        "WAZUH_HOST": "https://your-wazuh-manager",
        "WAZUH_USER": "wazuh-api-user",
        "WAZUH_PASS": "wazuh-api-password"
      }
    }
  }
}

Open WebUI / Remote SSE Endpoint

Endpoint: http://localhost:3000/mcp (Streamable HTTP) or http://localhost:3000/sse

Key Configuration Variables

Variable

Default

Description

WAZUH_HOST

Required

Hostname or IP of Wazuh Manager

WAZUH_USER

Required

API Username

WAZUH_PASS

Required

API Password

WAZUH_PORT

55000

Wazuh API Port

MCP_HOST

127.0.0.1

MCP Server Bind Host

MCP_PORT

3000

MCP Server Bind Port

AUTH_MODE

bearer

Authentication mode (bearer, oauth, none)

WAZUH_VERIFY_SSL

true

Verify SSL certificates (true/false)

API Endpoints

  • /mcp - MCP Streamable HTTP endpoint

  • /sse - Legacy Server-Sent Events endpoint

  • /health - Service health status

  • /metrics - Prometheus metrics

  • /docs - OpenAPI documentation

License

MIT License

This server cannot be installed

A
license - permissive license
-
quality - not tested
C
maintenance

How are these scores calculated?

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • wazuh-mcp-server

    Sbharadwaj05
    A
    license
    A
    quality
    B
    maintenance
    AI-powered MCP server that enables security analysts to query Wazuh SIEM/XDR for alert triage, threat hunting, compliance audits, and incident response through natural language prompts.
    Last updated
    28
    13
    MIT

  • Wazuh MCP Server

    gensecaihq
    A
    license
    -
    quality
    A
    maintenance
    Enables natural language interaction with Wazuh SIEM to query alerts, hunt threats, check vulnerabilities, and trigger active responses.
    Last updated
    212
    MIT

  • AI4IA-MCP-Server

    RezzFayyazi
    A
    license
    -
    quality
    D
    maintenance
    Bridges AI assistants with Wazuh SIEM infrastructure, providing natural language access to security alerts, vulnerability analysis, CVE databases, and network documentation for security operations.
    Last updated
    MIT

  • AI Detection Engineering

    Simoon896
    A
    license
    -
    quality
    B
    maintenance
    An MCP server that enables conversational interaction with Wazuh SIEM, allowing users to investigate alerts, hunt threats, tune false positives, edit rules, and run security actions via natural language.
    Last updated
    MIT

View all related MCP servers

Related MCP Connectors

  • oracle42-intelligence

    AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.

  • AgentAegis

    Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

  • security-intel-mcp

    CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/nks1097/Wazuh_Servidor_MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server