Enables AI assistants to converse in plain language with a Wazuh SIEM deployment, querying and aggregating alerts, hunting threats, triaging vulnerabilities, running compliance checks, and executing or rolling back active responses across multi-cluster environments. Works with both cloud and fully local, air-gapped LLM clients while enforcing scoped, audited access to the security tools.
Enables integration between Wazuh security platform and AI applications through the MCP framework, providing tools for security analysis, agent management, and system monitoring.
Enables LLM agents to discover and invoke guarded web search, read-only SQLite queries, and sandboxed file read/write tools over the Model Context Protocol. It adds schema validation, rate limiting, output sanitization, request-ID logging, and Prometheus metrics at the protocol boundary.
Enables AI assistants to query Wazuh security alerts, investigate hosts, detect brute-force attempts, and generate security summaries by connecting to a Wazuh manager.