get_sca_checks
Retrieve individual SCA compliance check results for a Wazuh agent's policy, with optional filters for result type, limit, and pagination offset.
Instructions
Get individual check results for a specific SCA policy on a Wazuh agent
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Agent identifier (e.g., '001') | |
| policy_id | Yes | SCA policy identifier (e.g., 'cis_debian10') | |
| result | No | Filter by check result: passed, failed, or not applicable | |
| limit | No | Maximum number of checks to return (1-500) | |
| offset | No | Pagination offset |
Implementation Reference
- src/tools/sca.ts:58-132 (handler)The 'get_sca_checks' tool handler. Registers the tool with McpServer, defines Zod input schema (agent_id, policy_id, result, limit, offset), calls client.getScaChecks(), and maps the response to a readable JSON output.
server.tool( "get_sca_checks", "Get individual check results for a specific SCA policy on a Wazuh agent", { agent_id: z .string() .describe("Agent identifier (e.g., '001')"), policy_id: z .string() .describe("SCA policy identifier (e.g., 'cis_debian10')"), result: z .enum(["passed", "failed", "not applicable"]) .optional() .describe("Filter by check result: passed, failed, or not applicable"), limit: z .number() .int() .min(1) .max(500) .default(25) .describe("Maximum number of checks to return (1-500)"), offset: z .number() .int() .min(0) .default(0) .describe("Pagination offset"), }, async ({ agent_id, policy_id, result, limit, offset }) => { try { const params: Record<string, string | number> = { limit, offset }; if (result) params.result = result; const response = await client.getScaChecks(agent_id, policy_id, params); const data = response.data; const mapped = { agent_id, policy_id, checks: data.affected_items.map((check) => ({ id: check.id, title: check.title, description: check.description, rationale: check.rationale, remediation: check.remediation, result: check.result, condition: check.condition, command: check.command, references: check.references, compliance: check.compliance, reason: check.reason, })), total: data.total_affected_items, limit, offset, }; return { content: [{ type: "text" as const, text: JSON.stringify(mapped, null, 2) }], }; } catch (error) { return { content: [ { type: "text" as const, text: JSON.stringify({ error: error instanceof Error ? error.message : String(error), }), }, ], isError: true, }; } } ); - src/tools/sca.ts:62-85 (schema)Input schema for the get_sca_checks tool: agent_id (string), policy_id (string), optional result enum (passed/failed/not applicable), limit (1-500, default 25), offset (min 0, default 0).
agent_id: z .string() .describe("Agent identifier (e.g., '001')"), policy_id: z .string() .describe("SCA policy identifier (e.g., 'cis_debian10')"), result: z .enum(["passed", "failed", "not applicable"]) .optional() .describe("Filter by check result: passed, failed, or not applicable"), limit: z .number() .int() .min(1) .max(500) .default(25) .describe("Maximum number of checks to return (1-500)"), offset: z .number() .int() .min(0) .default(0) .describe("Pagination offset"), }, - src/tools/sca.ts:5-133 (registration)The registerScaTools function registers both 'get_sca_policies' and 'get_sca_checks' tools on the McpServer. Called from src/index.ts line 44.
export function registerScaTools( server: McpServer, client: WazuhClient ): void { server.tool( "get_sca_policies", "List Security Configuration Assessment (SCA) policies evaluated on a Wazuh agent", { agent_id: z .string() .describe("Agent identifier (e.g., '001')"), }, async ({ agent_id }) => { try { const response = await client.getScaPolicies(agent_id); const data = response.data; const result = { agent_id, policies: data.affected_items.map((policy) => ({ policy_id: policy.policy_id, name: policy.name, description: policy.description, score: policy.score, pass: policy.pass, fail: policy.fail, invalid: policy.invalid, total_checks: policy.total_checks, hash_file: policy.hash_file, end_scan: policy.end_scan, })), total: data.total_affected_items, }; return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }], }; } catch (error) { return { content: [ { type: "text" as const, text: JSON.stringify({ error: error instanceof Error ? error.message : String(error), }), }, ], isError: true, }; } } ); server.tool( "get_sca_checks", "Get individual check results for a specific SCA policy on a Wazuh agent", { agent_id: z .string() .describe("Agent identifier (e.g., '001')"), policy_id: z .string() .describe("SCA policy identifier (e.g., 'cis_debian10')"), result: z .enum(["passed", "failed", "not applicable"]) .optional() .describe("Filter by check result: passed, failed, or not applicable"), limit: z .number() .int() .min(1) .max(500) .default(25) .describe("Maximum number of checks to return (1-500)"), offset: z .number() .int() .min(0) .default(0) .describe("Pagination offset"), }, async ({ agent_id, policy_id, result, limit, offset }) => { try { const params: Record<string, string | number> = { limit, offset }; if (result) params.result = result; const response = await client.getScaChecks(agent_id, policy_id, params); const data = response.data; const mapped = { agent_id, policy_id, checks: data.affected_items.map((check) => ({ id: check.id, title: check.title, description: check.description, rationale: check.rationale, remediation: check.remediation, result: check.result, condition: check.condition, command: check.command, references: check.references, compliance: check.compliance, reason: check.reason, })), total: data.total_affected_items, limit, offset, }; return { content: [{ type: "text" as const, text: JSON.stringify(mapped, null, 2) }], }; } catch (error) { return { content: [ { type: "text" as const, text: JSON.stringify({ error: error instanceof Error ? error.message : String(error), }), }, ], isError: true, }; } } ); } - src/client.ts:294-300 (helper)Client-side method getScaChecks() that makes the actual HTTP GET request to /sca/{agentId}/checks/{policyId} with query params. Called by the tool handler to fetch SCA check data from the Wazuh API.
async getScaChecks( agentId: string, policyId: string, params: Record<string, string | number> = {} ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhScaCheck>>> { return this.get(`/sca/${agentId}/checks/${policyId}`, params); } - src/types.ts:161-177 (schema)TypeScript interface WazuhScaCheck defining the shape of an SCA check result returned by the Wazuh API.
export interface WazuhScaCheck { id: number; title: string; description?: string; rationale?: string; remediation?: string; result: string; condition?: string; command?: string[]; references?: string; compliance?: Record<string, string[]>; rules?: string[]; file?: string[]; process?: string[]; registry?: string[]; reason?: string; }