wazuh-mcp

A Model Context Protocol (MCP) server for the Wazuh SIEM/XDR platform. Query agents, security alerts, detection rules, and decoders directly from Claude or any MCP-compatible client.

Features

25 MCP Tools - Agents, alerts, rules, decoders, SCA, syscollector, FIM, rootcheck, groups, and manager
3 MCP Resources - Pre-built views for agents, recent alerts, and rule summaries
3 MCP Prompts - Alert investigation, agent health checks, and security overviews
JWT Authentication - Automatic token management with refresh on expiry
Full Compliance Mapping - PCI-DSS, GDPR, HIPAA, NIST 800-53, MITRE ATT&CK
Pagination - All list endpoints support limit/offset pagination
Type-Safe - Full TypeScript with strict mode and Zod schema validation

Prerequisites

Node.js 20+
A running Wazuh manager with API access (default port 55000)
Wazuh API credentials (username/password)
(Optional) Wazuh Indexer (OpenSearch) access for alert queries

Installation

git clone https://github.com/solomonneas/wazuh-mcp.git
cd wazuh-mcp
npm install
npm run build

Configuration

Set the following environment variables:

Variable	Required	Default	Description
`WAZUH_URL`	Yes	-	Wazuh API URL (e.g., `https://10.0.0.2:55000`)
`WAZUH_USERNAME`	Yes	-	API username
`WAZUH_PASSWORD`	Yes	-	API password
`WAZUH_VERIFY_SSL`	No	`false`	Set to `true` to verify SSL certificates

Alternative variable names WAZUH_BASE_URL and WAZUH_USER are also supported.

Wazuh Indexer (OpenSearch) - Required for Alerts

Wazuh 4.x stores alerts in the Wazuh Indexer (OpenSearch), not the REST API. To enable alert tools (get_alerts, get_alert, search_alerts) and the wazuh://alerts/recent resource, configure the indexer connection:

Variable	Required	Default	Description
`WAZUH_INDEXER_URL`	No	-	Wazuh Indexer URL (e.g., `https://10.0.0.2:9200`)
`WAZUH_INDEXER_USERNAME`	No	`admin`	Indexer username
`WAZUH_INDEXER_PASSWORD`	No	-	Indexer password
`WAZUH_INDEXER_VERIFY_SSL`	No	`false`	Set to `true` to verify SSL certificates

If WAZUH_INDEXER_URL is not set, alert tools will return a helpful configuration message. All other tools (agents, rules, decoders, version) work without the indexer.

Usage

Claude Desktop

Add to your Claude Desktop configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "wazuh": {
      "command": "node",
      "args": ["/path/to/wazuh-mcp/dist/index.js"],
      "env": {
        "WAZUH_URL": "https://your-wazuh-manager:55000",
        "WAZUH_USERNAME": "wazuh-wui",
        "WAZUH_PASSWORD": "your-password",
        "WAZUH_INDEXER_URL": "https://your-wazuh-indexer:9200",
        "WAZUH_INDEXER_USERNAME": "admin",
        "WAZUH_INDEXER_PASSWORD": "your-indexer-password"
      }
    }
  }
}

OpenClaw

Add to your openclaw.json:

{
  "mcp": {
    "servers": {
      "wazuh": {
        "type": "stdio",
        "command": "node",
        "args": ["/path/to/wazuh-mcp/dist/index.js"],
        "env": {
          "WAZUH_URL": "https://your-wazuh-manager:55000",
          "WAZUH_USERNAME": "wazuh-wui",
          "WAZUH_PASSWORD": "your-password",
          "WAZUH_INDEXER_URL": "https://your-wazuh-indexer:9200",
          "WAZUH_INDEXER_USERNAME": "admin",
          "WAZUH_INDEXER_PASSWORD": "your-indexer-password"
        }
      }
    }
  }
}

Standalone

export WAZUH_URL=https://your-wazuh-manager:55000
export WAZUH_USERNAME=wazuh-wui
export WAZUH_PASSWORD=your-password
npm start

Development

npm run dev    # Watch mode with tsx
npm run lint   # Type checking
npm test       # Run tests

MCP Tools

Agent Tools

Tool	Description
`list_agents`	List all agents with optional status filtering (active, disconnected, never_connected, pending)
`get_agent`	Get detailed info for a specific agent by ID
`get_agent_stats`	Get CPU, memory, and disk statistics for an agent

Alert Tools

Tool	Description
`get_alerts`	Retrieve recent alerts with filtering by level, agent, rule, and text search
`get_alert`	Retrieve a single alert by ID
`search_alerts`	Full-text search across all alerts

Rule Tools

Tool	Description
`list_rules`	List detection rules with level and group filtering
`get_rule`	Get full rule details including compliance mappings
`search_rules`	Search rules by description text

SCA Tools (Security Configuration Assessment)

Tool	Description
`get_sca_policies`	List SCA policies and scores for an agent (CIS benchmarks, etc.)
`get_sca_checks`	Get individual check results with remediation steps and compliance mappings

Syscollector Tools (System Inventory)

Tool	Description
`get_agent_os`	Get OS information (name, version, architecture, hostname)
`get_agent_packages`	List installed software packages with versions
`get_agent_processes`	List running processes with PIDs and command lines
`get_agent_ports`	List open network ports with associated processes
`get_agent_network`	List network interfaces and IP addresses
`get_agent_hotfixes`	List installed Windows hotfixes/patches

FIM & Rootcheck Tools

Tool	Description
`get_fim_files`	Get File Integrity Monitoring results (files, registry keys, hashes)
`get_rootcheck`	Get rootkit detection scan findings

Manager Tools

Tool	Description
`get_manager_logs`	Get Wazuh manager logs filtered by level and module
`get_manager_config`	Get active manager configuration by section

Group Tools

Tool	Description
`list_groups`	List all agent groups
`get_group_agents`	List agents in a specific group

Other Tools

Tool	Description
`list_decoders`	List log decoders with optional name filtering
`get_wazuh_version`	Get Wazuh manager version and API info

MCP Resources

Resource URI	Description
`wazuh://agents`	All registered agents and their status
`wazuh://alerts/recent`	25 most recent security alerts
`wazuh://rules/summary`	Detection rules sorted by severity

MCP Prompts

Prompt	Description
`investigate-alert`	Step-by-step alert investigation with MITRE mapping and remediation
`agent-health-check`	Comprehensive agent health assessment (status, resources, alerts)
`security-overview`	Full environment security summary with compliance coverage

Examples

List active agents

Use list_agents with status "active" to see all connected agents.

Investigate a brute force attempt

Search alerts for "brute force" and investigate the top result,
including the MITRE ATT&CK technique and remediation steps.

Check agent health

Run an agent health check on agent 001 - check its connection status,
resource usage, and any recent critical alerts.

Find high-severity rules

List all rules with level 12 or higher to see critical detection rules
and their compliance framework mappings.

Testing

npm test              # Run all tests
npm run test:watch    # Watch mode

Tests use mocked Wazuh API responses - no live Wazuh instance needed.

Project Structure

wazuh-mcp/
├── src/
│   ├── index.ts           # MCP server entry point
│   ├── config.ts          # Environment configuration
│   ├── client.ts          # Wazuh REST API client (JWT auth)
│   ├── indexer-client.ts  # Wazuh Indexer (OpenSearch) client
│   ├── types.ts           # TypeScript type definitions
│   ├── resources.ts       # MCP resource handlers
│   ├── prompts.ts         # MCP prompt templates
│   └── tools/
│       ├── agents.ts      # Agent management tools
│       ├── alerts.ts      # Alert query tools
│       ├── rules.ts       # Rule query tools
│       ├── decoders.ts    # Decoder listing tool
│       ├── version.ts     # Version info tool
│       ├── sca.ts         # Security Configuration Assessment
│       ├── syscollector.ts # System inventory (OS, packages, ports, etc.)
│       ├── syscheck.ts    # File Integrity Monitoring
│       ├── rootcheck.ts   # Rootkit detection
│       ├── manager.ts     # Manager logs and configuration
│       └── groups.ts      # Agent group management
├── tests/
│   ├── client.test.ts     # API client unit tests
│   └── tools.test.ts      # Tool handler unit tests
├── package.json
├── tsconfig.json
├── tsup.config.ts
└── vitest.config.ts

License

MIT

Name		Name	Last commit message	Last commit date
Latest commit History 17 Commits
.github/workflows		.github/workflows
scripts		scripts
src		src
tests		tests
.env.example		.env.example
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
package-lock.json		package-lock.json
package.json		package.json
tsconfig.json		tsconfig.json
tsup.config.ts		tsup.config.ts
vitest.config.ts		vitest.config.ts

Folders and files

Latest commit

History

Repository files navigation

wazuh-mcp

Features

Prerequisites

Installation

Configuration

Wazuh Indexer (OpenSearch) - Required for Alerts

Usage

Claude Desktop

OpenClaw

Standalone

Development

MCP Tools

Agent Tools

Alert Tools

Rule Tools

SCA Tools (Security Configuration Assessment)

Syscollector Tools (System Inventory)

FIM & Rootcheck Tools

Manager Tools

Group Tools

Other Tools

MCP Resources

MCP Prompts

Examples

List active agents

Investigate a brute force attempt

Check agent health

Find high-severity rules

Testing

Project Structure

License

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages