Wazuh MCP Server

Wazuh mcp server lets Claude, Cursor and other MCP clients work with Wazuh directly. A Rust-based server designed to bridge the gap between a Wazuh Security Information and Event Management (SIEM) system and applications requiring contextual security data, specifically tailored for the Claude Desktop Integration using the Model Context Protocol (MCP).

What Wazuh does

A Rust-based server designed to bridge the gap between a Wazuh Security Information and Event Management (SIEM) system and applications requiring contextual security data, specifically tailored for the Claude Desktop Integration using the Model Context Protocol (MCP).

Modern AI assistants like Claude can benefit significantly from real-time context about the user's security environment. The Wazuh MCP Server bridges this gap by providing comprehensive access to Wazuh SIEM data through natural language interactions.

Tools it exposes

Once connected, the assistant can call these 14 tools directly:

• Risk — Based Vulnerability Prioritization:** Correlate vulnerability data with agent criticality and exposure to focus remediation efforts
• Agent — Specific Investigation:** Combine multiple tools to build comprehensive profiles of specific agents during security incidents
• Cross — Component Analysis:** Correlate data from both Wazuh Indexer (alerts) and Wazuh Manager (agents, rules, vulnerabilities) for comprehensive security insights
• Multi — Source Intelligence:** Leverage analyzers for reputation checks, malware analysis, domain analysis, and behavioral analysis
• Collaboration — ** Enable security team collaboration on incidents detected by Wazuh
• Server — Sent Events (SSE) for streaming responses
• Variable — Description
• WAZUH_API_HOST — Hostname or IP address of the Wazuh Manager API server
• WAZUH_API_PORT — Port number for the Wazuh Manager API
• WAZUH_API_USERNAME — Username for Wazuh Manager API authentication
• WAZUH_API_PASSWORD — Password for Wazuh Manager API authentication
• WAZUH_INDEXER_HOST — Hostname or IP address of the Wazuh Indexer API server
• WAZUH_INDEXER_PORT — Port number for the Wazuh Indexer API
• WAZUH_INDEXER_USERNAME — Username for Wazuh Indexer API authentication

Installing the wazuh mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Configuration

The server reads 8 environment variables: WAZUH_API_HOST, WAZUH_API_PORT, WAZUH_API_USERNAME, WAZUH_API_PASSWORD, WAZUH_INDEXER_HOST, WAZUH_INDEXER_PORT, WAZUH_INDEXER_USERNAME, WAZUH_INDEXER_PASSWORD. Keep credentials in your client's env block or a secrets manager rather than committing them.

Requirements

• An MCP (Model Context Protocol) compatible LLM client (e.g., Claude Desktop) - A running Wazuh server (v4.12 recommended) with the API enabled and accessible. - Network connectivity between this server and the Wazuh API (if API interaction is used).

Where it fits

Developer-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. Wazuh sits in that group, and the shape of its toolset — Risk, Agent, Cross among others — tells you what it is really for. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• With 14 tools exposed, expect a noticeable bump in prompt size — disable it in projects that never use Wazuh.
• Maintained by gbrigandi, written in Go.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the wazuh mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.