Read-only Wazuh SIEM/XDR control CLI with an MCP adapter
Read-only Wazuh SIEM/XDR control CLI with an MCP adapter
An MCP server that lets an AI client query your Wazuh SIEM/XDR: alerts, agents, vulnerabilities, rules, and more, read-only.
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| list_agents | List all agents with optional status filtering (active, disconnected, never_connected, pending) |
| get_agent | Get detailed info for a specific agent by ID |
| get_agent_stats | Get CPU, memory, and disk statistics for an agent |
| get_alerts | Retrieve recent alerts with filtering by time range, level, agent, rule, and text search |
| get_alert | Retrieve a single alert by ID |
| search_alerts | Full-text search across alerts with optional time range filtering |
| list_vulnerabilities | List vulnerability inventory with optional CVE, agent, severity, and package filters |
| search_vulnerabilities | Search vulnerability inventory by CVE, package, agent, or description |
| list_rules | List detection rules with level and group filtering |
| get_rule | Get full rule details including compliance mappings |
| search_rules | Search rules by description text |
| get_sca_policies | List SCA policies and scores for an agent (CIS benchmarks, etc.) |
| get_sca_checks | Get individual check results with remediation steps and compliance mappings |
| get_agent_os | Get OS information (name, version, architecture, hostname) |
{
"mcpServers": {
"wazuh-1": {
"command": "npx",
"args": ["-y", "invocation"],
"env": {
"WAZUH_URL": "your-value",
"WAZUH_USERNAME": "your-value",
"WAZUH_PASSWORD": "your-value",
"WAZUH_INDEXER_URL": "your-value",
"WAZUH_INDEXER_USERNAME": "your-value",
"WAZUH_INDEXER_PASSWORD": "your-value",
"WAZUH_BASE_URL": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| WAZUH_URL | Endpoint or connection string the server talks to. | Yes |
| WAZUH_USERNAME | Configuration value read at startup. | Optional |
| WAZUH_PASSWORD | Configuration value read at startup. | Optional |
| WAZUH_INDEXER_URL | Endpoint or connection string the server talks to. | Yes |
| WAZUH_INDEXER_USERNAME | Configuration value read at startup. | Optional |
| WAZUH_INDEXER_PASSWORD | Configuration value read at startup. | Optional |
| WAZUH_BASE_URL | Endpoint or connection string the server talks to. | Yes |
Queries the NIST National Vulnerability Database (NVD) via its API.
Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.
Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.
Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi
Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.
A comprehensive Model Context Protocol (MCP) server for ABP.IO framework with 48+ tools for application development, UI generation, and management