Rust-based MCP (Model Context Protocol) server that exposes Wazuh SIEM data to LLM clients via stdio or optional HTTP.
https://github.com/gbrigandi/mcp-server-wazuhStop wrestling with complex SIEM queries and API documentation. This MCP server transforms your Wazuh security data into natural conversations with AI assistants like Claude.
Instead of memorizing API endpoints and crafting elaborate queries, you can now ask questions like "Show me critical vulnerabilities on web servers" or "What processes are running on agent 001?" and get structured, actionable data from your Wazuh deployment.
Security operations teams spend too much time fighting with tools instead of fighting threats. Traditional SIEM interfaces require:
This MCP server eliminates that friction by providing direct access to your Wazuh data through natural language interactions.
Alert Triage in Seconds Ask "What are the highest priority alerts from the last hour?" instead of navigating through multiple API calls and alert dashboards. Get immediate context with agent details, vulnerability scores, and recommended actions.
Vulnerability Management Made Simple Query "Show me all critical vulnerabilities on production web servers" and receive prioritized remediation guidance instead of parsing through CSV exports and cross-referencing asset inventories.
Incident Response Acceleration During security incidents, ask "What processes are running on the compromised host?" or "Show me all network connections from this agent" to get forensic data in real-time without switching tools.
Compliance Reporting Without Pain Generate evidence for PCI-DSS, HIPAA, or GDPR audits by asking natural language questions about your security posture instead of building custom reports.
The server provides deep integration with both Wazuh Manager and Wazuh Indexer, giving you access to:
Built in Rust for performance and reliability, this server handles production workloads with proper SSL validation, authentication, and error handling. Deploy it as a binary, Docker container, or build from source - whatever fits your infrastructure.
The stdio transport integrates seamlessly with Claude Desktop, while optional HTTP endpoints support custom integrations.
Pair this with the Cortex MCP Server for complete threat intelligence workflows. Automatically analyze suspicious artifacts from Wazuh alerts using 140+ analyzers including VirusTotal, Shodan, and MISP.
When Wazuh detects a suspicious file hash, your AI assistant can automatically analyze it through multiple threat intelligence sources and provide contextualized recommendations for response actions.
Quick Setup with Pre-built Binary:
claude_desktop_config.json with Wazuh connection detailsDocker Deployment:
docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latest
Configure environment variables for your Wazuh Manager and Indexer connections, then integrate with your preferred MCP client.
The server connects to both your Wazuh Manager API (port 55000) and Wazuh Indexer (port 9200) to provide comprehensive security context from a single interface.
Transform your security operations from reactive dashboard-driven investigations to proactive, conversation-driven threat hunting. Your security team will thank you.