Wazuh-MCP-Server

Overview

The Wazuh MCP Server provides AI-powered security operations through natural language queries to Wazuh SIEM systems. It exposes 48 security tools that allow users to query alerts, hunt threats, check vulnerabilities, and trigger active responses across Wazuh deployments through conversation. The server supports both cloud and local LLMs, with robust security features including RBAC, audit logging, input validation, and rate limiting. Production-ready with comprehensive documentation and maintained by an active development team.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• get_wazuh_alerts

  Query and retrieve Wazuh alerts with filtering options

  Try:Show me critical alerts from the last hourTry:Get all alerts for agent-007Try:Find alerts with rule ID 5712
• get_wazuh_alert_summary

  Get a summary of alert statistics and trends

  Try:Give me a summary of today's alertsTry:Show me alert trends for the past 24 hoursTry:Count alerts by severity level
• analyze_alert_patterns

  Analyze patterns and correlations in security alerts

  Try:Analyze patterns in brute force attacksTry:Find recurring alert patterns across agentsTry:Correlate alerts from the same source IP
• get_wazuh_agents

  List all registered Wazuh agents

  Try:Show me all registered agentsTry:List agents with OS type LinuxTry:Count agents by status
• get_wazuh_vulnerabilities

  Query vulnerability data from Wazuh

  Try:Show me all critical vulnerabilitiesTry:Find vulnerabilities on agent-001Try:List vulnerabilities by CVE ID
• analyze_security_threat

  Analyze potential security threats and provide assessments

  Try:Analyze this suspicious login patternTry:Assess the threat level of this alertTry:Determine if this activity is malicious
• wazuh_block_ip

  Block an IP address across Wazuh agents

  Try:Block the IP address 10.0.1.45Try:Block all incoming connections from this sourceTry:Prevent further access from this malicious IP
• wazuh_isolate_host

  Isolate a compromised host from the network

  Try:Isolate agent-007 from the networkTry:Quarantine this compromised hostTry:Disconnect the suspicious agent
• generate_security_report

  Generate a comprehensive security report

  Try:Generate a security report for this weekTry:Create a threat intelligence summaryTry:Prepare an incident response report
• run_compliance_check

  Run compliance checks against security standards

  Try:Check compliance with CIS benchmarksTry:Run a HIPAA compliance scanTry:Verify NIST control adherence
• wazuh_check_blocked_ip

  Verify if an IP is currently blocked

  Try:Check if 10.0.1.45 is still blockedTry:Verify the status of this blocked IPTry:Confirm if the isolation is active
• wazuh_unisolate_host

  Remove isolation from a previously isolated host

  Try:Restore network access to agent-007Try:Un-isolate this compromised hostTry:Remove the quarantine from the agent

Comparable tools

Installation

git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git
cd Wazuh-MCP-Server
cp .env.example .env
# Edit .env with your Wazuh credentials
docker compose up -d

FAQ

What Wazuh versions are supported?

This MCP server supports Wazuh versions 4.8.0 through 4.14.4.

Can I use this with on-premises LLMs?

Yes, it works with local LLMs via Ollama, Open WebUI, or mcphost with no data leaving your network.

Compare Wazuh-MCP-Server with