Wazuh

You can run the Wazuh MCP Server to query agents, alerts, rules, and decoders from Claude or any MCP client. This server exposes a range of MCP tools and resources, providing a scalable way to integrate Wazuh data into your workflows while maintaining strong typing and secure authentication.

How to use

Use the Wazuh MCP Server from an MCP client to access agent information, security alerts, detection rule details, and decoders. You can also leverage the built-in resources and prompts to quickly investigate alerts, check agent health, and review security coverage across your environment. Authentication is handled via JWT tokens with automatic refresh, so you can maintain uninterrupted sessions.

How to install

Prerequisites you need before installation:

• Node.js 20+ installed on your system.

• A running Wazuh manager with API access (default port 55000) and valid Wazuh API credentials.

How to install

# Clone the MCP server repository
git clone https://github.com/solomonneas/wazuh-mcp.git
cd wazuh-mcp

# Install dependencies
npm install

# Build the project for production
npm run build

How to use

Configure your environment with the Wazuh API endpoint and credentials, then start the MCP server. The CLI-based run shows how to initiate the server in both a Claude Desktop setup and a standalone mode.

Claude Desktop configuration

{
  "mcpServers": {
    "wazuh": {
      "command": "node",
      "args": ["/path/to/wazuh-mcp/dist/index.js"],
      "env": {
        "WAZUH_URL": "https://your-wazuh-manager:55000",
        "WAZUH_USERNAME": "wazuh-wui",
        "WAZUH_PASSWORD": "your-password"
      }
    }
  }
}

Standalone start

export WAZUH_URL=https://your-wazuh-manager:55000
export WAZUH_USERNAME=wazuh-wui
export WAZUH_PASSWORD=your-password
npm start

Development

npm run dev    # Watch mode with tsx
npm run lint   # Type checking
npm test       # Run tests

MCP Tools

Agent Tools allow you to list agents, fetch details for a specific agent, and retrieve agent statistics. Alerts Tools enable retrieving recent alerts, a single alert by ID, and performing full-text searches across alerts. Rule Tools let you list, inspect, and search detection rules. Other Tools include listing decoders and querying the Wazuh version.

MCP Resources

Access pre-built views to see all registered agents, 25 most recent alerts, and a summary of detection rules with severity mappings.

MCP Prompts

Use prompts to guide investigations, check agent health, and generate a complete security overview with compliance mappings.

Examples

List active agents, investigate alerts with MITRE mappings, check agent health, and find high-severity rules to review their compliance mappings.

Testing

Run unit tests to verify client interactions and tool handlers without requiring a live Wazuh instance.

Project Structure

The project exposes an MCP server entry point, a Wazuh REST API client with JWT authentication, and modular tool and resource handlers organized under src/.

License

MIT license.

Available tools

list_agents

List all agents with optional status filtering (active, disconnected, never_connected, pending)

get_agent

Get detailed info for a specific agent by ID

get_agent_stats

Get CPU, memory, and disk statistics for an agent

get_alerts

Retrieve recent alerts with filtering by level, agent, rule, and text search

get_alert

Retrieve a single alert by ID

search_alerts

Full-text search across all alerts

list_rules

List detection rules with level and group filtering

get_rule

Get full rule details including compliance mappings

search_rules

Search rules by description text

list_decoders

List log decoders with optional name filtering

get_wazuh_version

Get Wazuh manager version and API info