MCP Server Wazuh, developed by Gbrigandi, is a free, Rust-based tool for the mcp platform. It connects directly to Wazuh Security Information and Event Management (SIEM) deployments, interacting with both the Wazuh Manager API and Wazuh Indexer API. This specialized server extends Wazuh capabilities by exposing a set of tools designed for various security operations. It supports multiple transport protocols and AI client integrations, making it a versatile component for security teams. The program is distributed by cloning its GitHub repository and building with Rust, or by downloading pre-built binaries.

What does MCP Server Wazuh connect to?

MCP Server Wazuh establishes connections with a Wazuh Security Information and Event Management (SIEM) deployment. Specifically, it interacts with the Wazuh Manager API and the Wazuh Indexer API. This integration allows it to access and manipulate data within the Wazuh ecosystem, providing a programmatic interface to the SIEM's core functions. Its category is defined as "MCP server" and "Specialized," indicating its focused role within security infrastructure. It acts as a bridge, enabling external systems and users to engage with Wazuh data and controls.

Core features and tools

The server provides 14 specialized tools to interact with Wazuh SIEM capabilities. These include alert triage, vulnerability management, agent management, security rules, system statistics, and forensic analysis. Notable callable tools are get_wazuh_alert_summary, get_wazuh_alerts, wazuh_block_ip, get_wazuh_critical_vulnerabilities, get_rule, and get_wazuh_version. It supports stdio for local desktop integrations, alongside optional HTTP transport, including Streamable HTTP via the "/mcp" endpoint and legacy Server-Sent Events (SSE) through the "/sse" endpoint for remote deployments.

Who is it for?

MCP Server Wazuh is designed for security teams, developers, SOC analysts, threat hunters, compliance officers, and security engineers. It empowers these professionals to interact with their Wazuh SIEM deployment using natural language or programmatic interfaces. The tool is particularly useful for those managing security operations, incident response, and compliance reporting. It aims to enhance efficiency in querying security infrastructure and automating response actions. This is not the right fit if you lack an existing Wazuh SIEM deployment.

How to get started

The server authenticates using configured Wazuh API credentials, which can be a username and password, or through Bearer token authentication. It also supports OAuth 2.0 with Dynamic Client Registration and an authless read-only mode. Configuration involves setting environment variables such as WAZUH_API_HOST and WAZUH_API_USERNAME, or using a .env file.

Use cases

• Natural Language Security Operations and Threat Analysis: Querying security infrastructure using natural language, such as "Show me critical vulnerabilities on our production web servers."
• Incident Response and Alert Triage: Automating alert categorization, enriching alerts with threat intelligence, and executing active response commands like blocking a malicious IP.
• Compliance Monitoring and Reporting: Generating compliance reports for frameworks such as PCI-DSS, HIPAA, SOX, and GDPR, along with performing gap analysis.

MCP Server Wazuh offers a powerful interface for interacting with Wazuh SIEM deployments, bridging security operations with various AI clients and programmatic access. Its specialized tools and flexible authentication methods make it a valuable asset for enhancing security workflows. The program enables advanced natural language queries and automated incident response actions.