get_wazuh_alert_summaryLABSCO SUMMARY
Security questions answered from both the Indexer and the Manager in one place.
The value is in the joins a human normally does by hand: an alert on one screen, the agent's processes on another, its vulnerabilities on a third. Pulling all three into one thread is what makes 'what is going on with agent 001' a single question. It is read-oriented, which is the right shape for a system you do not want an agent reconfiguring.
What it is
A Rust server that sits between an MCP client and a Wazuh deployment, reaching both halves of it: the Indexer for alerts and the Manager for agents, rules, vulnerabilities and statistics.
What you get
- A summary of recent security alerts, with the count you ask for
- Vulnerability data per agent, including a critical-only view for triage
- Running processes and open ports on a specific agent, and the list of agents currently reporting
- The detection rules loaded, so you can review what is and is not being caught
- Manager statistics - weekly, remoted and log-collector - plus cluster health and node list
- Manager log search and an error-log view for incident work
Requirements
A running Wazuh server with the API enabled and reachable; the project recommends v4.12. Take a pre-built binary from Releases, pull ghcr.io/gbrigandi/mcp-server-wazuh, or build from source with Rust. Configuration is environment variables: host, port, username and password for both the Manager API and the Indexer. WAZUH_VERIFY_SSL defaults to false, which skips certificate checks - set it to true in production. Transport is stdio, or HTTP with --transport http, which binds to 127.0.0.1 unless you tell it otherwise.
Setup effort
One command plus credentials — docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latest, then supply credentials
USE CASES
01
Triaging what fired overnight
Pull an alert summary with a limit you choose, then follow the agents that show up into their process and port lists.
02
Deciding what to patch first
Read the vulnerability summary for the agents that matter, then narrow to the critical ones and rank by exposure.
03
Investigating an incident in the manager logs
Search the manager logs for the window in question and pull the error log alongside it.
04
Checking coverage is actually complete
List the agents currently reporting and read the cluster health and nodes, so silent gaps get noticed.
05
Reviewing whether the rules earn their keep
Read the rules summary and the manager statistics together, and cut the ones that only make noise.
14 tools
Listed in project docs. Your client may show a different list.
get_wazuh_vulnerability_summaryget_wazuh_critical_vulnerabilitiesget_wazuh_agent_processesget_wazuh_agent_portsget_wazuh_running_agentsget_wazuh_rules_summaryget_wazuh_weekly_statsget_wazuh_remoted_statsget_wazuh_log_collector_statsget_wazuh_cluster_healthget_wazuh_cluster_nodessearch_wazuh_manager_logsget_wazuh_manager_error_logsBEFORE YOU INSTALL
What to know first
Tools you get
14 tools named in the project's documentation. Every tool reads from the Wazuh Manager or Indexer; nothing creates, edits or acknowledges anything. If you read the README, its sample tools/list response lists a single tool; that is an old illustrative excerpt, not the full list.
Requires
- WAZUH_API_PASSWORD in your environment
- WAZUH_INDEXER_PASSWORD in your environment
- WAZUH_API_USERNAME in your environment
- WAZUH_INDEXER_USERNAME in your environment
INSTALLATION
Connect your client
Server setup
From source
TERMINAL
git clone https://github.com/gbrigandi/mcp-server-wazuh.git
cd mcp-server-wazuh
# Build with stdio transport only (default)
cargo build --release
# Build with HTTP transport support
cargo build --release --features http
docker
TERMINAL
docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latestMCP Clients
Claude Desktop — binary
CLAUDE DESKTOP — BINARY · JSON
{
"mcpServers": {
"wazuh": {
"command": "<YOUR_PATH_TO_MCP_SERVER_WAZUH>",
"args": [],
"env": {
"WAZUH_API_HOST": "<YOUR_WAZUH_API_HOST>",
"WAZUH_API_PORT": "55000",
"WAZUH_API_USERNAME": "<YOUR_WAZUH_API_USERNAME>",
"WAZUH_API_PASSWORD": "<YOUR_WAZUH_API_PASSWORD>",
"WAZUH_INDEXER_HOST": "<YOUR_WAZUH_INDEXER_HOST>",
"WAZUH_INDEXER_PORT": "9200",
"WAZUH_INDEXER_USERNAME": "<YOUR_WAZUH_INDEXER_USERNAME>",
"WAZUH_INDEXER_PASSWORD": "<YOUR_WAZUH_INDEXER_PASSWORD>",
"WAZUH_VERIFY_SSL": "false",
"WAZUH_TEST_PROTOCOL": "https",
"RUST_LOG": "info"
}
}
}
}Claude Desktop — Docker
Create a .env file with your Wazuh settings
The container reads its configuration from this file — your Wazuh Manager API and Indexer hosts and logins:
FILE
WAZUH_API_HOST=<YOUR_WAZUH_API_HOST>
WAZUH_API_PORT=55000
WAZUH_API_USERNAME=<YOUR_WAZUH_API_USERNAME>
WAZUH_API_PASSWORD=<YOUR_WAZUH_API_PASSWORD>
WAZUH_INDEXER_HOST=<YOUR_WAZUH_INDEXER_HOST>
WAZUH_INDEXER_PORT=9200
WAZUH_INDEXER_USERNAME=<YOUR_WAZUH_INDEXER_USERNAME>
WAZUH_INDEXER_PASSWORD=<YOUR_WAZUH_INDEXER_PASSWORD>
WAZUH_VERIFY_SSL=false
WAZUH_TEST_PROTOCOL=https
RUST_LOG=infoAdd the server to claude_desktop_config.json
<YOUR_PATH_TO_ENV> is the full path of the file you just created.
CLAUDE DESKTOP — DOCKER · JSON
{
"mcpServers": {
"wazuh": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"--env-file",
"<YOUR_PATH_TO_ENV>",
"ghcr.io/gbrigandi/mcp-server-wazuh:latest"
]
}
}
}
