The value is in the joins a human normally does by hand: an alert on one screen, the agent's processes on another, its vulnerabilities on a third. Pulling all three into one thread is what makes 'what is going on with agent 001' a single question. It is read-oriented, which is the right shape for a system you do not want an agent reconfiguring.
A Rust server that sits between an MCP client and a Wazuh deployment, reaching both halves of it: the Indexer for alerts and the Manager for agents, rules, vulnerabilities and statistics.
- A summary of recent security alerts, with the count you ask for
- Vulnerability data per agent, including a critical-only view for triage
- Running processes and open ports on a specific agent, and the list of agents currently reporting
- The detection rules loaded, so you can review what is and is not being caught
- Manager statistics - weekly, remoted and log-collector - plus cluster health and node list
- Manager log search and an error-log view for incident work
A running Wazuh server with the API enabled and reachable; the project recommends v4.12. Take a pre-built binary from Releases, pull ghcr.io/gbrigandi/mcp-server-wazuh, or build from source with Rust. Configuration is environment variables: host, port, username and password for both the Manager API and the Indexer. WAZUH_VERIFY_SSL defaults to false, which skips certificate checks - set it to true in production. Transport is stdio, or HTTP with --transport http, which binds to 127.0.0.1 unless you tell it otherwise.
One command plus a key — docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latest, then supply credentials