get_wazuh_alertsLABSCO SUMMARY
The dangerous half is fenced off, and every action has a check and an undo.
Most servers that can change production stop at "here is the tool". This one splits its surface three ways — act, verify, roll back — so blocking an IP is followed by a tool that asks the agent whether the block is really there, and another that removes it. The 14 tools that change anything sit behind a separate scope that is off unless you grant it, and credentials found in alert full_log fields are redacted before they reach the model.
What it is
An MCP server in front of a Wazuh deployment, exposing 55 security tools across alerts, agents, vulnerabilities, threat analysis, compliance, cluster operations and active response. It reaches both the Wazuh Manager REST API and the Wazuh Indexer, and it runs the same way against a cloud model or a local one through Ollama, which is what makes an air-gapped SOC deployment possible.
What you get
- Alert work over the Indexer — filtering, searching, pattern analysis, and a period summary with no document limit; timestamps take ISO 8601 or relative date math such as
now-24h—get_wazuh_alerts,get_alerts_aggregated,analyze_alert_patterns,search_security_events - Agent state down to running processes, open ports and current configuration —
get_wazuh_agents,check_agent_health,get_agent_processes,get_agent_ports,get_agent_configuration - CVEs by severity, agent and package, with a critical-only view and a summary —
get_wazuh_vulnerabilities,get_wazuh_critical_vulnerabilities,get_wazuh_vulnerability_summary - Compliance scoring for PCI-DSS, HIPAA, SOX, GDPR, NIST and ISO 27001:2022, including Annex A control detail and gap analysis —
run_compliance_check,get_iso27001_gap_analysis,get_sca_policy_checks - Active response: block an IP, isolate a host, kill a process, disable a user, quarantine a file —
wazuh_block_ip,wazuh_isolate_host,wazuh_kill_process,wazuh_quarantine_file - A separate verification family that checks the action actually landed, and a rollback family that undoes it —
wazuh_check_blocked_ip,wazuh_check_agent_isolation,wazuh_unisolate_host,wazuh_restore_file - Cluster health, rule summaries, manager logs and connectivity checks —
get_wazuh_cluster_health,get_wazuh_rules_summary,search_wazuh_manager_logs,validate_wazuh_connection
Requirements
A Wazuh 4.8.0–4.14.7 deployment with API access, plus Docker 20.10+ with Compose v2. WAZUH_HOST, WAZUH_USER and WAZUH_PASS are the three required variables; the server listens on port 3000 and speaks Streamable HTTP at /mcp. The 14 state-changing tools need the wazuh:write scope, which is opt-in via MCP_API_KEY_SCOPES — a token with no scope claim gets read-only. AUTH_SECRET_KEY is mandatory once ENVIRONMENT=production, and the server refuses to start without it. Alert search and vulnerability tools additionally need Indexer credentials (WAZUH_INDEXER_HOST, WAZUH_INDEXER_USER, WAZUH_INDEXER_PASS).
Setup effort
Run a container — build the image from the repository, then point your client at it
USE CASES
01
Triaging the last hour of critical alerts
Pull filtered alerts by level and time window, then read the pattern analysis to see whether the spike is one source or many.
02
Containing a host mid-incident and proving it worked
Isolate the agent or drop the source IP at the firewall, then call the matching check tool so the containment is confirmed from the agent side rather than assumed from a successful API call.
03
Finding which machines still carry unpatched critical CVEs
Query critical vulnerabilities across agents and cross-check the package list against the agent's running processes before scheduling the patch window.
04
Preparing an ISO 27001 review
Run the gap analysis for Annex A, open the control detail for anything failing, and pull the SCA policy checks that back it up.
05
Keeping SIEM data off third-party APIs
Point a local model at the same /mcp endpoint through mcphost or Open WebUI; the tool surface is identical and nothing leaves the network.
55 tools
Listed in project docs. Your client may show a different list.
get_wazuh_alert_summaryget_alerts_aggregatedanalyze_alert_patternssearch_security_eventsget_wazuh_agentsget_wazuh_running_agentscheck_agent_healthget_agent_processesget_agent_portsget_agent_configurationget_wazuh_vulnerabilitiesget_wazuh_critical_vulnerabilitiesget_wazuh_vulnerability_summaryanalyze_security_threatcheck_ioc_reputationsearch_external_contextperform_risk_assessmentget_top_security_threatsgenerate_security_reportrun_compliance_checkget_iso27001_dashboardget_iso27001_control_detailget_iso27001_gap_analysisget_iso27001_alertsget_sca_policy_checksget_wazuh_statisticsget_wazuh_cluster_healthget_wazuh_cluster_nodesget_wazuh_rules_summarysearch_wazuh_manager_logsget_wazuh_manager_error_logsget_wazuh_log_collector_statsget_wazuh_remoted_statsget_wazuh_weekly_statsvalidate_wazuh_connectionwazuh_block_ipwazuh_isolate_hostwazuh_kill_processwazuh_disable_userwazuh_quarantine_filewazuh_firewall_dropwazuh_host_denywazuh_active_responsewazuh_restartwazuh_check_blocked_ipwazuh_check_agent_isolationwazuh_check_processwazuh_check_user_statuswazuh_check_file_quarantinewazuh_unisolate_hostwazuh_enable_userwazuh_restore_filewazuh_firewall_allowwazuh_host_allowBEFORE YOU INSTALL
What to know first
Tools you get
55 tools named in the project's documentation.
Requires
- Docker 20.10+ with Compose v2
- A Wazuh 4.8.0–4.14.7 deployment with API access enabled
- Wazuh Manager API user and password (WAZUH_USER, WAZUH_PASS) in the server's .env
- Wazuh Indexer user and password (WAZUH_INDEXER_USER, WAZUH_INDEXER_PASS) in .env, for alert search and vulnerability tools
INSTALLATION
Connect your client
Server setup
TERMINAL
git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git
cd Wazuh-MCP-Server
cp .env.example .envEdit .env: set WAZUH_HOST, WAZUH_USER and WAZUH_PASS (your Wazuh Manager API host and account). For the alert-search and vulnerability tools also set WAZUH_INDEXER_HOST, WAZUH_INDEXER_USER and WAZUH_INDEXER_PASS; YDC_API_KEY (a You.com key) is optional and only enables search_external_context.
TERMINAL
docker compose up -d
curl http://localhost:3000/healthGet the API key the server generated (your client sends it as a Bearer token):
TERMINAL
docker compose logs wazuh-main-server | grep "API key"MCP Clients
Claude Desktop
Your server must be reachable over HTTPS (Claude Desktop custom connectors need a Claude Pro, Max, Team or Enterprise plan).
Settings → Connectors → Add custom connector
URL:
CLAUDE DESKTOP · URL
<YOUR_SERVER_URL>/mcpIn Advanced settings, add your Bearer token, then click Connect
your-server-domain.com is wherever you deployed the server. In the default bearer mode the token is a JWT: exchange the API key from the server logs with curl -X POST <YOUR_SERVER_URL>/auth/token -H "Content-Type: application/json" -d '{"api_key": "wazuh_your-generated-api-key"}'.
MCPHost
MCPHOST · JSON
{
"mcpServers": {
"wazuh": {
"type": "remote",
"url": "http://localhost:3000/mcp",
"headers": [
"Authorization: Bearer ${env://MCP_API_KEY}"
]
}
}
}Put this in ~/.mcphost.yml (the README writes the same entry in YAML). Before starting mcphost, run export MCP_API_KEY="your-key-from-server-logs" with the API key from the last install step.
Open WebUI
Open WebUI v0.6.31 or newer: in Admin Settings, add an MCP tool server pointed at http://localhost:3000/mcp (or your server's /mcp address), with the server's API key as the Bearer token.
