gbrigandi/mcp-server-wazuh

Overview

An MCP server written in Rust that exposes Wazuh SIEM functionality through the Model Context Protocol. It lets AI agents like Claude query security alerts, manage agents, and retrieve compliance data via the Wazuh API.

Best for

Best for
Security teams who want to integrate AI assistant capabilities with their Wazuh SIEM deployment

Use cases

• Query and summarize security alerts from Wazuh
• Manage Wazuh agents (list, add, remove) through natural language
• Retrieve compliance and vulnerability scan results

How to use

Tools exposed

• WAZUH_API_HOST
• WAZUH_API_PORT
• WAZUH_API_USERNAME
• WAZUH_API_PASSWORD
• WAZUH_INDEXER_HOST
• WAZUH_INDEXER_PORT
• WAZUH_INDEXER_USERNAME
• WAZUH_INDEXER_PASSWORD
• WAZUH_VERIFY_SSL
• WAZUH_TEST_PROTOCOL
• RUST_LOG

Tested with

Claude Desktop

Notes

An MCP server written in Rust that exposes Wazuh SIEM functionality through the Model Context Protocol. It lets AI agents like Claude query security alerts, manage agents, and retrieve compliance data via the Wazuh API.

210 stars on GitHub. Last updated 2025-12-12. Licensed MIT.

Use cases

• Query and summarize security alerts from Wazuh
• Manage Wazuh agents (list, add, remove) through natural language
• Retrieve compliance and vulnerability scan results

Pros

• 210 stars on GitHub, indicating community adoption and reliability
• Written in Rust for performance and memory safety
• Enables natural language interaction with Wazuh SIEM using MCP clients

Cons

• Requires an existing Wazuh SIEM deployment to function
• Only works with MCP-compatible clients (e.g., Claude)
• May have limited documentation or early stage maturity

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.