Wazuh MCP Server

Example Use Cases

• 1

  Retrieve and analyze Wazuh alerts with AI-assisted summaries and filtering via Claude Desktop.

• 2

  Monitor agent health, processes, ports, and configurations and run compliance checks against standard frameworks.

• 3

  Secure local STDIO integration to query Wazuh APIs and the indexer without exposing an HTTP service.

Description

Wazuh MCP Server provides a local STDIO-based FastMCP runtime (29 security tools) that enables Claude Desktop to query Wazuh Server and Indexer APIs for alerts, agents, vulnerabilities, and system monitoring. It offers AI-driven threat analysis, compliance reporting, and health checks while keeping the integration secure by avoiding any HTTP server exposure. The project is production-focused with features like SSL validation, error handling, audit logging, and comprehensive documentation.