Wazuh MCP Server

Example Use Cases

• 1

  Conversational access to Wazuh SIEM alerts and vulnerabilities

• 2

  Analyze and triage security events using AI

• 3

  Generate compliance reports and monitor agent health

Description

This MCP server provides a secure bridge between AI assistants like Claude and Wazuh SIEM, enabling natural language queries for alerts, vulnerabilities, agent health, and compliance reports. It supports 48 specialized security tools and is fully compliant with the MCP 2025-11-25 protocol. Designed for production use, it includes features like OAuth 2.0 authentication, rate limiting, circuit breakers, and Prometheus metrics, and is deployable via Docker across multiple platforms. It facilitates both manual conversational access and integration with autonomous AI agents for advanced SOC automation.