❯ git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git ▌

Wazuh MCP Server: Connect Claude or any LLM to your Wazuh SIEM through the Model Context Protocol

View on GitHub262 stars68 forksPython · MIT licence · by Aloke Majumder

Wazuh MCP Server is a production-grade Model Context Protocol (MCP) server that lets Claude, or any MCP-capable LLM client, work directly with a Wazuh SIEM. Analysts ask questions in plain language, and the server turns them into safe, scoped calls against Wazuh: alerts, agents, vulnerabilities, compliance and active response.

It is read-only by default. State-changing actions need an explicit write scope that is never granted implicitly, and active response comes with verification and rollback. It is also the tool layer underneath Wazuh Autopilot, my agentic SOC for Wazuh.

What Wazuh MCP Server Does

55 security tools

Eight toolsets: alerts, agents, vulnerabilities, threat analysis, compliance, manager and cluster health, and active response with verification and rollback, plus guided prompts and resources.

Compliance built in

Compliance views for PCI DSS, HIPAA, SOX, GDPR, NIST and ISO 27001:2022 straight from your Wazuh data.

Read-only by default

The 14 state-changing tools require the wazuh:write scope, which is never granted implicitly.

Enterprise authentication

Bearer tokens from an API key, or OAuth 2.0 with PKCE and sign-in through Entra ID, Google Workspace, Okta or Keycloak.

Works with Claude and more

Claude custom connectors (claude.ai and Claude Desktop) over OAuth; Open WebUI, LibreChat and scripts over bearer tokens.

Local and air-gapped

The server never calls a model itself. Pair it with a local vLLM + Open WebUI stack to keep SIEM data on-premises.

How It Works

01The server speaks Streamable HTTP at /mcp and supports current and earlier MCP protocol revisions.
02Deploy with Docker Compose or the published multi-arch image; add Redis for multi-instance sessions and multi-cluster routing if you need it.
03Supports Wazuh 4.8.0 through 4.14.7. Alert, vulnerability and alert-backed compliance tools need the Wazuh Indexer.

Who It's For

SOC teams on Wazuh who want AI-assisted triage and threat hunting
Security engineers building AI agents on top of a SIEM
Organisations that need compliance answers from Wazuh data quickly
Teams that must keep security data on-premises with a local LLM

Wazuh MCP Server: FAQs

❯

What is the Wazuh MCP Server?

An open-source Model Context Protocol server that connects Claude or any MCP-capable LLM client to a Wazuh SIEM, exposing 55 security tools for alert triage, threat hunting, vulnerability management, compliance and active response.

❯

How do I connect Claude to Wazuh?

Deploy the Wazuh MCP Server, then add it as a Claude custom connector using its HTTPS /mcp endpoint. Claude signs in with OAuth (authorization code with PKCE). Other clients such as Open WebUI and LibreChat use a bearer token.

❯

Can it change my Wazuh configuration or run active response?

Only if you allow it. The server is read-only by default; the 14 state-changing tools require the wazuh:write scope, and active response includes verification and rollback.

❯

Does it work with local or air-gapped LLMs?

Yes. The server only executes tools and never calls a model. You can pair it with a local vLLM and Open WebUI stack so SIEM data never leaves your network.

❯

Which Wazuh versions are supported?

Wazuh 4.8.0 through 4.14.7, according to the project's compatibility notes. Alert, vulnerability and alert-backed compliance tools need the Wazuh Indexer.

❯

Is the Wazuh MCP Server free?

Yes. It is open source under the MIT licence. If you want help deploying it or building an AI SOC around it, see consulting.

Need help putting it into production?

I built and maintain Wazuh MCP Server. If you want help deploying it, building an AI-assisted SOC around it, or training your team, see AI & security consulting and hands-on training, or get in touch.