Monitoring · Security

Wazuh logo

Wazuh

unmuktoai/wazuh-mcp-server

Lets an MCP client — Claude, Open WebUI backed by a local model, or any client that speaks Streamable HTTP — query alerts, agents, vulnerabilities and compliance data, and dispatch active responses, with scope-based access control and audit logging.

Install

docker run -d --name wazuh-mcp-server --env-file .env -e MCP_HOST=0.0.0.0 -e ENVIRONMENT=production \

Environment variables

WAZUH_HOSTWAZUH_USERWAZUH_PASSWAZUH_INDEXER_HOSTWAZUH_INDEXER_USERWAZUH_INDEXER_PASSVLLM_API_KEYWEBUI_SECRET_KEY
GitHub stars
14
Category
Monitoring, Security
License
MIT
Updated
Oct 6, 2026

Tools (9)

  • WAZUH_DISABLED_TOOLS

    hides individual tools.

  • alerts

    get_wazuh_alerts, get_wazuh_alert_summary, get_alerts_aggregated, analyze_alert_patterns, search_security_events

  • agents

    get_wazuh_agents, get_wazuh_running_agents, check_agent_health, get_agent_processes, get_agent_ports, get_agent_configuration

  • vulnerabilities

    get_wazuh_vulnerabilities, get_wazuh_critical_vulnerabilities, get_wazuh_vulnerability_summary

  • analysis

    analyze_security_threat, check_ioc_reputation, perform_risk_assessment, get_top_security_threats, generate_security_report

  • web_search

    search_external_context — You.com web search; returns a "not enabled" result unless YDC_API_KEY is set

  • compliance

    run_compliance_check (PCI-DSS, HIPAA, SOX, GDPR, NIST, ISO27001), get_iso27001_dashboard, get_iso27001_control_detail, get_iso27001_gap_analysis,…

  • system

    get_wazuh_statistics, get_wazuh_weekly_stats, get_wazuh_cluster_health, get_wazuh_cluster_nodes, get_wazuh_rules_summary, get_wazuh_remoted_stats,…

  • wazuh_firewall_allow

    and wazuh_host_allow require an operator-deployed undo command (WAZUH_AR_FIREWALL_UNDO_COMMAND, WAZUH_AR_HOSTDENY_UNDO_COMMAND); without one they refuse.

Details on this page are taken from the project's README. Open README

Supported clients

Clients mentioned in this server's README:

View all
Claude Desktop logo

Claude Desktop

Desktop · Freemium · Proprietary

Anthropic's official Claude AI desktop application. Supports MCP servers to extend functionality.

WindowsMacOS
Windsurf logo

Windsurf

Desktop · Freemium · Proprietary

The first agentic IDE. The Windsurf editor truly merges how developers and AI work together.

WindowsMacOSLinux
LibreChat logo

LibreChat

Web · Free · MIT

An extensible open-source AI chat platform. Supports multiple AI providers and MCP servers.

Web

Related MCP servers

More servers
2344 logo

2344

comet-ml/opik

7k

Opik is the open-source LLM observability and evaluation platform for AI agent tracing, LLM evaluation, prompt management, and production monitoring. Built by Comet. Apache-2.0 licensed, free to self-host the full platform, with 20,000+ GitHub stars.

Monitoring
MCP Grafana logo

MCP Grafana

grafana/mcp-grafana

612

A Model Context Protocol (MCP) server for Grafana.

Monitoring
Vite Plugin Vue MCP logo

Vite Plugin Vue MCP

webfansplz/vite-plugin-vue-mcp

407

Vite plugin that enables a MCP server for your Vue app to provide information about the component tree, state, routes, and pinia tree and state.

Monitoring
api200 logo

api200

API-200/api200

169

API 200 is all-in-one gateway for managing third-party APIs efficiently. Integrate third-party APIs or setup MCP server in minutes with auto-generated code, docs, auth, caching and error handling – so you can focus on what really matters.

Monitoring
WireMCP (Wireshark) logo

WireMCP (Wireshark)

0xkoda/wiremcp

98

WireMCP is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with real-time network traffic analysis capabilities.

Monitoring
gospy logo

gospy

monsterxx03/gospy

90

A tool for inspecting and analyzing running Go processes, including goroutine states, memory statistics, and binary information.

Monitoring