mcp-server-wazuhMCP Server for Wazuh SIEM

— (0)

Reviewed by Daniel Nikulshyn·Updated July 2026

Overview

The Wazuh MCP Server is a Rust-based server that bridges the gap between a Wazuh Security Information and Event Management (SIEM) system and applications requiring contextual security data. It provides comprehensive access to Wazuh SIEM data through natural language interactions, transforming complex Wazuh API responses into MCP-compatible format. This server enables AI assistants to access security alerts, agent management, vulnerability assessment data, security rules, system statistics, log analysis, and cluster health data. The Wazuh MCP Server is particularly valuable for compliance teams who need to quickly assess security posture, identify gaps in monitoring coverage, validate rule effectiveness, and generate evidence for audit requirements across distributed infrastructure.

Key features

Security Alerts & Events
Agent Management & Monitoring
Vulnerability Assessment
Security Rules & Configuration
System Statistics & Performance metrics
Log Analysis & Forensics

Pricing

Model: Free
Category: MCP Servers
Rating: No reviews yet

Use cases

Security Alert Analysis

Query recent security alerts to quickly identify and prioritize threats requiring immediate attention

Vulnerability Management

Assess security posture of specific agents and prioritize patching efforts using get_wazuh_vulnerability_summary and get_wazuh_critical_vulnerabilities

System Monitoring and Forensics

Investigate running processes on agents using get_wazuh_agent_processes for threat hunting and system analysis

Pros & Cons

Pros

Provides real-time access to Wazuh SIEM data through natural language interactions
Transforms complex Wazuh API responses into MCP-compatible format
Enables AI assistants to access security data without manual API calls or complex queries
Supports compliance monitoring and gap analysis for regulatory frameworks

Cons

Requires a Wazuh SIEM system and MCP-compatible applications
May require additional configuration and maintenance for optimal performance

Reviews

No reviews yet. Be the first!

Q&A

What are the limitations of the Wazuh MCP Server?

The limitations include requiring a Wazuh SIEM system and MCP-compatible applications, and may require additional configuration and maintenance for optimal performance.

Asked by Bartek Adamski · Mar 31, 2026

What are the pros of using the Wazuh MCP Server?

The pros include providing real-time access to Wazuh SIEM data, transforming complex Wazuh API responses into MCP-compatible format, and supporting compliance monitoring and gap analysis for regulatory frameworks.

Asked by Petros Georgiou · Mar 19, 2026

What are the key features of the Wazuh MCP Server?

The key features include Security Alerts & Events, Agent Management & Monitoring, Vulnerability Assessment, Security Rules & Configuration, System Statistics & Performance metrics, and Log Analysis & Forensics.

Asked by Larisa Ionescu · Feb 22, 2026

What is the Wazuh MCP Server used for?

The Wazuh MCP Server bridges the gap between a Wazuh SIEM system and applications requiring contextual security data, providing access to security alerts, agent management, and more through natural language interactions.

Asked by Mohammed Al-Amin · Jan 6, 2026