gensecaihq/Wazuh-MCP-Server

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

221 ★63 forksPythonUpdated 20d ago

What you need to know

Production-hardened MCP server that lets you talk to your Wazuh SIEM in natural language — 55 security tools to query alerts, hunt threats, triage vulnerabilities and run active responses across the deployment, with dual-era MCP, multi-cluster and air-gap support.

Install

git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git && cd Wazuh-MCP-Server && cp .env.example .env
Set WAZUH_HOST, WAZUH_USER, WAZUH_PASS, then docker compose up -d
docker pull ghcr.io/gensecaihq/wazuh-mcp-server:latest

Usage

•Ask 'Show me critical alerts from the last hour' or 'Block that source IP on agent-003' in plain language
•Run fully local (air-gapped) via Open WebUI + Ollama, mcphost, or any MCP client
•Perform compliance checks for PCI-DSS, HIPAA, SOX, GDPR, NIST and ISO 27001:2022

Key features

✓55 tools across alerts, agents, vulnerabilities, security analysis, compliance, system, active response, verification and rollback
✓Fail-closed RBAC: the 14 state-changing tools require wazuh:write (opt-in), everything else read-only by default
✓Audit logging, output sanitization (credential redaction), input validation, rate limiting, circuit breakers and container hardening
✓Multi-cluster with optional cross-cluster search, Prometheus /metrics, and an OpenAPI /docs endpoint

Best for

Security teams who want conversational, governed access to Wazuh — including air-gapped SOCs that cannot send SIEM data to cloud APIs.

Caveats

⚠Serves plain HTTP — terminate TLS at a reverse proxy or load balancer
⚠AUTH_SECRET_KEY required in production or the server refuses to start; wazuh_firewall_allow/wazuh_host_allow need custom undo commands stock Wazuh lacks
⚠Server sits between an LLM and your SIEM — read the security guide before exposing it

Platforms: Linux · Docker · ServerClients: Claude Desktop · Open WebUI · mcphost · MCP clients

Reviewed 2026-08-11

Topics

active-responseaiclaudecompliance cybersecurity devsecops incident-responsellmmcpmcp-servermodel-context-protocolpythonsecurity security-automationsiemsocthreat-detectionthreat-hunting vulnerability-managementwazuh

Stars: 221★
Forks: 63
Language: Python
License: MIT
Created: 2025-03-13
Last push: 2026-08-16