Wazuh SIEM Security
An MCP server for the Wazuh SIEM/XDR platform that enables users to query agents, security alerts, detection rules, and decoders through Claude or other MCP clients. It provides specialized tools and prompts for investigating security alerts, perform
What is Wazuh SIEM Security?
Wazuh SIEM Security is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to mcp server for the wazuh siem/xdr platform that enables users to query agents, security alerts, detection rules, and decoders through claude or other mcp clients. it provides specialized tools and pro...
An MCP server for the Wazuh SIEM/XDR platform that enables users to query agents, security alerts, detection rules, and decoders through Claude or other MCP clients. It provides specialized tools and prompts for investigating security alerts, perform
This server falls under the Security and Monitoring & Observability categories on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- An MCP server for the Wazuh SIEM/XDR platform that enables u
Use Cases
Maintainer
Works with
Installation
NPM
npx -y wazuhManual Installation
npx -y wazuhConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use Wazuh SIEM Security
The Wazuh MCP Server bridges Claude and other MCP clients to a running Wazuh SIEM/XDR deployment, exposing natural language access to security alerts, agent status, detection rules, vulnerability summaries, and cluster health. Built in Rust for low overhead, it connects to both the Wazuh Manager API and the Wazuh Indexer, offering tools for incident triage, compliance validation, threat hunting, and log forensics through conversational queries. Security operations teams can use it to investigate alerts and generate reports without writing API calls or navigating the Wazuh web UI.
Prerequisites
- A running Wazuh deployment (Manager + Indexer) accessible over the network
- Wazuh API credentials (username and password with read access)
- Wazuh Indexer credentials (username and password, typically admin/admin on default installs)
- Claude Desktop or another MCP client
- The mcp-server-wazuh binary, Docker image, or Rust toolchain to build from source
Obtain the mcp-server-wazuh binary
Download the pre-built binary for your platform from the GitHub releases page and make it executable, or pull the Docker image.
# Download binary (Linux x86_64)
curl -LO https://github.com/gbrigandi/mcp-server-wazuh/releases/latest/download/mcp-server-wazuh-linux-amd64
chmod +x mcp-server-wazuh-linux-amd64
# Or pull Docker image
docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latestGather your Wazuh connection details
Collect the hostname/IP and ports for both the Wazuh Manager API (default port 55000) and the Wazuh Indexer (default port 9200), along with credentials for each.
Set the required environment variables
Export all eight required variables before starting the server or add them to the env block in your MCP client config.
export WAZUH_API_HOST="wazuh.example.com"
export WAZUH_API_PORT="55000"
export WAZUH_API_USERNAME="wazuh-api-user"
export WAZUH_API_PASSWORD="your-api-password"
export WAZUH_INDEXER_HOST="wazuh.example.com"
export WAZUH_INDEXER_PORT="9200"
export WAZUH_INDEXER_USERNAME="admin"
export WAZUH_INDEXER_PASSWORD="your-indexer-password"Configure Claude Desktop
Add the Wazuh server to your claude_desktop_config.json with the environment variables in the env block.
Restart Claude Desktop and test connectivity
Restart Claude Desktop and ask it to list running Wazuh agents to confirm the server can reach your Wazuh deployment.
Wazuh SIEM Security Examples
Client configuration
Add this block to ~/Library/Application Support/Claude/claude_desktop_config.json on macOS. Replace all placeholder values with your actual Wazuh connection details.
{
"mcpServers": {
"wazuh": {
"command": "npx",
"args": ["-y", "wazuh"],
"env": {
"WAZUH_API_HOST": "wazuh.example.com",
"WAZUH_API_PORT": "55000",
"WAZUH_API_USERNAME": "wazuh-api-user",
"WAZUH_API_PASSWORD": "your-api-password",
"WAZUH_INDEXER_HOST": "wazuh.example.com",
"WAZUH_INDEXER_PORT": "9200",
"WAZUH_INDEXER_USERNAME": "admin",
"WAZUH_INDEXER_PASSWORD": "your-indexer-password"
}
}
}
}Prompts to try
Use these prompts in Claude Desktop to investigate your Wazuh security data through natural language.
- "Show me a summary of critical security alerts from the last 24 hours"
- "What vulnerabilities are present on my web servers?"
- "List all running Wazuh agents and their status"
- "Are we meeting PCI-DSS logging requirements based on current rules?"
- "What processes are running on agent 001 that are unusual?"
- "Search the Wazuh manager logs for authentication failures in the last hour"Troubleshooting Wazuh SIEM Security
Connection refused or timeout when the server starts
Verify WAZUH_API_HOST and WAZUH_INDEXER_HOST are reachable from your machine using curl or ping. Confirm the ports (55000 and 9200 by default) are open in your firewall and that Wazuh services are running.
SSL certificate verification errors on startup
Set the optional environment variable WAZUH_VERIFY_SSL=false to disable certificate verification for self-signed certificates common in homelab Wazuh deployments. For production, install the Wazuh CA certificate instead.
Tools return empty results for alerts or agents
Confirm your Wazuh API user has read access to agents and alerts. Test directly with: curl -u wazuh-api-user:password -k https://wazuh.example.com:55000/agents to validate credentials and connectivity.
Frequently Asked Questions about Wazuh SIEM Security
What is Wazuh SIEM Security?
Wazuh SIEM Security is a Model Context Protocol (MCP) server that mcp server for the wazuh siem/xdr platform that enables users to query agents, security alerts, detection rules, and decoders through claude or other mcp clients. it provides specialized tools and prompts for investigating security alerts, perform It connects AI assistants to external tools and data sources through a standardized interface.
How do I install Wazuh SIEM Security?
Install via npm with the command: npx -y wazuh. Then add the server configuration to your AI client's JSON config file (e.g., claude_desktop_config.json or .cursor/mcp.json).
Which AI clients work with Wazuh SIEM Security?
Wazuh SIEM Security works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is Wazuh SIEM Security free to use?
Yes, Wazuh SIEM Security is open source and available under the MIT License license. You can use it freely in both personal and commercial projects.
Wazuh SIEM Security Alternatives — Similar Security Servers
Looking for alternatives to Wazuh SIEM Security? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up Wazuh SIEM Security in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use Wazuh SIEM Security?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.