The Wazuh MCP server connects AI agents to the Wazuh SIEM platform. It exposes security alerts, vulnerability data, and compliance checks. Agents can query Wazuh's Elasticsearch database and trigger actions like adding agents or updating configurations. Security teams use it to automate threat detection and response workflows.
The Wazuh MCP server connects AI agents to the Wazuh SIEM platform. It exposes security alerts, vulnerability data, and compliance checks. Agents can query Wazuh's Elasticsearch database and trigger actions like adding agents or updating configurations. Security teams use it to automate threat detection and response workflows.
Add this configuration to your claude_desktop_config.json:
{
"mcpServers": {
"gbrigandi-mcp-server-wazuh-github": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-gbrigandi-mcp-server-wazuh-github"
]
}
}
}Restart Claude Desktop, then ask:
"What tools do you have available from wazuh?"
API Key Required
This server requires an API key from wazuh. Add it to your environment or config.
| Variable | Required | Description |
|---|---|---|
| WAZUH_API_KEY | Yes | Your wazuh API key |
"What resources are available in wazuh?"
Claude will query available resources and return a list of what you can access.
"Show me details about [specific item] in wazuh"
Claude will fetch and display detailed information about the requested item.
"Create a new [item] in wazuh with [details]"
Claude will use the appropriate tool to create the resource and confirm success.
We build custom MCP integrations for B2B companies. From simple connections to complex multi-tool setups.