Wazuh MCP server

This is a small helper program that connects your AI assistant to Wazuh, a security monitoring system many companies use. Once it is set up, you can ask questions about your security alerts, agents, and vulnerabilities in normal words instead of clicking through dashboards. It is handy for security analysts, IT admins, and compliance teams who already run Wazuh.

What this MCP server does

You ask your AI something like "show me critical vulnerabilities on web servers". The AI passes that request to this helper program. The helper then talks to your Wazuh system using the details you configured, such as the address and login. Wazuh sends back the matching data, and the helper turns it into a clean answer. You see the result right in your chat, as a list, a summary, or a set of numbers.

Click to zoom

What you can do with it

• Review recent security alerts and spot the ones that need attention
• Check which agents are running and which have gone quiet
• List vulnerabilities on a specific agent and prioritize patching
• See which processes and network ports are open on an agent
• Look at your detection rules and how well they are working
• Check the health of your Wazuh cluster and its nodes
• Search manager logs when you are investigating an incident

Try asking your AI

• “Show me the critical alerts from the last 24 hours”
• “Which agents are currently offline?”
• “List the critical vulnerabilities on agent 001”
• “Are we meeting PCI-DSS logging requirements?”

What it gives back to you

You get answers in the chat, usually as short lists or summaries. For example, a list of alerts with severity and time, a count of offline agents, or the names of vulnerable software on a machine. Some requests return numbers and statistics, like weekly totals or cluster status. It reads and reports; it does not change anything in Wazuh for you.

Before you start

Who it's for

Security analysts, IT administrators, and compliance teams who already use Wazuh and want to query it in plain language.