Wazuh-MCP-Server MCP Server
gensecaihq/Wazuh-MCP-Server
[](https://agentrank-ai.com/tool/gensecaihq--Wazuh-MCP-Server/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge) Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.
claude mcp add agentrank -- npx -y agentrank-mcp-server Overview
gensecaihq/Wazuh-MCP-Server is a Python MCP server licensed under MIT. Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready. Topics: ai, claude, mcp, mcp-server, model-context-protocol, python, wazuh, active-response, compliance, cybersecurity, devsecops, incident-response, llm, security, security-automation, siem, soc, threat-detection, threat-hunting, vulnerability-management.
Ranked #217 out of 24846 indexed tools.
In the top 1% of all indexed tools.
Has 18 contributors.
Ecosystem
Score Breakdown
251 stars → growing community
Last commit 18d ago → recently updated
35/41 issues closed → responsive maintainer
18 contributors → active community
No dependents → no downstream usage
Weights: Freshness 20% · Issue Health 20% · Dependents 22% · Stars 10% · Contributors 8% · How we score →
Matched Queries
From the README
<div align="center"> # Wazuh MCP Server **A Model Context Protocol (MCP) server for the Wazuh SIEM.** Lets an MCP client — Claude, Open WebUI backed by a local model, or any client that speaks Streamable HTTP — query alerts, agents, vulnerabilities and compliance data, and dispatch active responses, with scope-based access control and audit logging. [Quick Start](#quick-start) · [Clients](#connecting-clients) · [Tools](#tools) · [Security](#security-model) · [Configuration](#configuration) · [Docs](#documentation) · [Changelog](CHANGELOG.md) · [Upgrading](UPGRADING.md) </div> --- ## Overview - **55 tools** in 8 toolsets: alerts, agents, vulnerabilities, threat analysis, compliance (PCI-DSS, HIPAA, SOX, GDPR, NIST, ISO 27001:2022), manager/cluster health, and active response with verification and rollback. Also 5 guided prompts, 6 resources and 3 resource templates. - **Read-only by default.** The 14 state-changing tools require the `wazuh:write` scope, which is never granted imRead full README on GitHub →
Get the weekly AgentRank digest
Top movers, new tools, ecosystem insights — straight to your inbox.