License

Skip to content

You signed in with another tab or window. Reload
to refresh your session. You signed out in another tab or window. Reload
to refresh your session. You switched accounts on another tab or window. Reload
to refresh your session. Dismiss alert

unmuktoai / Wazuh-MCP-Server Public

• Notifications
  You must be signed in to change notification settings

• Fork 2

• Star 5

An open-source MCP server for integrating Wazuh security data with LLMs (such as the Claude Desktop App). This service authenticates with the Wazuh RESTful API, retrieves alerts from Elasticsearch indices, transforms events into an MCP-compliant JSON format, and exposes an HTTP endpoint for Claude Desktop to fetch real-time security context.

License

MIT license

5 stars
2 forks
Branches
Tags
Activity

Star

Notifications
You must be signed in to change notification settings

unmuktoai/Wazuh-MCP-Server

main

6 Branches
0 Tags

Go to file

Code

Folders and files

| Name | | Name | Last commit message | Last commit date |
| --- | --- | --- | --- |
| Latest commit
-------------


alokemajumder

Update README.md

Mar 17, 2025

c05d22d
 · Mar 17, 2025

History
-------

14 Commits

| | |
| .github/workflows | | .github/workflows | Update python-app.yml | Mar 13, 2025 |
| tests | | tests | Create test_wazuh_mcp_server.py | Mar 13, 2025 |
| LICENSE | | LICENSE | Initial commit | Mar 13, 2025 |
| README.md | | README.md | Update README.md | Mar 17, 2025 |
| requirements.txt | | requirements.txt | Create requirements.txt | Mar 13, 2025 |
| wazuh_mcp_server.py | | wazuh_mcp_server.py | Create wazuh_mcp_server.py | Mar 13, 2025 |
| View all files | | |

Repository files navigation

Wazuh MCP Server

A production-grade, open-source MCP server for integrating Wazuh security data with LLMs (such as the Claude Desktop App). This service authenticates with the Wazuh RESTful API, retrieves alerts from Elasticsearch indices, transforms events into an MCP-compliant JSON format, and exposes an HTTP endpoint for Claude Desktop to fetch real-time security context.

Features

• JWT-Based Authentication: Securely authenticate with Wazuh using JWT tokens.
• Alert Retrieval: Query Elasticsearch indices for Wazuh alert data.
• MCP Message Transformation: Convert security events into standardized MCP messages.
• Flask HTTP Server: Exposes an /mcp endpoint for Claude Desktop integration.
• Robust Error Handling: Handles token expiration, network timeouts, and malformed data.
• Configurable: Easily configure via environment variables and integrate with Claude Desktop via its config file.

Prerequisites

• Python 3.8+
• Access to a Wazuh API instance.
• (Optional) Claude Desktop configured to call the MCP server.

Installation

1. Clone the Repository:

   shell git clone https://github.com/unmuktoai/Wazuh-MCP-Server.git cd Wazuh-MCP-Server

Create and Activate a Virtual Environment:

python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

Install Dependencies:

pip install -r requirements.txt

Configuration Set the following environment variables to configure the MCP server:

WAZUH_HOST: Wazuh server hostname or IP.
WAZUH_PORT: Port for the Wazuh API (default: 55000).
WAZUH_USER: Wazuh API username.
WAZUH_PASS: Wazuh API password.
VERIFY_SSL: Set to "true" or "false" (default: false).
MCP_SERVER_PORT: Port on which the MCP server will run (default: 8000).

Example (MacOS):

export WAZUH_HOST="your_wazuh_server"
export WAZUH_PORT="55000"
export WAZUH_USER="your_username"
export WAZUH_PASS="your_password"
export VERIFY_SSL="false"
export MCP_SERVER_PORT="8000"

Running the Server Start the MCP server with:

python wazuh_mcp_server.py 

The server will listen on all interfaces at the port specified by

MCP_SERVER_PORT.

Integration with Claude Desktop To integrate with Claude Desktop, update its configuration file:

MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json Add the following entry under mcpServers:

{
"mcpServers": {
  "mcp-server-wazuh": {
    "command": "python3 /path/to/Wazuh-MCP-Server/wazuh_mcp_server.py",
    "env": {
      "WAZUH_HOST": "your_wazuh_server",
      "WAZUH_PORT": "55000",
      "WAZUH_USER": "your_username",
      "WAZUH_PASS": "your_password",
      "MCP_SERVER_PORT": "8000",
      "VERIFY_SSL": "false"
    }
  }
}
}

License This project is licensed under the MIT License.

Contributing Contributions are welcome! Please open issues or submit pull requests for improvements or bug fixes.

About

An open-source MCP server for integrating Wazuh security data with LLMs (such as the Claude Desktop App). This service authenticates with the Wazuh RESTful API, retrieves alerts from Elasticsearch indices, transforms events into an MCP-compliant JSON format, and exposes an HTTP endpoint for Claude Desktop to fetch real-time security context.

Topics

python
ai
mcp
wazuh
claude
claude-ai
genai
wazuh-integration
model-context-protocol
mcp-server
model-context-protocol-servers
mcpserver

Resources

Readme

License

MIT license

Activity

Custom properties

Stars

5 stars

Watchers

0 watching

Forks

2 forks

Report repository

Releases

No releases published

Contributors 2

• 
  alokemajumder am

• 
  aiunmukto

Languages

• Python 100.0%

You can’t perform that action at this time.