mcp-server

Wazuh-MCP-Server

Name: Wazuh-MCP-Server
Author: INFOKOM-KI

Wazuh MCP Server: AI-Driven SOC Automation

93 stars+1★ this week25 forksPythonUpdated 10/14/2026100% free · open source

What it does

It adds an AI layer to a Wazuh SOC, automatically turning alerts into actionable recommendations using LLMs.

When to use it

•You already run Wazuh for log collection and need automated triage without hiring a full SOC team.
•Your security team wants to enrich alerts with suggested remediation steps powered by OpenAI.
•You want a plug‑and‑play server that listens to Wazuh alerts and replies with concise, human‑readable insights.

Ready-to-paste prompt

curl -X POST http://localhost:8000/alert \
     -H "Content-Type: application/json" \
     -d '{"rule": {"id": 5712, "description": "Multiple failed SSH logins"}, "srcip": "192.0.2.45", "timestamp": "2024-09-18T12:34:56Z"}'

Heads up: The server aborts on start if the OPENAI_API_KEY env variable is missing or invalid – obtain a key from platform.openai.com and set it before launching.

Saves to your device

Use with Claude

New

Skip the builder — one click puts this in Claude, Cursor, Antigravity and more.

🛠️ Technical setup

Expect 20–40 minutes in a terminal — or let your AI agent drive it.

Try it instantly — no install

Claude Code

mkdir -p ~/.claude/skills/wazuh-mcp-server && curl -fsSL https://workflowstacks.com/api/skills/wazuh-mcp-server/claude-skill -o ~/.claude/skills/wazuh-mcp-server/SKILL.md

Open in another AI app

Opens the app with this repo with the prompt ready to go — no copy-paste needed.

Connect the whole catalog (MCP)

claude mcp add --transport http workflowstacks https://workflowstacks.com/api/mcp

Adds a WorkflowStacks connector to Claude Code: search and load any skill here by chatting.

How Wazuh-MCP-Server works

Codeflow

Free to inspect

Wazuh-MCP-Server is a large Python project (~58k lines across 148 code files, plus 140 test files). It is a full software project: use it through its install path rather than reading it end to end. Last commit this month, BSD-3-Clause license, has a test suite.

Size

Large codebase

~58k lines · 148 code files · ~8 h to skim

Setup

Developer setup

A real software project. Use it via its install path; don't expect to read it all.

Runs on

Python

No API keys detected

Python 98%Shell 2%

Where to start reading

1
README.md
Start here — what it does and how to install it
2
main.py
Where the program starts running
3
requirements.txt
Dependencies and the commands it exposes

What's in each folder

docs/Documentation1 files

mcp_server/Folder135 files

resource/Folder22 files

scripts/Helper scripts9 files

tests/Tests — proof it works149 files

READMEHas testsDocumentedNo CIBSD-3-Clause licenseUpdated this month