gensecaihq / Wazuh-MCP-Server

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

Why this job: name: mcp; says: mcp server; topics: mcp-server, model-context-protocol, mcp

Open on GitHub Website

What it does

Lets an MCP client — Claude, Open WebUI backed by a local model, or any client that speaks Streamable HTTP — query alerts, agents, vulnerabilities and compliance data, and dispatch active responses, with scope-based access control and audit logging.

Get started

git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git
cd Wazuh-MCP-Server
cp .env.example .env

Maintenance: Active; Last commit 40 days ago
Stars: 267; +5 this week
Licence: MIT; Allows business use
Downloads for: None listed; No release files
Latest version: v5.0.0; Released 46 days ago
Built with: Python; 92% of the code

Is it looked after?

Contributors: 5; Last 90 days
Issues: 95% closed; 2 still open
Pull requests: 70 merged; 4 waiting
Releases: 21; 15 in the last year

Similar repos

Repos similar to this one
Repo	Stars	Last commit	Licence	Downloads for
INFOKOM-KI / Wazuh-MCP-Server	100	yesterday	BSD-3-Clause	No downloads
mukul975 / cve-mcp-server	1,765	4 months ago	Apache-2.0	No downloads
google / mcp-security	538	3 days ago	Apache-2.0	No downloads

More: languages, topics and project record

Languages

Python 92%
Shell 7%
Dockerfile <1%
Batchfile <1%

Topics

active-response
ai
claude
compliance
cybersecurity
devsecops
incident-response
llm
mcp
mcp-server
model-context-protocol
python

Project record

JobMCP servers
StatusListed
Commits385
Forks71
Watching12
Stars in 28 days+15
CreatedMar 13, 2025
First seen by usNov 7, 2026
CheckedNov 7, 2026