| name | wazuh-mcp-connector |
| description | MCP connector for Wazuh security monitoring – enables AI-powered threat detection, security event analysis, and compliance monitoring through Claude |
| license | GPL |
| tags | ["security","siem","mcp","wazuh","threat-detection"] |
| difficulty | expert |
| time_to_master | 4-8 weeks |
| version | 1.0.0 |
Wazuh MCP Connector
Overview
This skill enables Claude to interact with Wazuh through the Model Context Protocol (MCP). It provides a bridge between Claude's AI capabilities and Wazuh's REST API, allowing natural language control of Wazuh operations, intelligent automation, and AI-powered assistance for Wazuh workflows.
When to Use This Skill
- Security alert triage and investigation
- Rule creation and tuning via natural language
- Compliance check configuration (PCI, HIPAA, GDPR)
- Agent deployment and management
- Vulnerability assessment and reporting
Architecture
┌─────────────┐ ┌─────────────────┐ ┌──────────────────┐
│ Claude │────▶│ MCP Server │────▶│ Wazuh │
│ (Client) │◀────│ (TypeScript) │◀────│ (REST API )│
└─────────────┘ └─────────────────┘ └──────────────────┘
Core Concepts
MCP Server Setup
The connector implements an MCP server that exposes Wazuh operations as tools Claude can invoke. The server translates natural language intentions into REST API calls.
Key Endpoints/Interfaces
/security/alerts, /agents, /rules, /decoders, /vulnerability
Implementation
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";
const server = new McpServer({
name: "wazuh-mcp-connector",
version: "1.0.0",
});
server.tool(
"list_resources",
"List and query Wazuh resources with optional filters",
{
query: z.string().optional().describe("Search query or filter"),
limit: z.number().optional().describe("Max results to return"),
},
async ({ query, limit }) => {
const response = await fetch(`${BASE_URL}/security/alerts`, {
headers: { "Authorization": `Bearer ${API_KEY}` },
});
const data = await response.json();
return {
: [{ : , : .(data, , ) }],
};
}
);
server.(
,
,
{
: z.().(),
: z.({}).().().(),
},
({ name, config }) => {
response = (, {
: ,
: {
: ,
: ,
},
: .({ name, ...config }),
});
data = response.();
{
: [{ : , : }],
};
}
);
server.(
,
,
{
: z.().(),
: z.().().(),
},
({ , timeframe }) => {
response = (, {
: { : },
});
data = response.();
{
: [{ : , : .(data, , ) }],
};
}
);
transport = ();
server.(transport);
Claude Desktop Configuration
{
"mcpServers": {
"wazuh-mcp-connector": {
"command": "node",
"args": ["path/to/wazuh-mcp-connector/index.js"],
"env": {
"WAZUH_API_KEY": "your-api-key",
"WAZUH_BASE_URL": "https://your-instance-url"
}
}
}
}
Best Practices
- Authentication: Store API keys securely using environment variables; never hardcode credentials
- Rate Limiting: Implement request throttling to respect Wazuh API rate limits
- Error Handling: Provide clear, actionable error messages for common failure scenarios
- Pagination: Handle paginated responses for large datasets efficiently
- Caching: Cache frequently accessed read-only data to reduce API calls
- Security: Validate all inputs before passing to the Wazuh API; sanitize outputs
- Logging: Log all API interactions for debugging and audit purposes
Example Prompts
"Analyze the top 10 critical security alerts from the last 24 hours and suggest remediation steps"
Security Considerations
- All API credentials must be stored as environment variables
- Implement input validation and sanitization for all tool parameters
- Use HTTPS for all API communications
- Follow the principle of least privilege for API token permissions
- Audit log all write operations for compliance tracking
Resources
Changelog
| Version | Date | Changes |
|---|
| 1.0.0 | 2026-04-01 | Initial MCP connector skill |
Part of SkillGalaxy - 10,000+ comprehensive skills for AI-assisted development.
