Vibe Coding DiscoverWazuh-MCP-Server
View on GitHubProduction-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.
Production MCP server that exposes 55 Wazuh SIEM tools (alerts, agents, vulnerabilities, compliance, active response) over Streamable HTTP. Read-only by default with OAuth 2.1, scopes, and Docker deployment for Claude or local LLM SOC workflows.
Use Cases
SOC alert triage via LLMThreat hunting across Wazuh alertsVulnerability management and summaryCompliance audits for PCI DSS, HIPAA, GDPR, NIST CSF, ISO 27001Active response containment and rollbackAgent health and process/port inspectionIOC reputation checks and risk assessmentAutomated security reportingManager and cluster health monitoringAir-gapped/on-prem LLM SOC deploymentPrompt-injection-aware tool selection evals
Built With
- Language
- Python
- Frameworks
- FastAPI · Uvicorn · Pydantic · Redis · vLLM · Open WebUI · LiteLLM · Ollama · Docker Compose · Prometheus
Tags
mcp-server · siem · wazuh · security · soc · threat-hunting · vulnerability-management · compliance · active-response · incident-response · oauth2 · rbac · docker · self-hosted · llm-integration · cybersecurity