Wazuh MCP Server
A production-grade, open-source MCP server for integrating Wazuh security data with LLMs (such as the Claude Desktop App). This service authenticates with the Wazuh RESTful API, retrieves alerts from Elasticsearch indices, transforms events into an MCP-compliant JSON format, and exposes an HTTP endpoint for Claude Desktop to fetch real-time security context.
Features
- JWT-Based Authentication: Securely authenticate with Wazuh using JWT tokens.
- Alert Retrieval: Query Elasticsearch indices for Wazuh alert data.
- MCP Message Transformation: Convert security events into standardized MCP messages.
- Flask HTTP Server: Exposes an
/mcpendpoint for Claude Desktop integration.
- Robust Error Handling: Handles token expiration, network timeouts, and malformed data.
- Configurable: Easily configure via environment variables and integrate with Claude Desktop via its config file.
Prerequisites
- Python 3.8+
- Access to a Wazuh API instance.
- (Optional) Claude Desktop configured to call the MCP server.
Installation
- Clone the Repository:
Create and Activate a Virtual Environment:
Install Dependencies:
Configuration
Set the following environment variables to configure the MCP server:
Example (MacOS):
Running the Server
Start the MCP server with:
The server will listen on all interfaces at the port specified by
Integration with Claude Desktop
To integrate with Claude Desktop, update its configuration file:
MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%/Claude/claude_desktop_config.json
Add the following entry under mcpServers:
License
This project is licensed under the MIT License.
Contributing
Contributions are welcome! Please open issues or submit pull requests for improvements or bug fixes.
Wazuh MCP Server
A production-grade, open-source MCP server for integrating Wazuh security data with LLMs (such as the Claude Desktop App). This service authenticates with the Wazuh RESTful API, retrieves alerts from Elasticsearch indices, transforms events into an MCP-compliant JSON format, and exposes an HTTP endpoint for Claude Desktop to fetch real-time security context.
Features
- JWT-Based Authentication: Securely authenticate with Wazuh using JWT tokens.
- Alert Retrieval: Query Elasticsearch indices for Wazuh alert data.
- MCP Message Transformation: Convert security events into standardized MCP messages.
- Flask HTTP Server: Exposes an
/mcpendpoint for Claude Desktop integration.
- Robust Error Handling: Handles token expiration, network timeouts, and malformed data.
- Configurable: Easily configure via environment variables and integrate with Claude Desktop via its config file.
Prerequisites
- Python 3.8+
- Access to a Wazuh API instance.
- (Optional) Claude Desktop configured to call the MCP server.
Installation
- Clone the Repository:
Create and Activate a Virtual Environment:
Install Dependencies:
Configuration
Set the following environment variables to configure the MCP server:
Example (MacOS):
Running the Server
Start the MCP server with:
The server will listen on all interfaces at the port specified by
Integration with Claude Desktop
To integrate with Claude Desktop, update its configuration file:
MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%/Claude/claude_desktop_config.json
Add the following entry under mcpServers:
License
This project is licensed under the MIT License.
Contributing
Contributions are welcome! Please open issues or submit pull requests for improvements or bug fixes.