Wazuh

🚀 Wazuh MCP Server

A production-grade, open-source MCP server for integrating Wazuh security data with large language models like Claude Desktop App. This service communicates with the Wazuh RESTful API via JWT authentication, retrieves alerts from Elasticsearch indices, transforms events into MCP-standard JSON format, and exposes an HTTP endpoint for Claude Desktop to obtain real-time security context.

✨ Features

• JWT-based Authentication: Securely authenticate with Wazuh using JWT tokens.
• Alert Retrieval: Query Elasticsearch indices for Wazuh alert data.
• MCP Message Transformation: Convert security events into standard MCP message format.
• Flask HTTP Server: Provide a /mcp endpoint for integration with Claude Desktop.
• Robust Error Handling: Handle token expiration, network timeouts, and data format errors.
• Configurability: Easily configure via environment variables and integrate through Claude Desktop's configuration file.

📦 Prerequisites

• Python 3.8+
• Access to a Wazuh API instance.
• (Optional) A configured Claude Desktop for calling the MCP server.

📦 Installation

Step 1: Clone the Repository

git clone https://github.com/unmuktoai/Wazuh-MCP-Server.git
cd Wazuh-MCP-Server

Step 2: Create and Activate a Virtual Environment

python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

Step 3: Install Dependencies

pip install -r requirements.txt

Step 4: Configuration

Set the following environment variables to configure the MCP server:

WAZUH_HOST: Hostname or IP address of the Wazuh server.
WAZUH_PORT: Wazuh API port (Default: 55000).
WAZUH_USER: Wazuh API username.
WAZUH_PASS: Wazuh API password.
VERIFY_SSL: Set to "true" or "false" (Default: false).
MCP_SERVER_PORT: Port on which the MCP server runs (Default: 8000).

Example (MacOS):

export WAZUH_HOST="your_wazuh_server"
export WAZUH_PORT="55000"
export WAZUH_USER="your_username"
export WAZUH_PASS="your_password"
export VERIFY_SSL="false"
export MCP_SERVER_PORT="8000"

Step 5: Run the Server

python wazuh_mcp_server.py

The server will listen on all interfaces at the specified MCP_SERVER_PORT.

Step 6: Integrate with Claude Desktop

To integrate with Claude Desktop, update its configuration file:

• MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%/Claude/claude_desktop_config.json

Add the following under mcpServers:

{
  "mcpServers": {
    "mcp-server-wazuh": {
      "command": "python3 /path/to/Wazuh-MCP-Server/wazuh_mcp_server.py",
      "env": {
        "WAZUH_HOST": "your_wazuh_server",
        "WAZUH_PORT": "55000",
        "WAZUH_USER": "your_username",
        "WAZUH_PASS": "your_password",
        "MCP_SERVER_PORT": "8000",
        "VERIFY_SSL": "false"
      }
    }
  }
}

📄 License

[Project license information]

🤝 Contribution Guidelines

Contributions to this project are welcome! Please refer to [Contribution Guidelines] for details on how to get involved.

This MCP server is a powerful and flexible tool designed to simplify the integration between Wazuh and modern language models, thereby enhancing the capabilities of security analysis.