Wazuh MCP Server

🚀 Wazuh MCP Server

An open-source, production-grade MCP server for integrating Wazuh security data with large language models like Claude Desktop App. This service authenticates with Wazuh via REST API using JWT tokens, retrieves alerts from Elasticsearch indices, converts events into MCP-standard JSON format, and exposes an HTTP endpoint for Claude Desktop to obtain real-time security context.

🚀 Quick Start

The Wazuh MCP Server is a powerful tool for integrating Wazuh security data with large language models. Follow the installation steps below to get started.

✨ Features

• JWT-based Authentication: Securely authenticate with Wazuh using JWT tokens.
• Alert Retrieval: Query Elasticsearch indices for Wazuh alert data.
• MCP Message Transformation: Convert security events into standardized MCP messages.
• Flask HTTP Server: Provide a /mcp endpoint for Claude Desktop integration.
• Robust Error Handling: Handle token expiration, network timeouts, and malformed data.
• Configurability: Easily configure via environment variables and integrate through Claude Desktop's configuration file.

📦 Installation

Prerequisites

• Python 3.8+
• Access to a Wazuh API instance
• (Optional) A configured Claude Desktop for calling the MCP server

Steps

1. Clone the repository:

   git clone https://github.com/unmuktoai/Wazuh-MCP-Server.git
   cd Wazuh-MCP-Server
   

2. Create and activate a virtual environment:

   python3 -m venv venv
   source venv/bin/activate  # For Windows users: venv\Scripts\activate
   

3. Install dependencies:

   pip install -r requirements.txt
   

4. Configuration Set the following environment variables to configure the MCP server:

   WAZUH_HOST: Specify the hostname or IP address of the Wazuh server.
   WAZUH_PORT: The port used by the Wazuh API (Default: 55000).
   WAZUH_USER: The username for the Wazuh API.
   WAZUH_PASS: The password for the Wazuh API.
   VERIFY_SSL: Set to "true" or "false" (Default: false).
   MCP_SERVER_PORT: The port on which the MCP server runs (Default: 8000).
   

   Example (MacOS):

   export WAZUH_HOST="your_wazuh_server"
   export WAZUH_PORT="55000"
   export WAZUH_USER="your_username"
   export WAZUH_PASS="your_password"
   export VERIFY_SSL="false"
   export MCP_SERVER_PORT="8000"
   

5. Run the server Start the MCP server using the following command:

   python wazuh_mcp_server.py 
   

   The server will listen on all interfaces on the specified MCP_SERVER_PORT.
6. Integrate with Claude Desktop To integrate the MCP server with Claude Desktop, update its configuration file: MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json Add the following entry under mcpServers:

   {
     "mcpServers": {
       "mcp-server-wazuh": {
         "command": "python3 /path/to/Wazuh-MCP-Server/wazuh_mcp_server.py",
         "env": {
           "WAZUH_HOST": "your_wazuh_server",
           "WAZUH_PORT": "55000",
           "WAZUH_USER": "your_username",
           "WAZUH_PASS": "your_password",
           "MCP_SERVER_PORT": "8000",
           "VERIFY_SSL": "false"
         }
       }
     }
   }
   

📄 License

This project is open-source under the MIT License.