AgentIndex icon
AgentIndex
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompareGuides
Submit Tool
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompare
Home/
Security & Safety/
Wazuh-MCP-Server
Wazuh-MCP-Server logo

Wazuh-MCP-Server

Active·★ 93·BSD-3-Clause·Updated 2026-10-14

Wazuh-MCP-Server is a defensive Security Operations Center (SOC) server exposing over 100 tools for security analysis. It integrates with Wazuh SIEM, various threat intelligence feeds, and provides advanced capabilities like MITRE-driven APT correlation and LangGraph investigation workflows.

#Wazuh#SIEM#SOC#Threat Intelligence#Security Automation#Incident Response#Forensics
© 2026 AgentIndex.app|Built by a 10-year iOS Developer.
Best by use caseAboutContactAdvertisePrivacy PolicyTerms of UseQYSGitHubBuy me a coffee ☕

Browse by Category

MCP ServersCode AssistantWorkflow AutomationRAG / Knowledge BaseMulti-AgentBrowser AutomationLLM InfraDev ToolingObservability

Not affiliated with Anthropic, OpenAI or Microsoft.

Guides
#LLM Integration
$ Install
$ git clone <repo> && cd Wazuh-MCP-Server && sudo bash setup.sh
↗ Visit site★ GitHub
01

Features

01Comprehensive Wazuh SIEM integration for alert search and management.
02Advanced 3-Sum APT correlation engine for multi-IoC and volumetric attack detection.
03Unified threat intelligence aggregation from multiple providers.
04LangGraph-powered investigation workflows and attack graphing for incident analysis.
05Extensive host and domain forensics tools, including typosquatting and webshell detection.
02

Compatibility

Python
Runtime
Verified via docs
Linux
OS
Verified via docs
MacOS
OS
Verified via docs
Wazuh
Integration
Verified via docs
Claude Desktop
Client
Verified via docs
03

Quick start

1
$ git clone <repo>
2
$ cd Wazuh-MCP-Server
3
$ sudo bash setup.sh
04

Use cases

↳Performing comprehensive cyber attack overviews and generating curated threat reports.
↳Correlating APT attacks using MITRE-driven rules and volumetric analysis to identify threats.
↳Investigating suspicious activities and IPs with unified threat intelligence and LangGraph-powered workflows.
↳Conducting host and domain forensics, including vulnerability assessment and detection of malicious artifacts.
05

Alternatives

⚡Top VS:
VSvigil★397→VSfalcon-mcp★272→VSWazuh-MCP-Server★257→

Comments

Log in to leave a comment

No comments yet. Be the first!

On this page
01Features02Compatibility03Quick start04Use cases05Alternatives
VS
mcp-panther
★47
→
vigil logo
vigil★ 397
Vigil - a 100% OpenSource AI system for machine-speed network defense
VSCompare→
falcon-mcp logo
falcon-mcp★ 272
Connect AI agents to CrowdStrike Falcon for automated security analysis and threat hunting
VSCompare→
Wazuh-MCP-Server logo
Wazuh-MCP-Server★ 257
AI-powered security operations for Wazuh SIEM—use any MCP-compatible client to ask security questions in plain English. Faster threat detection, incident triage, and compliance checks with real-time monitoring and anomaly spotting. Production-ready MCP server for conversational SOC workflows.
VSCompare→
mcp-panther logo
mcp-panther★ 47
Write detections, investigate alerts, and query logs from your favorite AI agents
VSCompare→
quark-engine logo
quark-engine★ 1.7k
Quark Agent - Your AI-powered Android APK Analyst
VSCompare→
ai-security-tool logo
ai-security-tool★ 1.1k
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
VSCompare→
ida-pro-mcp logo
ida-pro-mcp★ 13.1k
AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
VSCompare→
hexstrike-ai logo
hexstrike-ai★ 13.0k
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
VSCompare→
See all alternatives →
INFOKOM-KI /
Wazuh-MCP-Server
↗

Wazuh MCP Server: AI-Driven SOC Automation

93BSD-3-Clause
Last commit1w ago
StatusActive
CategorySecurity & Safety
Links
Documentation↗Discussion↗Issues↗Releases↗
Cloud Infrastructure
Ad

Deploy on DigitalOcean

Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.

Claim $200 Free Credit