Loading...
{
"mcpServers": {
"wazuh": {
"command": "/path/to/mcp-server-wazuh",
"args": [],
"env": {
"WAZUH_API_HOST": "your_wazuh_manager_api_host",
"WAZUH_API_PORT": "55000",
"WAZUH_API_USERNAME": "your_wazuh_api_user",
"WAZUH_API_PASSWORD": "your_wazuh_api_password",
"WAZUH_INDEXER_HOST": "your_wazuh_indexer_host",
"WAZUH_INDEXER_PORT": "9200",
"WAZUH_INDEXER_USERNAME": "your_wazuh_indexer_user",
"WAZUH_INDEXER_PASSWORD": "your_wazuh_indexer_password",
"WAZUH_VERIFY_SSL": "false",
"WAZUH_TEST_PROTOCOL": "https",
"RUST_LOG": "info"
}
}
}
}get_wazuh_alert_summaryRetrieves a summary of recent security alerts from Wazuh.
Read-only operation, no modification of data.
get_wazuh_vulnerability_summaryProvides a summary of vulnerabilities detected on Wazuh agents.
Read-only operation, no modification of data.
get_wazuh_critical_vulnerabilitiesLists critical vulnerabilities found on Wazuh agents.
Read-only operation, no modification of data.
get_wazuh_agent_processesLists running processes on a specific Wazuh agent.
Read-only operation, no modification of data.
get_wazuh_agent_portsLists open ports on a specific Wazuh agent.
Read-only operation, no modification of data.
get_wazuh_running_agentsLists currently running Wazuh agents.
Read-only operation, no modification of data.
get_wazuh_rules_summaryProvides a summary of the Wazuh detection rules.
Read-only operation, no modification of data.
get_wazuh_weekly_statsRetrieves weekly statistics from the Wazuh manager.
Read-only operation, no modification of data.
get_wazuh_remoted_statsRetrieves statistics from the Wazuh remoted service.
Read-only operation, no modification of data.
get_wazuh_log_collector_statsRetrieves statistics from the Wazuh log collector.
Read-only operation, no modification of data.
get_wazuh_cluster_healthRetrieves the health status of the Wazuh cluster.
Read-only operation, no modification of data.
get_wazuh_cluster_nodesLists the nodes in the Wazuh cluster.
Read-only operation, no modification of data.
search_wazuh_manager_logsSearches the Wazuh manager logs for specific events.
Read-only operation, no modification of data.
get_wazuh_manager_error_logsRetrieves error logs from the Wazuh manager.
Read-only operation, no modification of data.
The Wazuh MCP Server is generally safe for read-only operations, such as querying alerts and agent information. However, caution should be exercised when using tools that modify Wazuh configurations, and proper access controls should be enforced on the Wazuh API to mitigate risks.