MCP server for Wazuh SIEM/XDR: query alerts, agents, vulnerabilities, and rules from Claude or any AI client. Read-only.
Quick Install
Copy the config for your editor. Some servers may need additional setup — check the README.
Add to claude_desktop_config.json:
{
"mcpServers": {
"wazuh-mcp": {
"command": "npx",
"args": [
"-y",
"lidless-labs/wazuh-mcp"
]
}
}
}
Run in terminal:
claude mcp add wazuh-mcp npx -y lidless-labs/wazuh-mcp
Add to .cursor/mcp.json:
{
"mcpServers": {
"wazuh-mcp": {
"command": "npx",
"args": [
"-y",
"lidless-labs/wazuh-mcp"
]
}
}
}