How to Use the Wazuh (SIEM) MCP in Windsurf

Q: How do I use Wazuh (SIEM) with Windsurf for agent inventory?

You simply tell Windsurf to list the agents. The listagents tool uses WQL filtering, so you can specify exactly which groups of endpoints you want to audit. It returns a clean list that's ready for your next action.

Q: What is the best way to test Wazuh (SIEM) rules in a CI/CD pipeline using Windsurf?

You can use getlogtest within your workflow. This tool lets you run specific rules and decoders against sample logs without deploying anything live, saving time and preventing false positives.

Q: Does the MCP Server support checking cluster health with Windsurf?

Absolutely. You can check if all nodes are connected using listclusternodes. If you suspect a node is down, you can run restartcluster to bring it back online.

Q: What data types does the Wazuh (SIEM) MCP Server touch regarding user accounts?

This server manages Wazuh API users. You use listsecurityusers to view existing roles and credentials, which is key for audit logging.

Automate Wazuh SIEM Audits using Windsurf: Get security posture reports without leaving your IDE.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Wazuh (SIEM) MCP to Windsurf

Create your Vinkius account to connect Wazuh (SIEM) to Windsurf and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Wazuh (SIEM) with Windsurf

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Run Full Agent Lifecycle Management with Windsurf

Windsurf handles the complexity of agent management. You set a goal—like 'audit all agents'—and it executes multi-step actions, ensuring you don't miss anything. It can run `list_agents` to get a full roster, then use `create_agent` or `delete_agents` with WQL to manage them. It even restarts the whole group using `restart_agents`. The result is a complete security audit log.

Analyze Deep Security Status Using the MCP Server

Need to know if your Wazuh manager is actually running right? Windsurf checks the daemon status with `get_manager_status` or rolls back system changes using `update_security_config`. This prevents guesswork when diagnosing issues. It also lets you update rules and decoders directly via `update_rule_file`, ensuring your SIEM stack stays current. You'll get a clean, executable plan every time.

Perform Compliance Checks with Windsurf

Compliance checks are multi-tool jobs. With Windsurf, you simply state the requirement, and it figures out the steps to validate it. It collects data from `get_rootcheck`, `get_syscheck` (SCA), and `get_file_integrity_monitoring` in sequence. It builds a unified report detailing security gaps across your network endpoints using these dedicated tools.

Setup guide

Set up Wazuh (SIEM) MCP in Windsurf

Prerequisites

Windsurf IDE installed (macOS, Windows, or Linux)
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Click the Cascade assistant icon in the sidebar, then click the hammer icon (🔨) at the top of the panel. Select "Configure" to open ~/.codeium/windsurf/mcp_config.json.
2

Add the Wazuh (SIEM) MCP

Paste the JSON snippet shown on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Refresh MCPs

Go back to the hammer icon (🔨) in Cascade and click "Refresh". Windsurf will detect the new server. No full restart is needed — the connection is hot-reloaded.
4

Verify in Cascade

Start a new Cascade conversation and ask something like "Show my Wazuh (SIEM) payment history." If connected, Cascade will call the Wazuh (SIEM) tools directly. You will see a green dot next to the server name in the MCP panel.

mcp_config.json

{
  "mcpServers": {
    "wazuh-siem-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Wazuh. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Wazuh (SIEM) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Wazuh (SIEM) MCP in Windsurf

You simply tell Windsurf to list the agents. The `list_agents` tool uses WQL filtering, so you can specify exactly which groups of endpoints you want to audit. It returns a clean list that's ready for your next action.

Yes. If security policies change, you need to update the system config. Use the `update_security_config` tool on the MCP Server. This ensures all agents pick up the new rules without manual intervention.

You can use `get_logtest` within your workflow. This tool lets you run specific rules and decoders against sample logs without deploying anything live, saving time and preventing false positives.

Absolutely. You can check if all nodes are connected using `list_cluster_nodes`. If you suspect a node is down, you can run `restart_cluster` to bring it back online.

This server manages Wazuh API users. You use `list_security_users` to view existing roles and credentials, which is key for audit logging.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python