Wazuh (SIEM) MCP Server for Claude CodeGive Claude Code instant access to 21 tools to Create Agent, Create Security Role, Delete Agents, and more

Connect your Wazuh SIEM to any AI agent to streamline security operations and endpoint monitoring through natural language.

Claude Code registers Wazuh (SIEM) as an MCP server in a single terminal command. Once connected, Claude Code discovers all 21 tools at runtime and can call them headlessly. ideal for CI/CD pipelines, cron jobs, and automated workflows where Wazuh (SIEM) data drives decisions without human intervention.

What you can do

• Agent Management — List all enrolled agents, create new ones, and perform bulk actions like restarts or upgrades using WQL filtering.
• Manager & Cluster Health — Monitor manager daemon status, fetch logs, and inspect cluster nodes to ensure high availability.
• Security Auditing — Query File Integrity Monitoring (Syscheck), Security Configuration Assessment (SCA), and Rootcheck results.
• Threat Intelligence — Access MITRE ATT&CK mappings and test log decoders to validate your detection pipeline.
• Rule Orchestration — List and update rules or decoders directly to fine-tune your security posture.

The Wazuh (SIEM) MCP Server exposes 21 tools through the Vinkius. Connect it to Claude Code in under two minutes — credentials fully managed, no infrastructure to provision, no vendor lock-in. Your configuration, your data, your control.