Wazuh (SIEM) MCP Server for ClineGive Cline instant access to 21 tools to Create Agent, Create Security Role, Delete Agents, and more
GDPR Free for SubscribersCline is an autonomous AI coding agent inside VS Code that plans, executes, and iterates on tasks. Wire Wazuh (SIEM) through Vinkius and Cline gains direct access to every tool. from data retrieval to workflow automation. without leaving the terminal.
Ask AI about this MCP Server for Cline
The Wazuh (SIEM) MCP Server for Cline is a standout in the Fort Knox category — giving your AI agent 21 tools to work with, ready to go from day one.
Vinkius delivers Streamable HTTP and SSE to any MCP client
Gemini{
"mcpServers": {
"wazuh-siem": {
"url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
}
}
}Vinkius Desktop App
The modern way to manage MCP Servers — no config files, no terminal commands. Install Wazuh (SIEM) and 4,000+ MCP Servers from a single visual interface.
* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure
About Wazuh (SIEM) MCP Server
Connect your Wazuh SIEM to any AI agent to streamline security operations and endpoint monitoring through natural language.
Cline operates autonomously inside VS Code. it reads your codebase, plans a strategy, and executes multi-step tasks including Wazuh (SIEM) tool calls without waiting for prompts between steps. Connect 21 tools through Vinkius and Cline can fetch data, generate code, and commit changes in a single autonomous run.
What you can do
- Agent Management — List all enrolled agents, create new ones, and perform bulk actions like restarts or upgrades using WQL filtering.
- Manager & Cluster Health — Monitor manager daemon status, fetch logs, and inspect cluster nodes to ensure high availability.
- Security Auditing — Query File Integrity Monitoring (Syscheck), Security Configuration Assessment (SCA), and Rootcheck results.
- Threat Intelligence — Access MITRE ATT&CK mappings and test log decoders to validate your detection pipeline.
- Rule Orchestration — List and update rules or decoders directly to fine-tune your security posture.
The Wazuh (SIEM) MCP Server exposes 21 tools through the Vinkius. Connect it to Cline in under two minutes — credentials fully managed, no infrastructure to provision, no vendor lock-in. Your configuration, your data, your control.
All 21 Wazuh (SIEM) tools available for Cline
When Cline connects to Wazuh (SIEM) through Vinkius, your AI agent gets direct access to every tool listed below — spanning siem, threat-detection, vulnerability-management, and more. Every call runs in a secure, isolated environment with full audit visibility. Beyond a simple connection, you get real-time monitoring of agent activity, enterprise governance, and optimized token usage.
Create agent on Wazuh (SIEM)
Enroll a new Wazuh agent
Create security role on Wazuh (SIEM)
Create a new Wazuh security role
Delete agents on Wazuh (SIEM)
Use WQL to specify which agents to delete. Remove Wazuh agents
Get logtest on Wazuh (SIEM)
Test rules and decoders against logs
Get manager logs on Wazuh (SIEM)
Retrieve Wazuh manager logs
Get manager status on Wazuh (SIEM)
Get Wazuh manager daemon status
Get mitre on Wazuh (SIEM)
Supports WQL filtering. Get MITRE ATT&CK results
Get rootcheck on Wazuh (SIEM)
Supports WQL filtering. Get Rootcheck results
Get sca on Wazuh (SIEM)
Supports WQL filtering. Get Security Configuration Assessment (SCA) results
Get syscheck on Wazuh (SIEM)
Supports WQL filtering. Get File Integrity Monitoring (Syscheck) results
Get syscollector on Wazuh (SIEM)
Supports WQL filtering. Get Syscollector inventory
List agents on Wazuh (SIEM)
Supports WQL filtering. List all Wazuh agents
List cluster nodes on Wazuh (SIEM)
List Wazuh cluster nodes
List decoders on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh decoders
List rules on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh rules
List security users on Wazuh (SIEM)
List Wazuh API users
Restart agents on Wazuh (SIEM)
Restart Wazuh agents
Restart cluster on Wazuh (SIEM)
Restart the Wazuh cluster
Update rule file on Wazuh (SIEM)
Update a Wazuh rule file
Update security config on Wazuh (SIEM)
Update Wazuh security configuration
Upgrade agents on Wazuh (SIEM)
Upgrade Wazuh agents
Connect Wazuh (SIEM) to Cline via MCP
Follow these steps to wire Wazuh (SIEM) into Cline. The entire setup takes under two minutes — your credentials stay safe behind Vinkius.
Open Cline MCP Settings
Add remote server
Enable the server
Start using Wazuh (SIEM)
Why Use Cline with the Wazuh (SIEM) MCP Server
Cline provides unique advantages when paired with Wazuh (SIEM) through the Model Context Protocol.
Cline operates autonomously. it reads your codebase, plans a strategy, and executes multi-step tasks including MCP tool calls without step-by-step prompts
Runs inside VS Code, so you get MCP tool access alongside your existing extensions, terminal, and version control in a single window
Cline can create, edit, and delete files based on MCP tool responses, enabling end-to-end automation from data retrieval to code generation
Transparent execution: every tool call and file change is shown in Cline's activity log for full visibility and approval before committing
Wazuh (SIEM) + Cline Use Cases
Practical scenarios where Cline combined with the Wazuh (SIEM) MCP Server delivers measurable value.
Autonomous feature building: tell Cline to fetch data from Wazuh (SIEM) and scaffold a complete module with types, handlers, and tests
Codebase refactoring: use Wazuh (SIEM) tools to validate live data while Cline restructures your code to match updated schemas
Automated testing: Cline fetches real responses from Wazuh (SIEM) and generates snapshot tests or mocks based on actual payloads
Incident response: query Wazuh (SIEM) for real-time status and let Cline generate hotfix patches based on the findings
Example Prompts for Wazuh (SIEM) in Cline
Ready-to-use prompts you can give your Cline agent to start working with Wazuh (SIEM) immediately.
"List all Wazuh agents that are currently active."
"Show me the latest Security Configuration Assessment (SCA) results."
"Check the Wazuh manager logs for any recent errors."
Troubleshooting Wazuh (SIEM) MCP Server with Cline
Common issues when connecting Wazuh (SIEM) to Cline through Vinkius, and how to resolve them.
Server shows error in sidebar
Wazuh (SIEM) + Cline FAQ
Common questions about integrating Wazuh (SIEM) MCP Server with Cline.
How does Cline connect to MCP servers?
Can Cline run MCP tools without approval?
Does Cline support multiple MCP servers at once?
Explore More MCP Servers
View all →
U.S. Census Population — Demographics, Age & Diversity
5 toolsAccess demographic data from the American Community Survey (ACS). Get total population, median age, and detailed racial/ethnic breakdowns (White, Black, Asian, Hispanic, Foreign-born) for any U.S. state, county, or city.
MyTime
10 toolsManage business operations via MyTime — track appointments, staff, and services directly from your AI agent.
Vidyard
10 toolsManage video assets, players, and hosting on Vidyard — the leading video messaging platform for business.
GetYourGuide
12 toolsSearch and book tours, activities, and travel experiences via AI agents with GetYourGuide.