Wazuh (SIEM) MCP Server for CursorGive Cursor instant access to 21 tools to Create Agent, Create Security Role, Delete Agents, and more
GDPR Free for SubscribersCursor is an AI-first code editor built on VS Code that integrates LLM-powered coding assistance directly into the development workflow. Its Agent mode enables autonomous multi-step coding tasks, and MCP support lets agents access external data sources and APIs during code generation.
Ask AI about this MCP Server for Cursor
The Wazuh (SIEM) MCP Server for Cursor is a standout in the Fort Knox category — giving your AI agent 21 tools to work with, ready to go from day one.
Vinkius delivers Streamable HTTP and SSE to any MCP client
Gemini{
"mcpServers": {
"wazuh-siem": {
"url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
}
}
}Vinkius Desktop App
The modern way to manage MCP Servers — no config files, no terminal commands. Install Wazuh (SIEM) and 4,000+ MCP Servers from a single visual interface.
* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure
About Wazuh (SIEM) MCP Server
Connect your Wazuh SIEM to any AI agent to streamline security operations and endpoint monitoring through natural language.
Cursor's Agent mode turns Wazuh (SIEM) into an in-editor superpower. Ask Cursor to generate code using live data from Wazuh (SIEM) and it fetches, processes, and writes. all in a single agentic loop. 21 tools appear alongside file editing and terminal access, creating a unified development environment grounded in real-time information.
What you can do
- Agent Management — List all enrolled agents, create new ones, and perform bulk actions like restarts or upgrades using WQL filtering.
- Manager & Cluster Health — Monitor manager daemon status, fetch logs, and inspect cluster nodes to ensure high availability.
- Security Auditing — Query File Integrity Monitoring (Syscheck), Security Configuration Assessment (SCA), and Rootcheck results.
- Threat Intelligence — Access MITRE ATT&CK mappings and test log decoders to validate your detection pipeline.
- Rule Orchestration — List and update rules or decoders directly to fine-tune your security posture.
The Wazuh (SIEM) MCP Server exposes 21 tools through the Vinkius. Connect it to Cursor in under two minutes — credentials fully managed, no infrastructure to provision, no vendor lock-in. Your configuration, your data, your control.
All 21 Wazuh (SIEM) tools available for Cursor
When Cursor connects to Wazuh (SIEM) through Vinkius, your AI agent gets direct access to every tool listed below — spanning siem, threat-detection, vulnerability-management, and more. Every call runs in a secure, isolated environment with full audit visibility. Beyond a simple connection, you get real-time monitoring of agent activity, enterprise governance, and optimized token usage.
Create agent on Wazuh (SIEM)
Enroll a new Wazuh agent
Create security role on Wazuh (SIEM)
Create a new Wazuh security role
Delete agents on Wazuh (SIEM)
Use WQL to specify which agents to delete. Remove Wazuh agents
Get logtest on Wazuh (SIEM)
Test rules and decoders against logs
Get manager logs on Wazuh (SIEM)
Retrieve Wazuh manager logs
Get manager status on Wazuh (SIEM)
Get Wazuh manager daemon status
Get mitre on Wazuh (SIEM)
Supports WQL filtering. Get MITRE ATT&CK results
Get rootcheck on Wazuh (SIEM)
Supports WQL filtering. Get Rootcheck results
Get sca on Wazuh (SIEM)
Supports WQL filtering. Get Security Configuration Assessment (SCA) results
Get syscheck on Wazuh (SIEM)
Supports WQL filtering. Get File Integrity Monitoring (Syscheck) results
Get syscollector on Wazuh (SIEM)
Supports WQL filtering. Get Syscollector inventory
List agents on Wazuh (SIEM)
Supports WQL filtering. List all Wazuh agents
List cluster nodes on Wazuh (SIEM)
List Wazuh cluster nodes
List decoders on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh decoders
List rules on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh rules
List security users on Wazuh (SIEM)
List Wazuh API users
Restart agents on Wazuh (SIEM)
Restart Wazuh agents
Restart cluster on Wazuh (SIEM)
Restart the Wazuh cluster
Update rule file on Wazuh (SIEM)
Update a Wazuh rule file
Update security config on Wazuh (SIEM)
Update Wazuh security configuration
Upgrade agents on Wazuh (SIEM)
Upgrade Wazuh agents
Connect Wazuh (SIEM) to Cursor via MCP
Follow these steps to wire Wazuh (SIEM) into Cursor. The entire setup takes under two minutes — your credentials stay safe behind Vinkius.
Open MCP Settings
Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"Add the server config
mcp.json file that opensSave the file
Start using Wazuh (SIEM)
Why Use Cursor with the Wazuh (SIEM) MCP Server
Cursor AI Code Editor provides unique advantages when paired with Wazuh (SIEM) through the Model Context Protocol.
Agent mode turns Cursor into an autonomous coding assistant that can read files, run commands, and call MCP tools without switching context
Cursor's Composer feature can generate entire files using real-time data fetched through MCP. no copy-pasting from external dashboards
MCP tools appear alongside built-in tools like file reading and terminal access, creating a unified agentic environment
VS Code extension compatibility means your existing workflow, keybindings, and extensions all work alongside MCP tools
Wazuh (SIEM) + Cursor Use Cases
Practical scenarios where Cursor combined with the Wazuh (SIEM) MCP Server delivers measurable value.
Code generation with live data: ask Cursor to generate a security report module using live DNS and subdomain data fetched through MCP
Automated documentation: have Cursor query your API's tool schemas and generate TypeScript interfaces or OpenAPI specs automatically
Infrastructure-as-code: Cursor can fetch domain configurations and generate corresponding Terraform or CloudFormation templates
Test scaffolding: ask Cursor to pull real API responses via MCP and generate unit test fixtures from actual data
Example Prompts for Wazuh (SIEM) in Cursor
Ready-to-use prompts you can give your Cursor agent to start working with Wazuh (SIEM) immediately.
"List all Wazuh agents that are currently active."
"Show me the latest Security Configuration Assessment (SCA) results."
"Check the Wazuh manager logs for any recent errors."
Troubleshooting Wazuh (SIEM) MCP Server with Cursor
Common issues when connecting Wazuh (SIEM) to Cursor through Vinkius, and how to resolve them.
Tools not appearing in Cursor
Server shows as disconnected
Wazuh (SIEM) + Cursor FAQ
Common questions about integrating Wazuh (SIEM) MCP Server with Cursor.
What is Agent mode and why does it matter for MCP?
Where does Cursor store MCP configuration?
mcp.json file. You can configure servers at the project level (.cursor/mcp.json in your project root) or globally (~/.cursor/mcp.json). Project-level configs take precedence.Can Cursor use MCP tools in inline edits?
How do I verify MCP tools are loaded?
Explore More MCP Servers
View all →
Green Street
12 toolsManage commercial real estate & REIT data via Green Street — list companies, retrieve market analytics, and track transaction summaries directly via AI.
Tailscale
13 toolsManage your Tailscale mesh network — list devices, update ACL policies, manage auth keys, and inspect users directly from any AI agent.
VTEX Catalog
7 toolsSearch products, manage SKUs, update stock levels, and explore categories and brands on your VTEX store — all from any AI agent.
Together AI
7 toolsGenerate code, evaluate embeddings, and deploy open-source LLMs instantly from your local agent via Together AI's infrastructure.