Wazuh (SIEM) MCP Server for Mastra AIGive Mastra AI instant access to 21 tools to Create Agent, Create Security Role, Delete Agents, and more
GDPR Free for SubscribersMastra AI is a TypeScript-native agent framework built for modern web stacks. Connect Wazuh (SIEM) through Vinkius and Mastra agents discover all tools automatically. type-safe, streaming-ready, and deployable anywhere Node.js runs.
Ask AI about this MCP Server for Mastra AI
The Wazuh (SIEM) MCP Server for Mastra AI is a standout in the Fort Knox category — giving your AI agent 21 tools to work with, ready to go from day one.
Vinkius delivers Streamable HTTP and SSE to any MCP client
Geminiimport { Agent } from "@mastra/core/agent";
import { createMCPClient } from "@mastra/mcp";
import { openai } from "@ai-sdk/openai";
async function main() {
// Your Vinkius token. get it at cloud.vinkius.com
const mcpClient = await createMCPClient({
servers: {
"wazuh-siem": {
url: "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp",
},
},
});
const tools = await mcpClient.getTools();
const agent = new Agent({
name: "Wazuh (SIEM) Agent",
instructions:
"You help users interact with Wazuh (SIEM) " +
"using 21 tools.",
model: openai("gpt-4o"),
tools,
});
const result = await agent.generate(
"What can I do with Wazuh (SIEM)?"
);
console.log(result.text);
}
main();
* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure
About Wazuh (SIEM) MCP Server
Connect your Wazuh SIEM to any AI agent to streamline security operations and endpoint monitoring through natural language.
Mastra's agent abstraction provides a clean separation between LLM logic and Wazuh (SIEM) tool infrastructure. Connect 21 tools through Vinkius and use Mastra's built-in workflow engine to chain tool calls with conditional logic, retries, and parallel execution. deployable to any Node.js host in one command.
What you can do
- Agent Management — List all enrolled agents, create new ones, and perform bulk actions like restarts or upgrades using WQL filtering.
- Manager & Cluster Health — Monitor manager daemon status, fetch logs, and inspect cluster nodes to ensure high availability.
- Security Auditing — Query File Integrity Monitoring (Syscheck), Security Configuration Assessment (SCA), and Rootcheck results.
- Threat Intelligence — Access MITRE ATT&CK mappings and test log decoders to validate your detection pipeline.
- Rule Orchestration — List and update rules or decoders directly to fine-tune your security posture.
The Wazuh (SIEM) MCP Server exposes 21 tools through the Vinkius. Connect it to Mastra AI in under two minutes — credentials fully managed, no infrastructure to provision, no vendor lock-in. Your configuration, your data, your control.
All 21 Wazuh (SIEM) tools available for Mastra AI
When Mastra AI connects to Wazuh (SIEM) through Vinkius, your AI agent gets direct access to every tool listed below — spanning siem, threat-detection, vulnerability-management, and more. Every call runs in a secure, isolated environment with full audit visibility. Beyond a simple connection, you get real-time monitoring of agent activity, enterprise governance, and optimized token usage.
Create agent on Wazuh (SIEM)
Enroll a new Wazuh agent
Create security role on Wazuh (SIEM)
Create a new Wazuh security role
Delete agents on Wazuh (SIEM)
Use WQL to specify which agents to delete. Remove Wazuh agents
Get logtest on Wazuh (SIEM)
Test rules and decoders against logs
Get manager logs on Wazuh (SIEM)
Retrieve Wazuh manager logs
Get manager status on Wazuh (SIEM)
Get Wazuh manager daemon status
Get mitre on Wazuh (SIEM)
Supports WQL filtering. Get MITRE ATT&CK results
Get rootcheck on Wazuh (SIEM)
Supports WQL filtering. Get Rootcheck results
Get sca on Wazuh (SIEM)
Supports WQL filtering. Get Security Configuration Assessment (SCA) results
Get syscheck on Wazuh (SIEM)
Supports WQL filtering. Get File Integrity Monitoring (Syscheck) results
Get syscollector on Wazuh (SIEM)
Supports WQL filtering. Get Syscollector inventory
List agents on Wazuh (SIEM)
Supports WQL filtering. List all Wazuh agents
List cluster nodes on Wazuh (SIEM)
List Wazuh cluster nodes
List decoders on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh decoders
List rules on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh rules
List security users on Wazuh (SIEM)
List Wazuh API users
Restart agents on Wazuh (SIEM)
Restart Wazuh agents
Restart cluster on Wazuh (SIEM)
Restart the Wazuh cluster
Update rule file on Wazuh (SIEM)
Update a Wazuh rule file
Update security config on Wazuh (SIEM)
Update Wazuh security configuration
Upgrade agents on Wazuh (SIEM)
Upgrade Wazuh agents
Connect Wazuh (SIEM) to Mastra AI via MCP
Follow these steps to wire Wazuh (SIEM) into Mastra AI. The entire setup takes under two minutes — your credentials stay safe behind Vinkius.
Install dependencies
npm install @mastra/core @mastra/mcp @ai-sdk/openaiReplace the token
[YOUR_TOKEN_HERE] with your Vinkius tokenRun the agent
agent.ts and run with npx tsx agent.tsExplore tools
Why Use Mastra AI with the Wazuh (SIEM) MCP Server
Mastra AI provides unique advantages when paired with Wazuh (SIEM) through the Model Context Protocol.
Mastra's agent abstraction provides a clean separation between LLM logic and tool infrastructure. add Wazuh (SIEM) without touching business code
Built-in workflow engine chains MCP tool calls with conditional logic, retries, and parallel execution for complex automation
TypeScript-native: full type inference for every Wazuh (SIEM) tool response with IDE autocomplete and compile-time checks
One-command deployment to any Node.js host. Vercel, Railway, Fly.io, or your own infrastructure
Wazuh (SIEM) + Mastra AI Use Cases
Practical scenarios where Mastra AI combined with the Wazuh (SIEM) MCP Server delivers measurable value.
Automated workflows: build multi-step agents that query Wazuh (SIEM), process results, and trigger downstream actions in a typed pipeline
SaaS integrations: embed Wazuh (SIEM) as a first-class tool in your product's AI features with Mastra's clean agent API
Background jobs: schedule Mastra agents to query Wazuh (SIEM) on a cron and store results in your database automatically
Multi-agent systems: create specialist agents that collaborate using Wazuh (SIEM) tools alongside other MCP servers
Example Prompts for Wazuh (SIEM) in Mastra AI
Ready-to-use prompts you can give your Mastra AI agent to start working with Wazuh (SIEM) immediately.
"List all Wazuh agents that are currently active."
"Show me the latest Security Configuration Assessment (SCA) results."
"Check the Wazuh manager logs for any recent errors."
Troubleshooting Wazuh (SIEM) MCP Server with Mastra AI
Common issues when connecting Wazuh (SIEM) to Mastra AI through Vinkius, and how to resolve them.
createMCPClient not exported
npm install @mastra/mcpWazuh (SIEM) + Mastra AI FAQ
Common questions about integrating Wazuh (SIEM) MCP Server with Mastra AI.
How does Mastra AI connect to MCP servers?
MCPClient with the server URL and pass it to your agent. Mastra discovers all tools and makes them available with full TypeScript types.Can Mastra agents use tools from multiple servers?
Does Mastra support workflow orchestration?
Explore More MCP Servers
View all →
Chuanyun
10 toolsEnterprise workflow automation and digital engine — manage business objects, forms, and approval history via AI.
Codefresh
8 toolsManage CI/CD and GitOps via Codefresh — track pipelines, trigger builds, and monitor delivery clusters directly from any AI agent.
NASA
9 toolsExplore space and science via NASA APIs — browse APOD, Mars rover photos, Earth imagery, NEO data and patents from any AI agent.
Pangea (Security APIs)
40 toolsSecure your AI applications with Pangea's comprehensive security APIs — scan for PII, redact sensitive data, audit logs, and check for embargoed IPs.