Wazuh (SIEM) MCP Server for WindsurfGive Windsurf instant access to 21 tools to Create Agent, Create Security Role, Delete Agents, and more
GDPR Free for SubscribersWindsurf brings agentic AI coding to a purpose-built IDE. Connect Wazuh (SIEM) through Vinkius and Cascade will auto-discover every tool. ask questions, generate code, and act on live data without leaving your editor.
Ask AI about this MCP Server for Windsurf
The Wazuh (SIEM) MCP Server for Windsurf is a standout in the Fort Knox category — giving your AI agent 21 tools to work with, ready to go from day one.
Vinkius delivers Streamable HTTP and SSE to any MCP client
Gemini{
"mcpServers": {
"wazuh-siem": {
"url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
}
}
}Vinkius Desktop App
The modern way to manage MCP Servers — no config files, no terminal commands. Install Wazuh (SIEM) and 4,000+ MCP Servers from a single visual interface.
* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure
About Wazuh (SIEM) MCP Server
Connect your Wazuh SIEM to any AI agent to streamline security operations and endpoint monitoring through natural language.
Windsurf's Cascade agent chains multiple Wazuh (SIEM) tool calls autonomously. query data, analyze results, and generate code in a single agentic session. Paste Vinkius Edge URL, reload, and all 21 tools are immediately available. Real-time tool feedback appears inline, so you see API responses directly in your editor.
What you can do
- Agent Management — List all enrolled agents, create new ones, and perform bulk actions like restarts or upgrades using WQL filtering.
- Manager & Cluster Health — Monitor manager daemon status, fetch logs, and inspect cluster nodes to ensure high availability.
- Security Auditing — Query File Integrity Monitoring (Syscheck), Security Configuration Assessment (SCA), and Rootcheck results.
- Threat Intelligence — Access MITRE ATT&CK mappings and test log decoders to validate your detection pipeline.
- Rule Orchestration — List and update rules or decoders directly to fine-tune your security posture.
The Wazuh (SIEM) MCP Server exposes 21 tools through the Vinkius. Connect it to Windsurf in under two minutes — credentials fully managed, no infrastructure to provision, no vendor lock-in. Your configuration, your data, your control.
All 21 Wazuh (SIEM) tools available for Windsurf
When Windsurf connects to Wazuh (SIEM) through Vinkius, your AI agent gets direct access to every tool listed below — spanning siem, threat-detection, vulnerability-management, and more. Every call runs in a secure, isolated environment with full audit visibility. Beyond a simple connection, you get real-time monitoring of agent activity, enterprise governance, and optimized token usage.
Create agent on Wazuh (SIEM)
Enroll a new Wazuh agent
Create security role on Wazuh (SIEM)
Create a new Wazuh security role
Delete agents on Wazuh (SIEM)
Use WQL to specify which agents to delete. Remove Wazuh agents
Get logtest on Wazuh (SIEM)
Test rules and decoders against logs
Get manager logs on Wazuh (SIEM)
Retrieve Wazuh manager logs
Get manager status on Wazuh (SIEM)
Get Wazuh manager daemon status
Get mitre on Wazuh (SIEM)
Supports WQL filtering. Get MITRE ATT&CK results
Get rootcheck on Wazuh (SIEM)
Supports WQL filtering. Get Rootcheck results
Get sca on Wazuh (SIEM)
Supports WQL filtering. Get Security Configuration Assessment (SCA) results
Get syscheck on Wazuh (SIEM)
Supports WQL filtering. Get File Integrity Monitoring (Syscheck) results
Get syscollector on Wazuh (SIEM)
Supports WQL filtering. Get Syscollector inventory
List agents on Wazuh (SIEM)
Supports WQL filtering. List all Wazuh agents
List cluster nodes on Wazuh (SIEM)
List Wazuh cluster nodes
List decoders on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh decoders
List rules on Wazuh (SIEM)
Supports WQL filtering. List loaded Wazuh rules
List security users on Wazuh (SIEM)
List Wazuh API users
Restart agents on Wazuh (SIEM)
Restart Wazuh agents
Restart cluster on Wazuh (SIEM)
Restart the Wazuh cluster
Update rule file on Wazuh (SIEM)
Update a Wazuh rule file
Update security config on Wazuh (SIEM)
Update Wazuh security configuration
Upgrade agents on Wazuh (SIEM)
Upgrade Wazuh agents
Connect Wazuh (SIEM) to Windsurf via MCP
Follow these steps to wire Wazuh (SIEM) into Windsurf. The entire setup takes under two minutes — your credentials stay safe behind Vinkius.
Open MCP Settings
Cmd+Shift+P and search "MCP"Add the server
mcp_config.jsonSave and reload
Start using Wazuh (SIEM)
Why Use Windsurf with the Wazuh (SIEM) MCP Server
Windsurf provides unique advantages when paired with Wazuh (SIEM) through the Model Context Protocol.
Windsurf's Cascade agent autonomously chains multiple tool calls in sequence, solving complex multi-step tasks without manual intervention
Purpose-built for agentic workflows. Cascade understands context across your entire codebase and integrates MCP tools natively
JSON-based configuration means zero code changes: paste a URL, reload, and all 21 tools are immediately available
Real-time tool feedback is displayed inline, so you see API responses directly in your editor without switching contexts
Wazuh (SIEM) + Windsurf Use Cases
Practical scenarios where Windsurf combined with the Wazuh (SIEM) MCP Server delivers measurable value.
Automated code generation: ask Cascade to fetch data from Wazuh (SIEM) and generate models, types, or handlers based on real API responses
Live debugging: query Wazuh (SIEM) tools mid-session to inspect production data while debugging without leaving the editor
Documentation generation: pull schema information from Wazuh (SIEM) and have Cascade generate comprehensive API docs automatically
Rapid prototyping: combine Wazuh (SIEM) data with Cascade's code generation to scaffold entire features in minutes
Example Prompts for Wazuh (SIEM) in Windsurf
Ready-to-use prompts you can give your Windsurf agent to start working with Wazuh (SIEM) immediately.
"List all Wazuh agents that are currently active."
"Show me the latest Security Configuration Assessment (SCA) results."
"Check the Wazuh manager logs for any recent errors."
Troubleshooting Wazuh (SIEM) MCP Server with Windsurf
Common issues when connecting Wazuh (SIEM) to Windsurf through Vinkius, and how to resolve them.
Server not connecting
Wazuh (SIEM) + Windsurf FAQ
Common questions about integrating Wazuh (SIEM) MCP Server with Windsurf.
How does Windsurf discover MCP tools?
mcp_config.json file on startup and connects to each configured server via Streamable HTTP. Tools are listed in the MCP panel and available to Cascade automatically.Can Cascade chain multiple MCP tool calls?
Does Windsurf support multiple MCP servers?
mcp_config.json. Each server's tools appear in the MCP panel and Cascade can use tools from different servers in a single flow.Explore More MCP Servers
View all →
Tradier
13 toolsTrade equities and options, fetch real-time market data, and manage your brokerage accounts directly through any AI agent.
Guidewire ClaimCenter
8 toolsManage insurance claims via ClaimCenter — track claim status, monitor exposures, and manage activities directly from any AI agent.
Exa AI
6 toolsSearch and discover the web — audit semantic results and similar links via AI.
Lemlist
8 toolsEquip your AI agent with direct access to Lemlist — manage cold email campaigns, track lead engagement, and automate outreach without opening the Lemlist dashboard.