How do I install Wazuh-MCP-Server?

Its own README gives this command: docker pull ghcr.io/gensecaihq/wazuh-mcp-server:latest. Run it where your MCP client can launch the server, and check the README for any settings it asks for.

What does Wazuh-MCP-Server connect to, and what does it need?

It reaches vllm and webui. The credentials we found in its source are AUTH_SECRET_KEY, MCP_API_KEY, VLLM_API_KEY and WEBUI_SECRET_KEY.

Is Wazuh-MCP-Server official and is it maintained?

We found nothing naming it as a vendor’s official server. Its repository has 257 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-16.

What licence does Wazuh-MCP-Server use?

The repository declares the MIT licence.

InfratoApp / Resources / MCP servers / Wazuh-MCP-Server

Wazuh-MCP-Server

Wazuh-MCP-Server is an MCP server, listed under security. It reaches vllm and webui. It needs AUTH_SECRET_KEY, MCP_API_KEY, VLLM_API_KEY and WEBUI_SECRET_KEY to authenticate. Its repository has 257 GitHub stars and is licensed under MIT; we last read it on 2026-10-22.

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

Install

Read from Wazuh-MCP-Server’s own README, close to verbatim -- not written by us, and not guessed.

docker pull ghcr.io/gensecaihq/wazuh-mcp-server:latest

View in Wazuh-MCP-Server’s own README ↗

What it reaches, and what it needs

Reaches

vllm, webui

Credential

AUTH_SECRET_KEY, MCP_API_KEY, VLLM_API_KEY, WEBUI_SECRET_KEY

Maintenance

Stars

257

State

listed

Licence

MIT

From the repository

View on GitHub ↗2026-10-22

Wazuh-MCP-Server compared with similar servers

Wazuh-MCP-Server compared with the closest alternatives, by services reached, credentials, stars, last update and licence
Server	Reaches	Needs	Stars	Last update	Licence
Wazuh-MCP-Server (this page)	vllm, webui	AUTH_SECRET_KEY, MCP_API_KEY, VLLM_API_KEY, WEBUI_SECRET_KEY	257	2026-10-16	MIT
ida-pro-mcp	—	None listed	13,080	2026-09-26	MIT
mcp-shodan	shodan	SHODAN_API_KEY	178	2026-10-19	MIT
mcp-server-idapro	—	None listed	103	2025-03-26	MIT
search-solodit-mcp	—	None listed	42	2025-06-30	—
opencti-mcp	opencti	OPENCTI_TOKEN	40	2026-08-03	MIT

Ranked by services in common with Wazuh-MCP-Server, then by stars. Figures are from each repository when we last read it.

Common questions about Wazuh-MCP-Server

What does Wazuh-MCP-Server do?: Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.
How do I install Wazuh-MCP-Server?: Its own README gives this command: docker pull ghcr.io/gensecaihq/wazuh-mcp-server:latest. Run it where your MCP client can launch the server, and check the README for any settings it asks for.
What does Wazuh-MCP-Server connect to, and what does it need?: It reaches vllm and webui. The credentials we found in its source are AUTH_SECRET_KEY, MCP_API_KEY, VLLM_API_KEY and WEBUI_SECRET_KEY.
Is Wazuh-MCP-Server official and is it maintained?: We found nothing naming it as a vendor’s official server. Its repository has 257 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-16.
What licence does Wazuh-MCP-Server use?: The repository declares the MIT licence.

More MCP servers for security

ida-pro-mcp13,080 stars
mcp-shodan178 stars
mcp-server-idapro103 stars
search-solodit-mcp42 stars
opencti-mcp40 stars
MalwareBazaar_MCP30 stars

All security entries →