Wazuh-MCP-Server

Name: Wazuh-MCP-Server Review
Item: Wazuh-MCP-Server
Rating: 3.0
Author: Aaron Matthews

Connector Productivity Usable

Works inClaude Code Claude Cowork Claude Chat

Usable Scanned — metadata only

Automates threat detection and incident response across distributed infrastructure, reducing mean time to detection (MTTD) and enabling security teams to foc…

Wazuh MCP Server: AI-Driven SOC Automation

Ask Claude to analyze security alerts from Wazuh and prioritize which incidents need immediate response.
Generate automated incident reports by querying Wazuh data for compliance and audit documentation.
Find suspicious patterns in endpoint logs to identify potential security threats across your infrastructure.

93 starsBSD-3-Clause (commercial OK)FreeNo code needed

Usable rating — This tool is functional but has notable gaps. Review the evaluation notes below before deploying.

Why it matters

Automates threat detection and incident response across distributed infrastructure, reducing mean time to detection (MTTD) and enabling security teams to focus on high-severity incidents rather than routine alert triage.

Best for

Security operations centers (SOCs) and enterprise security teams managing multi-environment threat monitoring and response workflows.

Works in

Claude Code Claude Cowork Claude Chat

Source

https://github.com/INFOKOM-KI/Wazuh-MCP-Server

By INFOKOM-KI

How to Get It

Option 1: Claude Desktop AppOpen the Customize panel in the sidebar → browse connectors → search and add. Works in Claude Code, Claude Cowork, and Claude Chat.

Option 2: Paste into Claude CodeCopy the command below and paste it into a Claude Code conversation. Claude will run it for you.

Command

claude mcp add Wazuh-MCP-Server -- npx -y Wazuh-MCP-Server

Tip: Paste this into a Claude Code conversation. Verify command matches your Claude Code version.

Auto-generated from the tool's public listing — not hands-on verified. Cross-check against the source repo's README before running.

First thing to try

Once it’s connected, paste this into Claude:

Analyze security alerts from Wazuh and prioritize which incidents need immediate response

CostFree

Trust Signals Auto-scanned

Stars93Contributors1Last updated2026-10-14LicenseBSD-3-Clause (OK for commercial use)Known CVEsNone foundSources: GitHub Advisory Database + OSV.dev · Scanned 2026-10-30 · scanner v1

Data & Access

Data processingPrompts sent to Anthropic API. Enterprise/Team plans exclude training.

Community Pulse New

No community discussions found yet. This doesn't mean the tool isn't good — it may be new or serve a niche use case.

Reviewer notes

Auto-scanned review. These are observations, not a security certification.

Scored from trust signals (evidence-eval-v1): 58 GitHub stars; contributors unknown; last commit 0d ago; license BSD-3-Clause.

Things to check

Scanned, not hands-on tested — this entry was auto-scanned from public metadata (GitHub metrics, license, security flags). No reviewer has run it, and no tool-specific limitations have been documented yet.
Single maintainer. Consider the risk if this person stops maintaining the project.

How to evaluate tools before deploying →

Data shown here comes from public APIs and automated scanning. Reviewer notes reflect one person's experience. This is not a security certification or legal recommendation. Always evaluate tools according to your own organization's policies.

Evaluation Scores

Evaluation

Ease of Use

3/5

Versatility

3/5

Reliability

3/5

Security

3/5

Overall score3.00 / 5.00 UsableEvaluatedSep 2026

Scored from trust signals (evidence-eval-v1): 58 GitHub stars; contributors unknown; last commit 0d ago; license BSD-3-Clause.

← Back to the Claude Observatory