Wazuh-MCP-Server

Grade A: derived only from the two verdicts below. How grades work

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

ActiveCurrent depsChecked Oct 19, 2026Free

Visit Wazuh-MCP-Server ↗Source on GitHub ↗

Why this verdict

How we check →

87 commits by 5 contributors in the last 90 days (24 in the last 30). receipt ↗
Latest release v5.0.0, 25 days ago. receipt ↗
On current major: Pydantic. receipt ↗
Not counted in verdict: FastAPI 0 → 0. receipt ↗

Snapshot: commit e751871 on main, checked 2026-10-19 07:57 UTC. Receipts link to files at this exact commit.

Dependency freshness

Package	Declared	Latest	Status
FastAPI fastapi	0.128.0	0.146.0	Behind, not counted
Pydantic pydantic	2.12.0	2.14.1	Current

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

Framework: FastAPI
API layer: Pydantic, Uvicorn

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

AI
Local LLM stacka vLLM + Open WebUI stack (compose.local-llm.yml)
AI
Toolset filtering for small modelstoolset filtering for small models
Analytics
Compliance checksrun_compliance_check (PCI-DSS, HIPAA, SOX, GDPR, NIST, ISO27001)
API
Streamable HTTP MCP endpointMCP transport: Streamable HTTP at /mcp
Auth
Bearer token authenticationbearer tokens minted from an API key
Auth
OAuth 2.0 with PKCEOAuth 2.0 (authorization code + PKCE)
Auth
OpenID Connect sign-inat an OpenID Connect provider (Entra ID, Google Workspace, Okta, Keycloak)
Auth
Scope-based access controlscope-based access control and audit logging
Auth
Read-only by defaultRead-only by default. The 14 state-changing tools require the wazuh:write scope
Deploy
Docker Compose deploymentDeployment: Docker Compose or a published multi-arch image
Deploy
Multi-arch container imageMulti-arch images (amd64, arm64) are published to GitHub Container Registry
Deploy
Optional Redis sessionsoptional Redis for multi-instance sessions
Other
Active response with rollbackactive response with verification and rollback
Other
Guided promptsAlso 5 guided prompts, 6 resources and 3 resource templates

Extracted from the kit's README by a local AI model (deepseek-flash) on Oct 1, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.

Watch Wazuh-MCP-Server

Get told if it goes dormant, gets archived, falls further behind on a core dependency, or changes its license or price.

RSS feed for Wazuh-MCP-Server · all changes

History

Oct 1, 2026 → Oct 19, 2026. One square per check, colored by maintenance status. Hover for details.

Show as a table

Date	Maintenance	Dependencies	Commits (90d)
Oct 19, 2026	Active	Current deps	87
Oct 12, 2026	Active	Current deps	87
Oct 1, 2026	Active	Current deps	90

Sources

Every claim on this page comes from these public records, checked Oct 19, 2026. Open them to verify.

Commit history ↗ default branch (main) at the checked commit: pulse, contributors, last commit
Releases ↗ latest release
pyproject.toml ↗ declared dependency versions and stack (at commit e751871)
requirements.txt ↗ declared dependency versions and stack (at commit e751871)
README ↗ quoted features at the checked commit
PyPI ↗ latest versions of Python packages (each linked in the table above)

Maintainer? Add the badge

It updates automatically every time we refresh the evidence. Clicking it opens this page.

[![kitproof](https://kitproof.dev/badge/wazuh-mcp-server-gensecaihq.svg)](https://kitproof.dev/kits/wazuh-mcp-server-gensecaihq/)