Atlas / MCP servers / infokom-ki / Wazuh-MCP-Server

Wazuh-MCP-ServerBLOCK

Name: Wazuh-MCP-Server
Author: infokom-ki

mcp/infokom-ki/wazuh-mcp-server

MCP server by infokom-ki · ai agents · blue team · llm · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Wazuh MCP Server: AI-Driven SOC Automation

Verdict

BLOCK

Grade

Trust score

56 /100

Exposed tools

114 99r · 13w · 2d

Transport

stdio · streamable-http

License

BSD-3-Clause

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://glama.ai/mcp/servers/INFOKOM-KI/Wazuh-MCP-Server)

A defensive MCP server for Claude Desktop / any MCP client — the blue-team counterpart to offensive tooling. 159 tools + 4 resources (133 when WAZUH_READ_ONLY=true) across Wazuh SIEM, multi-provider threat intelligence, MITRE-driven 3-Sum APT correlation, attack graphing, LangGraph investigation workflows, local case RAG, host forensics, and opt-in HDBSCAN clustering + ATT&CK incident labeling. Read-only by default.

Programmer: NAuliajati (csirt[at]tangerangkota[.]go[.]id)

Architecture

main.py -> mcp_server/  (package)
├─ core/          HTTP client, redaction, audit, config, attack graph, IOC store
├─ wazuh/         Indexer (OpenSearch) + Manager API (JWT auth)
├─ correlation/   3-Sum engine (pure computation, MITRE-driven)
├─ threat_intel/  CrowdSec, ThreatFox, OTX, URLhaus, GreyNoise + shared cache
├─ agents/        LangGraph investigation + playbook workflows
└─ tools/         64 tool modules

Every tool call flows through a single pipeline in the @blueteam_tool decorator — the three most-connected nodes in the code graph:

audit (_audit_log) -> call -> redact (_redact_alert_data) -> truncate (_truncate_if_needed)

CHARACTER_LIMIT (100000 by default) caps what leaves the server. An oversized JSON body comes back as valid JSON with truncated: true instead of a sliced document, and in-process langgraph calls skip the cap enti

Read from source at commit 7da5192d570fOBSERVED · 2026-10-08

Exposed tools (114)

99 read · 13 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`argus_ip_lookup`	read	Query Argus Threat Intelligence (TangerangKota-CSIRT) aggregating 7 sources.
`blueteam_asset_context`	read	Look up internal asset context for a hostname/subdomain.
`blueteam_attack_chain`	destructive	Analyze rule-to-rule transitions to reconstruct attack kill-chain progression.
`blueteam_attack_graph`	read	Analyze the attacker relationship graph - campaign clusters, hubs, bridges.
`blueteam_beacon_detect`	read	Detect C2 beaconing patterns via inter-arrival time analysis.
`blueteam_breach_check`	read	Check whether an email address appeared in a known data breach (RapidAPI Breach Check).
`blueteam_calendar_heatmap`	read	Detect scheduled attack patterns via day×hour heatmap analysis.
`blueteam_campaign_watch`	read	Detect campaign evolution: new clusters and growth in existing clusters.
`blueteam_capture_traffic`	read	Capture live network traffic using tcpdump. Requires root or CAP_NET_RAW.
`blueteam_case_add_iocs`	write	Attach IOC to an existing case.
`blueteam_case_add_verdict`	write	Record an investigation verdict against a srcip within a case.
`blueteam_case_create`	write	Create a new investigation case (durable incident record).
`blueteam_case_get`	read	Fetch a case by ID, with all its IOCs and verdicts.
`blueteam_case_list`	read	List all cases (most recent first).
`blueteam_check_open_firewall`	read	Show current firewall rules (iptables/nftables/ufw). Identifies
`blueteam_check_ssh_authorized_keys`	read	List all SSH authorized_keys files across all user home directories.
`blueteam_check_updates`	read	Check for available security updates (Debian/Ubuntu: apt, RHEL: dnf/yum).
`blueteam_check_webshell`	read	Check a URL for active webshell or backdoor via curl + signature scan.
`blueteam_crtsh_lookup`	read	Search SSL certificate transparency logs for a domain via crt.sh.
`blueteam_curated_threat_report`	read	Generate a geo/domain/rule-filtered threat intelligence report in one call.
`blueteam_cve_advisory`	read	Fetch Microsoft (MSRC), Red Hat, and Ubuntu security advisories for a CVE.
`blueteam_cve_attack_mapping`	read	Map a CVE to MITRE ATT&CK techniques and the threat groups that use them.
`blueteam_cve_epss`	read	Return EPSS scores for one or more CVE IDs (exploitation probability).
`blueteam_cve_kev`	read	Check if a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog.
`blueteam_cve_lookup`	read	Fetch a CVE record from NVD: description, CVSS, severity, references.
`blueteam_cve_poc`	read	Search for public proof-of-concept exploits for a CVE (GitHub + Nuclei).
`blueteam_cve_score`	read	Compute a composite 0-100 risk score for a CVE (CVSS + EPSS + KEV + PoC).
`blueteam_cve_ssvc`	read	Triage a CVE with the CISA SSVC Deployer tree (Act / Attend / Track* / Track).
`blueteam_dependency_scan`	read	Scan a dependency manifest against OSV.dev and return vulnerable packages.
`blueteam_domain_permute`	read	Generate typosquatting/phishing lookalikes of a domain.
`blueteam_export_report`	read	Generate a SOC report deliverable (.docx / .xlsx / .pptx) via officecli.
`blueteam_extract_iocs`	read	Extract structured Indicators of Compromise from raw text.
`blueteam_fail2ban_jail_status`	read	Get detailed status of a specific fail2ban jail, including all banned IPs.
`blueteam_fail2ban_status`	read	List all active fail2ban jails and their ban counts.
`blueteam_fail2ban_unban`	read	Unban an IP address from a specific fail2ban jail.
`blueteam_failed_logins`	read	Show all failed login attempts from /var/log/btmp (lastb).
`blueteam_false_positive_kb`	read	List the false-positive knowledge base - IOC the 3-Sum engine auto-suppresses.
`blueteam_false_positive_tracker`	read	Count how often a Wazuh rule fired but was later marked false-positive.
`blueteam_find_suid_files`	read	Find all SUID/SGID binaries on the system. Unexpected SUID files
`blueteam_find_world_writable`	read	Find world-writable files and directories (excluding /proc, /sys, /dev).
`blueteam_hash_file`	read	Compute a cryptographic hash of a file. Use to detect tampering.
`blueteam_index_schema`	read	Discover Wazuh Indexer field names and types before building queries.
`blueteam_investigate_ip`	write	Run an IP investigation: alert profile, timeline, and geo.
`blueteam_investigation_history`	read	Check if an IP was previously investigated and what the verdict was.
`blueteam_investigation_summary`	read	Dashboard: unique IPs investigated, verdict breakdown, analyst notes.
`blueteam_investigation_workflow`	write	Run the full SOC investigation workflow (langgraph) end-to-end.
`blueteam_ioc_lifecycle`	read	Query the IOC lifecycle store - discovered IOCs ranked by time-decay recency.
`blueteam_ioc_search`	read	Search IOC databases for a source IP (RapidAPI IOC Search).
`blueteam_ioc_search_bulk`	read	Search IOC databases for many source IPs, one metered request per IP.
`blueteam_ip_intel_bulk`	read	Look up threat intelligence for many IPs in a single metered request.
`blueteam_journalctl`	read	Query systemd journal for any service. Useful for services without flat log files.
`blueteam_last_logins`	read	Show recent login history from /var/log/wtmp. Includes successful
`blueteam_list_connections`	read	List all established TCP connections with remote IPs and local processes.
`blueteam_list_cron_jobs`	write	List all system and user cron jobs. Attackers often add cron jobs
`blueteam_list_listening_ports`	read	List all TCP/UDP ports currently listening, with owning process.
`blueteam_list_processes`	read	List all running processes with CPU, memory, PID, and command line.
`blueteam_list_users`	read	List all local user accounts with UID, GID, home dir, and shell.
`blueteam_lookup_domain_virustotal`	read	Check domain reputation via VirusTotal.
`blueteam_lookup_hash_virustotal`	read	Check file hash reputation via VirusTotal.
`blueteam_lynis_audit`	write	Run a Lynis system hardening audit. Checks hundreds of security controls
`blueteam_mark_investigated`	read	Record an IP investigation verdict in the persistent JSONL history.
`blueteam_metrics`	read	Show server telemetry per-tool call counts, latency, and guard counters.
`blueteam_mitre_lookup`	read	Look up a MITRE ATT&CK tactic or technique in the local mapping.
`blueteam_owned_domains`	read	Show the active redaction policy and the configured owned (victim) domains.
`blueteam_pivot_suggest`	read	Suggest the next investigation step for an IOC, driven by the attack graph.
`blueteam_playbook_run`	write	Run an alert-driven hunting + investigation playbook (langgraph supervisor).
`blueteam_prompt_route`	read	Map a natural language security prompt to the most relevant Wazuh MCP tools.
`blueteam_read_auth_log`	read	Read and optionally filter /var/log/auth.log for SSH, sudo, and PAM events.
`blueteam_read_syslog`	read	Read /var/log/syslog or journalctl for general system events.
`blueteam_read_web_log`	read	Read nginx or Apache access/error logs. Great for spotting web attacks.
`blueteam_rootkit_scan`	write	Run a rootkit scanner (rkhunter or chkrootkit) to check for known rootkits.
`blueteam_semantic_search`	read	Semantic search over Wazuh rules using BM25 lexical ranking.
`blueteam_set_owned_domains`	write	Set the runtime owned (victim) domains used by `protect_victim` redaction.
`blueteam_stix_analyze`	read	Correlate Wazuh findings with the MITRE ATT&CK STIX 2.1 knowledge graph.
`blueteam_stix_killchain`	destructive	Build an ATT&CK kill chain for a source IP from observed alerts + the STIX graph.
`blueteam_sudo_history`	read	Show recent sudo command usage from auth.log.
`blueteam_system_health`	read	Get an overview of system health: uptime, disk, memory, CPU load.
`blueteam_threat_card`	read	Generate a threat card for a source IP.
`blueteam_threat_hunt`	write	Run a named threat hunting query against Wazuh alert data.
`blueteam_threat_intel_aggregate`	read	Aggregate threat intelligence from all available providers for one IOC.
`blueteam_unified_threat_score`	read	Query multiple threat intel sources and return a unified confidence score.
`blueteam_wazuh_alert_compare`	read	Compare alert profiles of two source IP side-by-side.
`blueteam_wazuh_alert_summarize`	read	Summarize Wazuh alerts for a source IP into a compact threat digest.
`blueteam_wazuh_alerts`	read	Read Wazuh security alerts - local alerts.json first, auto-fallback to Indexer.
`blueteam_wazuh_compliance`	read	Summarize Wazuh alerts by compliance framework (CIS, PCI DSS, GDPR, HIPAA, NIST 800-53).
`blueteam_wazuh_export`	read	Export Wazuh alerts to a JSONL file on the server using OpenSearch scroll API.
`blueteam_wazuh_geo_heatmap`	read	Generate attack coordinate and city-level geo heatmap data.
`blueteam_wazuh_indexer_search`	read	Query Wazuh Indexer (OpenSearch) for alerts/events with cursor pagination.
`blueteam_wazuh_syscheck`	read	Query Wazuh File Integrity Monitoring (syscheck) events from the indexer.
`blueteam_wazuh_vulnerabilities`	read	Query Wazuh vulnerability scanning results from the indexer.
`blueteam_who_is_logged_in`	read	Show currently logged-in users, their source IPs, and session times.
`blueteam_whois_lookup`	read	Look up domain registration via RDAP (free, no API key required).
`crowdsec_ip_reputation`	read	_audit_log(
`crowdsec_ip_reputation_bulk`	write	import asyncio
`greynoise_ip_context`	read	Check if an IP is a known internet scanner or business service (free, no auth).
`jarm_fingerprint`	read	Fingerprint a TLS server (JARM-style) to identify C2/malware infrastructure.
`netra_ip_analysis`	read	Query Netra Threat Intelligence for IP analysis.
`otx_lookup`	read	Look up an IOC in AlienVault OTX (Open Threat Exchange).
`otx_lookup_bulk`	read	Look up multiple IOCs against AlienVault OTX concurrently (max 20).
`sangfor_blocklist_check`	read	Check if an IP is currently blocked by Sangfor firewall.
`sangfor_blocklist_list`	read	List IP blocked by Sangfor firewall, optionally filtered by timestamp and/or attacker IP/IoC.
`threatfox_ioc_search`	read	Search ThreatFox by abuse.ch for malware-associated indicators of compromise.
`threatfox_ioc_search_bulk`	read	Search multiple IOCs against ThreatFox concurrently (max 25).
`urlhaus_hash_lookup`	read	Look up a file hash (MD5/SHA256) in URLhaus malware payload database.
`urlhaus_lookup`	read	Check if a URL is a known malware distributor via URLhaus (abuse.ch).
`urlhaus_lookup_bulk`	read	Check multiple URLs against URLhaus concurrently (max 20).
`wazuh_alert_aggregate_analysis`	read	Zero-doc statistical analysis of Wazuh alerts across the full index.
`wazuh_alert_dsl_query`	write	Execute a raw OpenSearch DSL aggregation query against the Wazuh Indexer.
`wazuh_alert_focused_crawl`	read	Surgical deep-dive into specific Wazuh alert clusters.
`wazuh_alert_timeline`	read	Return a time-bucketed breakdown of Wazuh alerts using OpenSearch date_histogram.
`wazuh_attack_velocity`	read	Compare two adjacent time windows to detect attack acceleration or deceleration.
`wazuh_compromised_emails_analysis`	read	Correlate compromised email addresses with attacker IPs from Wazuh alerts.
`wazuh_domain_lookup`	read	Search Wazuh alerts for a specific domain name.
`wazuh_email_lookup`	read	Search Wazuh alerts for email addresses and rank top-N most frequently seen.

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (12 observation(s))
Network: declared (16 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

mcp_server/core/tool_decorator.py:171

out[k] = eval(v, globalns)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

mcp_server/tools/webshell_check.py:27

(r"<\?php\s+exec\s*\(.+\)", "Generic PHP exec() backdoor", "medium"),

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

mcp_server/tools/host_forensics.py:641

name="blueteam_check_ssh_authorized_keys",