Mcp-wazuh
access level: read-only✔ Source-reviewed Oct 2026
We read this project's source code and tool definitions (Oct 2026). This is a code review, not a live test against real systems. Re-check after upgrades.
| Repository | https://github.com/Letos01/Mcp-wazuh |
|---|---|
| Category | Security/SIEM |
| Systems touched | Wazuh SIEM (API + indexer) |
| Access (as described) | read-only |
| License / price | MIT / free |
| GitHub stars | 0 |
| Read tools | 7 read-only tools (alerts, agents, searches) |
| Write / delete / exec tools | None (write tools on roadmap behind approval) |
| Read-only mode | Yes: readOnlyHint on every tool, readonly Wazuh role, warns if admin creds used |
| Safety notes | Wraps attacker-written log text as untrusted data and flags prompt-injection attempts, which most SIEM MCPs skip. Bearer token required in HTTP mode. |
| Verified | yes (README review 2026-10-24) |
| Notes | Brand new (Oct 2026), 0 stars. Added 2026-10-24. |
📬 SysAdmin Agents
The SysAdmin Agents newsletter: new MCP servers, agent skills and safety notes for sysadmins. One email a week.