wazuh-mcp 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Solomon Neas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,291 @@
+# wazuh-mcp
+
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.7-blue.svg)](https://www.typescriptlang.org/)
+[![Node.js](https://img.shields.io/badge/Node.js-20%2B-green.svg)](https://nodejs.org/)
+[![MCP](https://img.shields.io/badge/MCP-1.12-purple.svg)](https://modelcontextprotocol.io/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+A [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server for the [Wazuh](https://wazuh.com/) SIEM/XDR platform. Query agents, security alerts, detection rules, and decoders directly from Claude or any MCP-compatible client.
+
+## Features
+
+- **25 MCP Tools** - Agents, alerts, rules, decoders, SCA, syscollector, FIM, rootcheck, groups, and manager
+- **3 MCP Resources** - Pre-built views for agents, recent alerts, and rule summaries
+- **3 MCP Prompts** - Alert investigation, agent health checks, and security overviews
+- **JWT Authentication** - Automatic token management with refresh on expiry
+- **Full Compliance Mapping** - PCI-DSS, GDPR, HIPAA, NIST 800-53, MITRE ATT&CK
+- **Pagination** - All list endpoints support limit/offset pagination
+- **Type-Safe** - Full TypeScript with strict mode and Zod schema validation
+
+## Prerequisites
+
+- Node.js 20+
+- A running Wazuh manager with API access (default port 55000)
+- Wazuh API credentials (username/password)
+- (Optional) Wazuh Indexer (OpenSearch) access for alert queries
+
+## Installation
+
+```bash
+git clone https://github.com/solomonneas/wazuh-mcp.git
+cd wazuh-mcp
+npm install
+npm run build
+```
+
+## Configuration
+
+Set the following environment variables:
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `WAZUH_URL` | Yes | - | Wazuh API URL (e.g., `https://10.0.0.2:55000`) |
+| `WAZUH_USERNAME` | Yes | - | API username |
+| `WAZUH_PASSWORD` | Yes | - | API password |
+| `WAZUH_VERIFY_SSL` | No | `false` | Set to `true` to verify SSL certificates |
+
+Alternative variable names `WAZUH_BASE_URL` and `WAZUH_USER` are also supported.
+
+### Wazuh Indexer (OpenSearch) - Required for Alerts
+
+Wazuh 4.x stores alerts in the Wazuh Indexer (OpenSearch), not the REST API. To enable alert tools (`get_alerts`, `get_alert`, `search_alerts`) and the `wazuh://alerts/recent` resource, configure the indexer connection:
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `WAZUH_INDEXER_URL` | No | - | Wazuh Indexer URL (e.g., `https://10.0.0.2:9200`) |
+| `WAZUH_INDEXER_USERNAME` | No | `admin` | Indexer username |
+| `WAZUH_INDEXER_PASSWORD` | No | - | Indexer password |
+| `WAZUH_INDEXER_VERIFY_SSL` | No | `false` | Set to `true` to verify SSL certificates |
+
+If `WAZUH_INDEXER_URL` is not set, alert tools will return a helpful configuration message. All other tools (agents, rules, decoders, version) work without the indexer.
+
+## Usage
+
+### Claude Desktop
+
+Add to your Claude Desktop configuration (`claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "wazuh": {
+      "command": "node",
+      "args": ["/path/to/wazuh-mcp/dist/index.js"],
+      "env": {
+        "WAZUH_URL": "https://your-wazuh-manager:55000",
+        "WAZUH_USERNAME": "wazuh-wui",
+        "WAZUH_PASSWORD": "your-password",
+        "WAZUH_INDEXER_URL": "https://your-wazuh-indexer:9200",
+        "WAZUH_INDEXER_USERNAME": "admin",
+        "WAZUH_INDEXER_PASSWORD": "your-indexer-password"
+      }
+    }
+  }
+}
+```
+
+### OpenClaw
+
+Add to your `openclaw.json`:
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "wazuh": {
+        "type": "stdio",
+        "command": "node",
+        "args": ["/path/to/wazuh-mcp/dist/index.js"],
+        "env": {
+          "WAZUH_URL": "https://your-wazuh-manager:55000",
+          "WAZUH_USERNAME": "wazuh-wui",
+          "WAZUH_PASSWORD": "your-password",
+          "WAZUH_INDEXER_URL": "https://your-wazuh-indexer:9200",
+          "WAZUH_INDEXER_USERNAME": "admin",
+          "WAZUH_INDEXER_PASSWORD": "your-indexer-password"
+        }
+      }
+    }
+  }
+}
+```
+
+### Standalone
+
+```bash
+export WAZUH_URL=https://your-wazuh-manager:55000
+export WAZUH_USERNAME=wazuh-wui
+export WAZUH_PASSWORD=your-password
+npm start
+```
+
+### Development
+
+```bash
+npm run dev    # Watch mode with tsx
+npm run lint   # Type checking
+npm test       # Run tests
+```
+
+## MCP Tools
+
+### Agent Tools
+
+| Tool | Description |
+|------|-------------|
+| `list_agents` | List all agents with optional status filtering (active, disconnected, never_connected, pending) |
+| `get_agent` | Get detailed info for a specific agent by ID |
+| `get_agent_stats` | Get CPU, memory, and disk statistics for an agent |
+
+### Alert Tools
+
+| Tool | Description |
+|------|-------------|
+| `get_alerts` | Retrieve recent alerts with filtering by level, agent, rule, and text search |
+| `get_alert` | Retrieve a single alert by ID |
+| `search_alerts` | Full-text search across all alerts |
+
+### Rule Tools
+
+| Tool | Description |
+|------|-------------|
+| `list_rules` | List detection rules with level and group filtering |
+| `get_rule` | Get full rule details including compliance mappings |
+| `search_rules` | Search rules by description text |
+
+### SCA Tools (Security Configuration Assessment)
+
+| Tool | Description |
+|------|-------------|
+| `get_sca_policies` | List SCA policies and scores for an agent (CIS benchmarks, etc.) |
+| `get_sca_checks` | Get individual check results with remediation steps and compliance mappings |
+
+### Syscollector Tools (System Inventory)
+
+| Tool | Description |
+|------|-------------|
+| `get_agent_os` | Get OS information (name, version, architecture, hostname) |
+| `get_agent_packages` | List installed software packages with versions |
+| `get_agent_processes` | List running processes with PIDs and command lines |
+| `get_agent_ports` | List open network ports with associated processes |
+| `get_agent_network` | List network interfaces and IP addresses |
+| `get_agent_hotfixes` | List installed Windows hotfixes/patches |
+
+### FIM & Rootcheck Tools
+
+| Tool | Description |
+|------|-------------|
+| `get_fim_files` | Get File Integrity Monitoring results (files, registry keys, hashes) |
+| `get_rootcheck` | Get rootkit detection scan findings |
+
+### Manager Tools
+
+| Tool | Description |
+|------|-------------|
+| `get_manager_logs` | Get Wazuh manager logs filtered by level and module |
+| `get_manager_config` | Get active manager configuration by section |
+
+### Group Tools
+
+| Tool | Description |
+|------|-------------|
+| `list_groups` | List all agent groups |
+| `get_group_agents` | List agents in a specific group |
+
+### Other Tools
+
+| Tool | Description |
+|------|-------------|
+| `list_decoders` | List log decoders with optional name filtering |
+| `get_wazuh_version` | Get Wazuh manager version and API info |
+
+## MCP Resources
+
+| Resource URI | Description |
+|-------------|-------------|
+| `wazuh://agents` | All registered agents and their status |
+| `wazuh://alerts/recent` | 25 most recent security alerts |
+| `wazuh://rules/summary` | Detection rules sorted by severity |
+
+## MCP Prompts
+
+| Prompt | Description |
+|--------|-------------|
+| `investigate-alert` | Step-by-step alert investigation with MITRE mapping and remediation |
+| `agent-health-check` | Comprehensive agent health assessment (status, resources, alerts) |
+| `security-overview` | Full environment security summary with compliance coverage |
+
+## Examples
+
+### List active agents
+
+```
+Use list_agents with status "active" to see all connected agents.
+```
+
+### Investigate a brute force attempt
+
+```
+Search alerts for "brute force" and investigate the top result,
+including the MITRE ATT&CK technique and remediation steps.
+```
+
+### Check agent health
+
+```
+Run an agent health check on agent 001 - check its connection status,
+resource usage, and any recent critical alerts.
+```
+
+### Find high-severity rules
+
+```
+List all rules with level 12 or higher to see critical detection rules
+and their compliance framework mappings.
+```
+
+## Testing
+
+```bash
+npm test              # Run all tests
+npm run test:watch    # Watch mode
+```
+
+Tests use mocked Wazuh API responses - no live Wazuh instance needed.
+
+## Project Structure
+
+```
+wazuh-mcp/
+├── src/
+│   ├── index.ts           # MCP server entry point
+│   ├── config.ts          # Environment configuration
+│   ├── client.ts          # Wazuh REST API client (JWT auth)
+│   ├── indexer-client.ts  # Wazuh Indexer (OpenSearch) client
+│   ├── types.ts           # TypeScript type definitions
+│   ├── resources.ts       # MCP resource handlers
+│   ├── prompts.ts         # MCP prompt templates
+│   └── tools/
+│       ├── agents.ts      # Agent management tools
+│       ├── alerts.ts      # Alert query tools
+│       ├── rules.ts       # Rule query tools
+│       ├── decoders.ts    # Decoder listing tool
+│       ├── version.ts     # Version info tool
+│       ├── sca.ts         # Security Configuration Assessment
+│       ├── syscollector.ts # System inventory (OS, packages, ports, etc.)
+│       ├── syscheck.ts    # File Integrity Monitoring
+│       ├── rootcheck.ts   # Rootkit detection
+│       ├── manager.ts     # Manager logs and configuration
+│       └── groups.ts      # Agent group management
+├── tests/
+│   ├── client.test.ts     # API client unit tests
+│   └── tools.test.ts      # Tool handler unit tests
+├── package.json
+├── tsconfig.json
+├── tsup.config.ts
+└── vitest.config.ts
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }