wazuh-mcp 1.0.0

package/dist/index.js

@@ -0,0 +1,1941 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/config.ts
+function getConfig() {
+  const url = process.env.WAZUH_URL || process.env.WAZUH_BASE_URL;
+  if (!url) {
+    throw new Error(
+      "WAZUH_URL environment variable is required. Set it to your Wazuh manager API URL (e.g., https://localhost:55000)"
+    );
+  }
+  const username = process.env.WAZUH_USERNAME || process.env.WAZUH_USER;
+  if (!username) {
+    throw new Error(
+      "WAZUH_USERNAME environment variable is required. Set it to your Wazuh API username."
+    );
+  }
+  const password = process.env.WAZUH_PASSWORD;
+  if (!password) {
+    throw new Error(
+      "WAZUH_PASSWORD environment variable is required. Set it to your Wazuh API password."
+    );
+  }
+  const verifySslStr = process.env.WAZUH_VERIFY_SSL ?? "false";
+  const verifySsl = verifySslStr.toLowerCase() === "true";
+  const timeout = parseInt(process.env.WAZUH_TIMEOUT ?? "30", 10) * 1e3;
+  let indexer;
+  const indexerUrl = process.env.WAZUH_INDEXER_URL;
+  if (indexerUrl) {
+    indexer = {
+      url: indexerUrl.replace(/\/+$/, ""),
+      username: process.env.WAZUH_INDEXER_USERNAME ?? "admin",
+      password: process.env.WAZUH_INDEXER_PASSWORD ?? "",
+      verifySsl: (process.env.WAZUH_INDEXER_VERIFY_SSL ?? "false").toLowerCase() === "true"
+    };
+  }
+  return { url: url.replace(/\/+$/, ""), username, password, verifySsl, timeout, indexer };
+}
+
+// src/client.ts
+var WazuhClientError = class extends Error {
+  constructor(message, statusCode) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "WazuhClientError";
+  }
+};
+var WazuhAuthenticationError = class extends WazuhClientError {
+  constructor(message, statusCode) {
+    super(message, statusCode);
+    this.name = "WazuhAuthenticationError";
+  }
+};
+var WazuhClient = class {
+  token = null;
+  baseUrl;
+  username;
+  password;
+  verifySsl;
+  timeout;
+  constructor(config) {
+    this.baseUrl = config.url;
+    this.username = config.username;
+    this.password = config.password;
+    this.verifySsl = config.verifySsl;
+    this.timeout = config.timeout;
+  }
+  get fetchOptions() {
+    const opts = {};
+    if (!this.verifySsl) {
+    }
+    return opts;
+  }
+  createAbortSignal() {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+    return {
+      signal: controller.signal,
+      clear: () => clearTimeout(timeoutId)
+    };
+  }
+  async authenticate() {
+    const credentials = Buffer.from(
+      `${this.username}:${this.password}`
+    ).toString("base64");
+    const { signal, clear } = this.createAbortSignal();
+    let response;
+    try {
+      response = await fetch(
+        `${this.baseUrl}/security/user/authenticate`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Basic ${credentials}`,
+            "Content-Type": "application/json"
+          },
+          signal,
+          ...this.fetchOptions
+        }
+      );
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new WazuhClientError(`Wazuh API authentication timeout after ${this.timeout}ms`);
+      }
+      throw error;
+    } finally {
+      clear();
+    }
+    if (!response.ok) {
+      throw new WazuhAuthenticationError(
+        `Authentication failed: ${response.status} ${response.statusText}`,
+        response.status
+      );
+    }
+    const body = await response.json();
+    if (!body.data?.token) {
+      throw new WazuhAuthenticationError(
+        "Authentication response missing token"
+      );
+    }
+    this.token = body.data.token;
+    return this.token;
+  }
+  async ensureAuthenticated() {
+    if (!this.token) {
+      await this.authenticate();
+    }
+  }
+  async request(method, endpoint, params, body) {
+    await this.ensureAuthenticated();
+    const url = new URL(`${this.baseUrl}${endpoint}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
+        }
+      }
+    }
+    const headers = {
+      Authorization: `Bearer ${this.token}`,
+      "Content-Type": "application/json"
+    };
+    const { signal, clear } = this.createAbortSignal();
+    let response;
+    try {
+      response = await fetch(url.toString(), {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : void 0,
+        signal,
+        ...this.fetchOptions
+      });
+    } catch (error) {
+      clear();
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new WazuhClientError(`Wazuh API timeout after ${this.timeout}ms`);
+      }
+      throw error;
+    }
+    clear();
+    if (response.status === 401) {
+      this.token = null;
+      await this.authenticate();
+      headers.Authorization = `Bearer ${this.token}`;
+      const { signal: retrySignal, clear: retryClear } = this.createAbortSignal();
+      let retryResponse;
+      try {
+        retryResponse = await fetch(url.toString(), {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0,
+          signal: retrySignal,
+          ...this.fetchOptions
+        });
+      } catch (error) {
+        retryClear();
+        if (error instanceof Error && error.name === "AbortError") {
+          throw new WazuhClientError(`Wazuh API timeout after ${this.timeout}ms`);
+        }
+        throw error;
+      }
+      retryClear();
+      if (!retryResponse.ok) {
+        throw new WazuhClientError(
+          `Request failed after re-auth: ${retryResponse.status} ${retryResponse.statusText}`,
+          retryResponse.status
+        );
+      }
+      return await retryResponse.json();
+    }
+    if (!response.ok) {
+      let errorMsg = `${response.status} ${response.statusText}`;
+      try {
+        const errorBody = await response.json();
+        if (errorBody.message) {
+          errorMsg = `${errorMsg}: ${errorBody.message}`;
+        }
+      } catch {
+      }
+      throw new WazuhClientError(`Request failed: ${errorMsg}`, response.status);
+    }
+    return await response.json();
+  }
+  async get(endpoint, params) {
+    return this.request("GET", endpoint, params);
+  }
+  // --- Agent methods ---
+  async getAgents(params = {}) {
+    return this.get("/agents", params);
+  }
+  async getAgent(agentId) {
+    return this.get(`/agents`, { agents_list: agentId });
+  }
+  async getAgentStats(agentId) {
+    return this.get(`/agents/${agentId}/stats/agent`);
+  }
+  // --- Alert methods ---
+  async getAlerts(params = {}) {
+    return this.get("/alerts", params);
+  }
+  // --- Rule methods ---
+  async getRules(params = {}) {
+    return this.get("/rules", params);
+  }
+  async getRule(ruleId) {
+    return this.get("/rules", { rule_ids: ruleId });
+  }
+  // --- Decoder methods ---
+  async getDecoders(params = {}) {
+    return this.get("/decoders", params);
+  }
+  // --- Version method ---
+  async getVersion() {
+    return this.get("/");
+  }
+  // --- SCA methods ---
+  async getScaPolicies(agentId) {
+    return this.get(`/sca/${agentId}`);
+  }
+  async getScaChecks(agentId, policyId, params = {}) {
+    return this.get(`/sca/${agentId}/checks/${policyId}`, params);
+  }
+  // --- Syscollector methods ---
+  async getAgentOs(agentId) {
+    return this.get(`/syscollector/${agentId}/os`);
+  }
+  async getAgentPackages(agentId, params = {}) {
+    return this.get(`/syscollector/${agentId}/packages`, params);
+  }
+  async getAgentProcesses(agentId, params = {}) {
+    return this.get(`/syscollector/${agentId}/processes`, params);
+  }
+  async getAgentPorts(agentId, params = {}) {
+    return this.get(`/syscollector/${agentId}/ports`, params);
+  }
+  async getAgentNetwork(agentId) {
+    return this.get(`/syscollector/${agentId}/netiface`);
+  }
+  async getAgentHotfixes(agentId, params = {}) {
+    return this.get(`/syscollector/${agentId}/hotfixes`, params);
+  }
+  // --- Rootcheck methods ---
+  async getRootcheck(agentId, params = {}) {
+    return this.get(`/rootcheck/${agentId}`, params);
+  }
+  // --- Syscheck / FIM methods ---
+  async getFimFiles(agentId, params = {}) {
+    return this.get(`/syscheck/${agentId}`, params);
+  }
+  // --- Manager methods ---
+  async getManagerLogs(params = {}) {
+    return this.get("/manager/logs", params);
+  }
+  async getManagerConfig(params = {}) {
+    return this.get("/manager/configuration", params);
+  }
+  // --- Group methods ---
+  async getGroups(params = {}) {
+    return this.get("/groups", params);
+  }
+  async getGroupAgents(groupId, params = {}) {
+    return this.get(`/groups/${groupId}/agents`, params);
+  }
+};
+
+// src/indexer-client.ts
+var WazuhIndexerError = class extends Error {
+  constructor(message, statusCode) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "WazuhIndexerError";
+  }
+};
+var WazuhIndexerClient = class {
+  baseUrl;
+  authHeader;
+  verifySsl;
+  timeout = 3e4;
+  constructor(config) {
+    this.baseUrl = config.url;
+    this.authHeader = "Basic " + Buffer.from(`${config.username}:${config.password}`).toString("base64");
+    this.verifySsl = config.verifySsl;
+  }
+  createAbortSignal() {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+    return { signal: controller.signal, clear: () => clearTimeout(timeoutId) };
+  }
+  async post(path, body) {
+    const url = `${this.baseUrl}${path}`;
+    const { signal, clear } = this.createAbortSignal();
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        headers: {
+          Authorization: this.authHeader,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body),
+        signal
+      });
+    } catch (error) {
+      clear();
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new WazuhIndexerError(`Wazuh Indexer request timeout after ${this.timeout}ms`);
+      }
+      throw error;
+    }
+    clear();
+    if (!response.ok) {
+      let errorMsg = `${response.status} ${response.statusText}`;
+      try {
+        const errorBody = await response.json();
+        if (errorBody.error) {
+          errorMsg = `${errorMsg}: ${JSON.stringify(errorBody.error)}`;
+        }
+      } catch {
+      }
+      throw new WazuhIndexerError(`Indexer request failed: ${errorMsg}`, response.status);
+    }
+    return await response.json();
+  }
+  mapHitToAlert(hit) {
+    const s = hit._source;
+    const rule = s.rule;
+    const agent = s.agent;
+    const manager = s.manager;
+    const decoder = s.decoder;
+    const mitre = rule?.mitre;
+    return {
+      id: hit._id,
+      timestamp: s.timestamp,
+      rule: rule ? {
+        id: rule.id,
+        level: rule.level,
+        description: rule.description,
+        groups: rule.groups,
+        pci_dss: rule.pci_dss,
+        gdpr: rule.gdpr,
+        hipaa: rule.hipaa,
+        nist_800_53: rule.nist_800_53,
+        mitre: mitre ? {
+          id: mitre.id,
+          tactic: mitre.tactic,
+          technique: mitre.technique
+        } : void 0
+      } : void 0,
+      agent: agent ? {
+        id: agent.id,
+        name: agent.name,
+        ip: agent.ip
+      } : void 0,
+      manager: manager ? { name: manager.name } : void 0,
+      location: s.location,
+      decoder: decoder ? { name: decoder.name } : void 0,
+      full_log: s.full_log,
+      data: s.data
+    };
+  }
+  async searchAlerts(query, size, from) {
+    const body = {
+      query,
+      size,
+      from,
+      sort: [{ timestamp: { order: "desc" } }]
+    };
+    const result = await this.post("/wazuh-alerts-*/_search", body);
+    return {
+      alerts: result.hits.hits.map((h) => this.mapHitToAlert(h)),
+      total: result.hits.total.value
+    };
+  }
+  async getRecentAlerts(limit, offset, filters) {
+    const must = [];
+    if (filters?.level !== void 0) {
+      must.push({ range: { "rule.level": { gte: filters.level } } });
+    }
+    if (filters?.agent_id) {
+      must.push({ term: { "agent.id": filters.agent_id } });
+    }
+    if (filters?.rule_id) {
+      must.push({ term: { "rule.id": filters.rule_id } });
+    }
+    if (filters?.search) {
+      must.push({
+        multi_match: {
+          query: filters.search,
+          fields: ["full_log", "rule.description", "agent.name"]
+        }
+      });
+    }
+    const query = must.length > 0 ? { bool: { must } } : { match_all: {} };
+    return this.searchAlerts(query, limit, offset);
+  }
+  async getAlert(id) {
+    const body = {
+      query: { ids: { values: [id] } },
+      size: 1
+    };
+    const result = await this.post("/wazuh-alerts-*/_search", body);
+    if (result.hits.hits.length === 0) return null;
+    return this.mapHitToAlert(result.hits.hits[0]);
+  }
+  async fullTextSearch(query, limit, offset, filters) {
+    const must = [
+      {
+        multi_match: {
+          query,
+          fields: ["full_log", "rule.description", "agent.name"]
+        }
+      }
+    ];
+    if (filters?.level !== void 0) {
+      must.push({ range: { "rule.level": { gte: filters.level } } });
+    }
+    if (filters?.agent_id) {
+      must.push({ term: { "agent.id": filters.agent_id } });
+    }
+    return this.searchAlerts({ bool: { must } }, limit, offset);
+  }
+};
+
+// src/tools/agents.ts
+import { z } from "zod";
+function registerAgentTools(server, client) {
+  server.tool(
+    "list_agents",
+    "List all Wazuh agents with optional status filtering",
+    {
+      status: z.enum(["active", "disconnected", "never_connected", "pending"]).optional().describe(
+        "Filter by agent status: active, disconnected, never_connected, or pending"
+      ),
+      limit: z.number().int().min(1).max(100).default(10).describe("Maximum number of agents to return (1-100)"),
+      offset: z.number().int().min(0).default(0).describe("Pagination offset"),
+      sort: z.string().optional().describe("Sort field with direction prefix (e.g., '-name', '+id')")
+    },
+    async ({ status, limit, offset, sort }) => {
+      try {
+        const params = { limit, offset };
+        if (status) params.status = status;
+        if (sort) params.sort = sort;
+        const response = await client.getAgents(params);
+        const data = response.data;
+        const result = {
+          agents: data.affected_items.map((agent) => ({
+            id: agent.id,
+            name: agent.name,
+            ip: agent.ip,
+            status: agent.status,
+            group: agent.group,
+            os_name: agent.os?.name,
+            os_version: agent.os?.version,
+            os_platform: agent.os?.platform,
+            version: agent.version,
+            manager: agent.manager,
+            node_name: agent.node_name,
+            date_add: agent.dateAdd,
+            last_keepalive: agent.lastKeepAlive
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent",
+    "Get detailed information about a specific Wazuh agent by ID",
+    {
+      agent_id: z.string().describe("Agent identifier (e.g., '001')")
+    },
+    async ({ agent_id }) => {
+      try {
+        const response = await client.getAgent(agent_id);
+        const agents = response.data.affected_items;
+        if (agents.length === 0) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({ error: `Agent '${agent_id}' not found` })
+              }
+            ],
+            isError: true
+          };
+        }
+        const agent = agents[0];
+        const result = {
+          id: agent.id,
+          name: agent.name,
+          ip: agent.ip,
+          status: agent.status,
+          group: agent.group,
+          os_name: agent.os?.name,
+          os_version: agent.os?.version,
+          os_platform: agent.os?.platform,
+          version: agent.version,
+          manager: agent.manager,
+          node_name: agent.node_name,
+          date_add: agent.dateAdd,
+          last_keepalive: agent.lastKeepAlive,
+          register_ip: agent.registerIP
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent_stats",
+    "Get system statistics (CPU, memory, disk) for a specific Wazuh agent",
+    {
+      agent_id: z.string().describe("Agent identifier (e.g., '001')")
+    },
+    async ({ agent_id }) => {
+      try {
+        const agentResponse = await client.getAgent(agent_id);
+        const agents = agentResponse.data.affected_items;
+        if (agents.length === 0) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({ error: `Agent '${agent_id}' not found` })
+              }
+            ],
+            isError: true
+          };
+        }
+        const agent = agents[0];
+        const statsResponse = await client.getAgentStats(agent_id);
+        const stats = statsResponse.data.affected_items[0] ?? {};
+        const result = {
+          agent_id: agent.id,
+          agent_name: agent.name,
+          cpu: stats.cpu,
+          memory: stats.memory,
+          disk: stats.disk
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/alerts.ts
+import { z as z2 } from "zod";
+var NO_INDEXER_MSG = "Alerts require WAZUH_INDEXER_URL configuration. Wazuh 4.x stores alerts in the Wazuh Indexer (OpenSearch), not the REST API.";
+function registerAlertTools(server, _client, indexerClient) {
+  server.tool(
+    "get_alerts",
+    "Retrieve recent security alerts from Wazuh with optional filtering",
+    {
+      limit: z2.number().int().min(1).max(100).default(10).describe("Maximum number of alerts to return (1-100)"),
+      offset: z2.number().int().min(0).default(0).describe("Pagination offset"),
+      level: z2.number().int().min(0).optional().describe("Minimum rule severity level"),
+      agent_id: z2.string().optional().describe("Filter by agent ID"),
+      rule_id: z2.string().optional().describe("Filter by specific rule ID"),
+      sort: z2.string().optional().describe("Sort field with direction prefix (e.g., '-timestamp')"),
+      search: z2.string().optional().describe("Search term for full_log text")
+    },
+    async ({ limit, offset, level, agent_id, rule_id, search }) => {
+      if (!indexerClient) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: NO_INDEXER_MSG }) }],
+          isError: true
+        };
+      }
+      try {
+        const { alerts, total } = await indexerClient.getRecentAlerts(limit, offset, {
+          level,
+          agent_id,
+          rule_id,
+          search
+        });
+        const result = {
+          alerts: alerts.map((alert) => ({
+            id: alert.id,
+            timestamp: alert.timestamp,
+            rule_id: alert.rule?.id,
+            rule_level: alert.rule?.level,
+            rule_description: alert.rule?.description,
+            rule_groups: alert.rule?.groups,
+            agent_id: alert.agent?.id,
+            agent_name: alert.agent?.name,
+            location: alert.location,
+            decoder: alert.decoder?.name,
+            full_log: alert.full_log,
+            mitre: alert.rule?.mitre
+          })),
+          total,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_alert",
+    "Retrieve a single security alert by its ID",
+    {
+      alert_id: z2.string().describe("Alert identifier")
+    },
+    async ({ alert_id }) => {
+      if (!indexerClient) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: NO_INDEXER_MSG }) }],
+          isError: true
+        };
+      }
+      try {
+        const alert = await indexerClient.getAlert(alert_id);
+        if (!alert) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({ error: `Alert '${alert_id}' not found` })
+              }
+            ],
+            isError: true
+          };
+        }
+        const result = {
+          id: alert.id,
+          timestamp: alert.timestamp,
+          rule_id: alert.rule?.id,
+          rule_level: alert.rule?.level,
+          rule_description: alert.rule?.description,
+          rule_groups: alert.rule?.groups,
+          agent_id: alert.agent?.id,
+          agent_name: alert.agent?.name,
+          location: alert.location,
+          decoder: alert.decoder?.name,
+          full_log: alert.full_log,
+          mitre: alert.rule?.mitre,
+          data: alert.data
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "search_alerts",
+    "Perform full-text search across Wazuh security alerts",
+    {
+      query: z2.string().describe("Search query string"),
+      limit: z2.number().int().min(1).max(100).default(10).describe("Maximum number of alerts to return (1-100)"),
+      offset: z2.number().int().min(0).default(0).describe("Pagination offset"),
+      level: z2.number().int().min(0).optional().describe("Minimum rule severity level"),
+      agent_id: z2.string().optional().describe("Filter by agent ID")
+    },
+    async ({ query, limit, offset, level, agent_id }) => {
+      if (!indexerClient) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: NO_INDEXER_MSG }) }],
+          isError: true
+        };
+      }
+      try {
+        const { alerts, total } = await indexerClient.fullTextSearch(query, limit, offset, {
+          level,
+          agent_id
+        });
+        const result = {
+          alerts: alerts.map((alert) => ({
+            id: alert.id,
+            timestamp: alert.timestamp,
+            rule_id: alert.rule?.id,
+            rule_level: alert.rule?.level,
+            rule_description: alert.rule?.description,
+            rule_groups: alert.rule?.groups,
+            agent_id: alert.agent?.id,
+            agent_name: alert.agent?.name,
+            location: alert.location,
+            decoder: alert.decoder?.name,
+            full_log: alert.full_log,
+            mitre: alert.rule?.mitre
+          })),
+          total,
+          query,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/rules.ts
+import { z as z3 } from "zod";
+function registerRuleTools(server, client) {
+  server.tool(
+    "list_rules",
+    "List all Wazuh rules with optional level and group filtering",
+    {
+      level: z3.number().int().min(0).optional().describe("Filter by rule severity level"),
+      group: z3.string().optional().describe("Filter by rule group name"),
+      limit: z3.number().int().min(1).max(100).default(10).describe("Maximum number of rules to return (1-100)"),
+      offset: z3.number().int().min(0).default(0).describe("Pagination offset"),
+      sort: z3.string().optional().describe("Sort field with direction prefix (e.g., '-level')")
+    },
+    async ({ level, group, limit, offset, sort }) => {
+      try {
+        const params = { limit, offset };
+        if (level !== void 0) params.level = level;
+        if (group) params.group = group;
+        if (sort) params.sort = sort;
+        const response = await client.getRules(params);
+        const data = response.data;
+        const result = {
+          rules: data.affected_items.map((rule) => ({
+            id: rule.id,
+            description: rule.description,
+            level: rule.level,
+            groups: rule.groups,
+            pci_dss: rule.pci_dss,
+            gdpr: rule.gdpr,
+            gpg13: rule.gpg13,
+            hipaa: rule.hipaa,
+            nist_800_53: rule.nist_800_53,
+            tsc: rule.tsc,
+            mitre: rule.mitre,
+            details: rule.details
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_rule",
+    "Get detailed information about a specific Wazuh rule by ID",
+    {
+      rule_id: z3.number().int().describe("Rule identifier (e.g., 5710)")
+    },
+    async ({ rule_id }) => {
+      try {
+        const response = await client.getRule(rule_id);
+        const rules = response.data.affected_items;
+        if (rules.length === 0) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({ error: `Rule '${rule_id}' not found` })
+              }
+            ],
+            isError: true
+          };
+        }
+        const rule = rules[0];
+        const result = {
+          id: rule.id,
+          description: rule.description,
+          level: rule.level,
+          groups: rule.groups,
+          filename: rule.filename,
+          relative_dirname: rule.relative_dirname,
+          status: rule.status,
+          pci_dss: rule.pci_dss,
+          gdpr: rule.gdpr,
+          gpg13: rule.gpg13,
+          hipaa: rule.hipaa,
+          nist_800_53: rule.nist_800_53,
+          tsc: rule.tsc,
+          mitre: rule.mitre,
+          details: rule.details
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "search_rules",
+    "Search Wazuh rules by description text",
+    {
+      description: z3.string().describe("Search term to match against rule descriptions"),
+      limit: z3.number().int().min(1).max(100).default(10).describe("Maximum number of rules to return (1-100)"),
+      offset: z3.number().int().min(0).default(0).describe("Pagination offset"),
+      level: z3.number().int().min(0).optional().describe("Minimum severity level filter")
+    },
+    async ({ description, limit, offset, level }) => {
+      try {
+        const params = {
+          search: description,
+          limit,
+          offset
+        };
+        if (level !== void 0) params.level = level;
+        const response = await client.getRules(params);
+        const data = response.data;
+        const result = {
+          rules: data.affected_items.map((rule) => ({
+            id: rule.id,
+            description: rule.description,
+            level: rule.level,
+            groups: rule.groups,
+            pci_dss: rule.pci_dss,
+            gdpr: rule.gdpr,
+            gpg13: rule.gpg13,
+            hipaa: rule.hipaa,
+            nist_800_53: rule.nist_800_53,
+            tsc: rule.tsc,
+            mitre: rule.mitre,
+            details: rule.details
+          })),
+          total: data.total_affected_items,
+          description,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/decoders.ts
+import { z as z4 } from "zod";
+function registerDecoderTools(server, client) {
+  server.tool(
+    "list_decoders",
+    "List all available Wazuh decoders with optional name filtering",
+    {
+      name: z4.string().optional().describe("Filter by decoder name"),
+      limit: z4.number().int().min(1).max(100).default(10).describe("Maximum number of decoders to return (1-100)"),
+      offset: z4.number().int().min(0).default(0).describe("Pagination offset"),
+      sort: z4.string().optional().describe("Sort field with direction prefix (e.g., '-name')")
+    },
+    async ({ name, limit, offset, sort }) => {
+      try {
+        const params = { limit, offset };
+        if (name) params.name = name;
+        if (sort) params.sort = sort;
+        const response = await client.getDecoders(params);
+        const data = response.data;
+        const result = {
+          decoders: data.affected_items.map((decoder) => ({
+            name: decoder.name,
+            filename: decoder.filename,
+            relative_dirname: decoder.relative_dirname,
+            status: decoder.status,
+            position: decoder.position,
+            details: decoder.details
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/version.ts
+function registerVersionTools(server, client) {
+  server.tool(
+    "get_wazuh_version",
+    "Get the Wazuh manager version and API information",
+    {},
+    async () => {
+      try {
+        const response = await client.getVersion();
+        const info = response.data;
+        const result = {
+          title: info.title,
+          api_version: info.api_version,
+          revision: info.revision,
+          license: info.license_name,
+          hostname: info.hostname,
+          timestamp: info.timestamp
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/sca.ts
+import { z as z5 } from "zod";
+function registerScaTools(server, client) {
+  server.tool(
+    "get_sca_policies",
+    "List Security Configuration Assessment (SCA) policies evaluated on a Wazuh agent",
+    {
+      agent_id: z5.string().describe("Agent identifier (e.g., '001')")
+    },
+    async ({ agent_id }) => {
+      try {
+        const response = await client.getScaPolicies(agent_id);
+        const data = response.data;
+        const result = {
+          agent_id,
+          policies: data.affected_items.map((policy) => ({
+            policy_id: policy.policy_id,
+            name: policy.name,
+            description: policy.description,
+            score: policy.score,
+            pass: policy.pass,
+            fail: policy.fail,
+            invalid: policy.invalid,
+            total_checks: policy.total_checks,
+            hash_file: policy.hash_file,
+            end_scan: policy.end_scan
+          })),
+          total: data.total_affected_items
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_sca_checks",
+    "Get individual check results for a specific SCA policy on a Wazuh agent",
+    {
+      agent_id: z5.string().describe("Agent identifier (e.g., '001')"),
+      policy_id: z5.string().describe("SCA policy identifier (e.g., 'cis_debian10')"),
+      result: z5.enum(["passed", "failed", "not applicable"]).optional().describe("Filter by check result: passed, failed, or not applicable"),
+      limit: z5.number().int().min(1).max(500).default(25).describe("Maximum number of checks to return (1-500)"),
+      offset: z5.number().int().min(0).default(0).describe("Pagination offset")
+    },
+    async ({ agent_id, policy_id, result, limit, offset }) => {
+      try {
+        const params = { limit, offset };
+        if (result) params.result = result;
+        const response = await client.getScaChecks(agent_id, policy_id, params);
+        const data = response.data;
+        const mapped = {
+          agent_id,
+          policy_id,
+          checks: data.affected_items.map((check) => ({
+            id: check.id,
+            title: check.title,
+            description: check.description,
+            rationale: check.rationale,
+            remediation: check.remediation,
+            result: check.result,
+            condition: check.condition,
+            command: check.command,
+            references: check.references,
+            compliance: check.compliance,
+            reason: check.reason
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(mapped, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/syscollector.ts
+import { z as z6 } from "zod";
+function registerSyscollectorTools(server, client) {
+  server.tool(
+    "get_agent_os",
+    "Get operating system information collected from a Wazuh agent",
+    {
+      agent_id: z6.string().describe("Agent identifier (e.g., '001')")
+    },
+    async ({ agent_id }) => {
+      try {
+        const response = await client.getAgentOs(agent_id);
+        const items = response.data.affected_items;
+        const result = {
+          agent_id,
+          os: items[0] ?? null
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent_packages",
+    "List software packages installed on a Wazuh agent",
+    {
+      agent_id: z6.string().describe("Agent identifier (e.g., '001')"),
+      limit: z6.number().int().min(1).max(500).default(25).describe("Maximum number of packages to return (1-500)"),
+      offset: z6.number().int().min(0).default(0).describe("Pagination offset"),
+      search: z6.string().optional().describe("Filter packages by name")
+    },
+    async ({ agent_id, limit, offset, search }) => {
+      try {
+        const params = { limit, offset };
+        if (search) params.search = search;
+        const response = await client.getAgentPackages(agent_id, params);
+        const data = response.data;
+        const result = {
+          agent_id,
+          packages: data.affected_items.map((pkg) => ({
+            name: pkg.name,
+            version: pkg.version,
+            architecture: pkg.architecture,
+            description: pkg.description,
+            format: pkg.format,
+            vendor: pkg.vendor,
+            install_time: pkg.install_time,
+            size: pkg.size
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent_processes",
+    "List running processes on a Wazuh agent",
+    {
+      agent_id: z6.string().describe("Agent identifier (e.g., '001')"),
+      limit: z6.number().int().min(1).max(500).default(25).describe("Maximum number of processes to return (1-500)"),
+      offset: z6.number().int().min(0).default(0).describe("Pagination offset"),
+      search: z6.string().optional().describe("Filter processes by name or command")
+    },
+    async ({ agent_id, limit, offset, search }) => {
+      try {
+        const params = { limit, offset };
+        if (search) params.search = search;
+        const response = await client.getAgentProcesses(agent_id, params);
+        const data = response.data;
+        const result = {
+          agent_id,
+          processes: data.affected_items.map((proc) => ({
+            pid: proc.pid,
+            name: proc.name,
+            state: proc.state,
+            ppid: proc.ppid,
+            cmd: proc.cmd,
+            argvs: proc.argvs,
+            euser: proc.euser,
+            vm_size: proc.vm_size
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent_ports",
+    "List open network ports on a Wazuh agent",
+    {
+      agent_id: z6.string().describe("Agent identifier (e.g., '001')"),
+      limit: z6.number().int().min(1).max(500).default(25).describe("Maximum number of ports to return (1-500)"),
+      offset: z6.number().int().min(0).default(0).describe("Pagination offset")
+    },
+    async ({ agent_id, limit, offset }) => {
+      try {
+        const response = await client.getAgentPorts(agent_id, { limit, offset });
+        const data = response.data;
+        const result = {
+          agent_id,
+          ports: data.affected_items.map((port) => ({
+            protocol: port.protocol,
+            local_ip: port.local_ip,
+            local_port: port.local_port,
+            remote_ip: port.remote_ip,
+            remote_port: port.remote_port,
+            state: port.state,
+            pid: port.pid,
+            process: port.process
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent_network",
+    "List network interfaces and their IP addresses on a Wazuh agent",
+    {
+      agent_id: z6.string().describe("Agent identifier (e.g., '001')")
+    },
+    async ({ agent_id }) => {
+      try {
+        const response = await client.getAgentNetwork(agent_id);
+        const data = response.data;
+        const result = {
+          agent_id,
+          interfaces: data.affected_items.map((iface) => ({
+            name: iface.name,
+            type: iface.type,
+            state: iface.state,
+            mac: iface.mac,
+            mtu: iface.mtu,
+            ipv4: iface.ipv4,
+            ipv6: iface.ipv6,
+            tx_packets: iface.tx_packets,
+            rx_packets: iface.rx_packets
+          })),
+          total: data.total_affected_items
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_agent_hotfixes",
+    "List Windows hotfixes/patches installed on a Wazuh agent",
+    {
+      agent_id: z6.string().describe("Agent identifier (e.g., '001')"),
+      limit: z6.number().int().min(1).max(500).default(25).describe("Maximum number of hotfixes to return (1-500)"),
+      offset: z6.number().int().min(0).default(0).describe("Pagination offset")
+    },
+    async ({ agent_id, limit, offset }) => {
+      try {
+        const response = await client.getAgentHotfixes(agent_id, { limit, offset });
+        const data = response.data;
+        const result = {
+          agent_id,
+          hotfixes: data.affected_items.map((h) => h.hotfix),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/rootcheck.ts
+import { z as z7 } from "zod";
+function registerRootcheckTools(server, client) {
+  server.tool(
+    "get_rootcheck",
+    "Get rootkit detection scan results for a Wazuh agent",
+    {
+      agent_id: z7.string().describe("Agent identifier (e.g., '001')"),
+      limit: z7.number().int().min(1).max(100).default(25).describe("Maximum number of results to return (1-100)"),
+      offset: z7.number().int().min(0).default(0).describe("Pagination offset"),
+      status: z7.enum(["outstanding", "solved"]).optional().describe("Filter by status: outstanding (active findings) or solved")
+    },
+    async ({ agent_id, limit, offset, status }) => {
+      try {
+        const params = { limit, offset };
+        if (status) params.status = status;
+        const response = await client.getRootcheck(agent_id, params);
+        const data = response.data;
+        const result = {
+          agent_id,
+          findings: data.affected_items.map((item) => ({
+            status: item.status,
+            event: item.event,
+            day: item.day,
+            old_day: item.old_day,
+            cis: item.cis,
+            pci_dss: item.pci_dss
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/syscheck.ts
+import { z as z8 } from "zod";
+function registerSyscheckTools(server, client) {
+  server.tool(
+    "get_fim_files",
+    "Get File Integrity Monitoring (FIM) results for a Wazuh agent \u2014 shows monitored files, registry keys, and detected changes",
+    {
+      agent_id: z8.string().describe("Agent identifier (e.g., '001')"),
+      limit: z8.number().int().min(1).max(500).default(25).describe("Maximum number of results to return (1-500)"),
+      offset: z8.number().int().min(0).default(0).describe("Pagination offset"),
+      search: z8.string().optional().describe("Filter by file path or name"),
+      type: z8.enum(["file", "registry_key", "registry_value"]).optional().describe("Filter by entry type: file, registry_key, or registry_value")
+    },
+    async ({ agent_id, limit, offset, search, type }) => {
+      try {
+        const params = { limit, offset };
+        if (search) params.search = search;
+        if (type) params.type = type;
+        const response = await client.getFimFiles(agent_id, params);
+        const data = response.data;
+        const result = {
+          agent_id,
+          files: data.affected_items.map((entry) => ({
+            file: entry.file,
+            type: entry.type,
+            date: entry.date,
+            mtime: entry.mtime,
+            size: entry.size,
+            perm: entry.perm,
+            uname: entry.uname,
+            gname: entry.gname,
+            md5: entry.md5,
+            sha256: entry.sha256,
+            changed_attributes: entry.changed_attributes
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/manager.ts
+import { z as z9 } from "zod";
+function registerManagerTools(server, client) {
+  server.tool(
+    "get_manager_logs",
+    "Retrieve Wazuh manager logs with optional filtering by severity level or module tag",
+    {
+      limit: z9.number().int().min(1).max(100).default(25).describe("Maximum number of log entries to return (1-100)"),
+      offset: z9.number().int().min(0).default(0).describe("Pagination offset"),
+      level: z9.enum(["info", "warning", "error", "critical", "debug"]).optional().describe("Filter by log severity level"),
+      tag: z9.string().optional().describe("Filter by module/tag name (e.g., 'wazuh-modulesd', 'ossec-analysisd')")
+    },
+    async ({ limit, offset, level, tag }) => {
+      try {
+        const params = { limit, offset };
+        if (level) params.level = level;
+        if (tag) params.tag = tag;
+        const response = await client.getManagerLogs(params);
+        const data = response.data;
+        const result = {
+          logs: data.affected_items.map((entry) => ({
+            timestamp: entry.timestamp,
+            tag: entry.tag,
+            level: entry.level,
+            description: entry.description
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_manager_config",
+    "Get the active Wazuh manager configuration for a specific section",
+    {
+      section: z9.string().optional().describe(
+        "Configuration section to retrieve (e.g., 'vulnerability-detection', 'syscheck', 'rootcheck', 'alerts'). Omit to get the full configuration."
+      )
+    },
+    async ({ section }) => {
+      try {
+        const params = {};
+        if (section) params.section = section;
+        const response = await client.getManagerConfig(params);
+        return {
+          content: [{ type: "text", text: JSON.stringify(response.data, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/tools/groups.ts
+import { z as z10 } from "zod";
+function registerGroupTools(server, client) {
+  server.tool(
+    "list_groups",
+    "List all Wazuh agent groups",
+    {
+      limit: z10.number().int().min(1).max(100).default(25).describe("Maximum number of groups to return (1-100)"),
+      offset: z10.number().int().min(0).default(0).describe("Pagination offset")
+    },
+    async ({ limit, offset }) => {
+      try {
+        const response = await client.getGroups({ limit, offset });
+        const data = response.data;
+        const result = {
+          groups: data.affected_items.map((group) => ({
+            name: group.name,
+            count: group.count,
+            config_sum: group.configSum,
+            merged_sum: group.mergedSum
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "get_group_agents",
+    "List agents belonging to a specific Wazuh group",
+    {
+      group_id: z10.string().describe("Group name/identifier (e.g., 'default', 'linux-servers')"),
+      limit: z10.number().int().min(1).max(100).default(25).describe("Maximum number of agents to return (1-100)"),
+      offset: z10.number().int().min(0).default(0).describe("Pagination offset")
+    },
+    async ({ group_id, limit, offset }) => {
+      try {
+        const response = await client.getGroupAgents(group_id, { limit, offset });
+        const data = response.data;
+        const result = {
+          group_id,
+          agents: data.affected_items.map((agent) => ({
+            id: agent.id,
+            name: agent.name,
+            ip: agent.ip,
+            status: agent.status,
+            os_name: agent.os?.name,
+            os_platform: agent.os?.platform,
+            version: agent.version,
+            last_keepalive: agent.lastKeepAlive
+          })),
+          total: data.total_affected_items,
+          limit,
+          offset
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: error instanceof Error ? error.message : String(error)
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// src/resources.ts
+function registerResources(server, client, indexerClient) {
+  server.resource(
+    "wazuh-agents",
+    "wazuh://agents",
+    {
+      description: "List of all registered Wazuh agents and their current status",
+      mimeType: "application/json"
+    },
+    async () => {
+      const response = await client.getAgents({ limit: 100 });
+      const agents = response.data.affected_items.map((agent) => ({
+        id: agent.id,
+        name: agent.name,
+        ip: agent.ip,
+        status: agent.status,
+        group: agent.group,
+        os: agent.os?.name,
+        version: agent.version,
+        last_keepalive: agent.lastKeepAlive
+      }));
+      return {
+        contents: [
+          {
+            uri: "wazuh://agents",
+            mimeType: "application/json",
+            text: JSON.stringify(
+              { agents, total: response.data.total_affected_items },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+  server.resource(
+    "wazuh-alerts-recent",
+    "wazuh://alerts/recent",
+    {
+      description: "Recent security alerts from Wazuh (last 25)",
+      mimeType: "application/json"
+    },
+    async () => {
+      if (!indexerClient) {
+        return {
+          contents: [
+            {
+              uri: "wazuh://alerts/recent",
+              mimeType: "application/json",
+              text: JSON.stringify({
+                error: "Alerts require WAZUH_INDEXER_URL configuration. Wazuh 4.x stores alerts in the Wazuh Indexer (OpenSearch), not the REST API."
+              })
+            }
+          ]
+        };
+      }
+      const { alerts: rawAlerts, total } = await indexerClient.getRecentAlerts(25, 0);
+      const alerts = rawAlerts.map((alert) => ({
+        id: alert.id,
+        timestamp: alert.timestamp,
+        rule_id: alert.rule?.id,
+        rule_level: alert.rule?.level,
+        rule_description: alert.rule?.description,
+        agent_id: alert.agent?.id,
+        agent_name: alert.agent?.name
+      }));
+      return {
+        contents: [
+          {
+            uri: "wazuh://alerts/recent",
+            mimeType: "application/json",
+            text: JSON.stringify({ alerts, total }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+  server.resource(
+    "wazuh-rules-summary",
+    "wazuh://rules/summary",
+    {
+      description: "Summary of Wazuh detection rules by severity level",
+      mimeType: "application/json"
+    },
+    async () => {
+      const response = await client.getRules({ limit: 100, sort: "-level" });
+      const rules = response.data.affected_items.map((rule) => ({
+        id: rule.id,
+        description: rule.description,
+        level: rule.level,
+        groups: rule.groups
+      }));
+      return {
+        contents: [
+          {
+            uri: "wazuh://rules/summary",
+            mimeType: "application/json",
+            text: JSON.stringify(
+              { rules, total: response.data.total_affected_items },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/prompts.ts
+import { z as z11 } from "zod";
+function registerPrompts(server) {
+  server.prompt(
+    "investigate-alert",
+    "Investigate a Wazuh security alert and provide analysis with remediation steps",
+    { alert_id: z11.string().describe("The alert ID to investigate") },
+    ({ alert_id }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: [
+              `Investigate Wazuh alert ${alert_id}. Please:`,
+              "",
+              "1. Use get_alert to retrieve the full alert details",
+              "2. Use get_rule to look up the triggered rule",
+              "3. Use get_agent to check the affected agent's status",
+              "4. Analyze the alert context (MITRE ATT&CK mapping, compliance frameworks)",
+              "5. Determine severity and potential impact",
+              "6. Suggest specific remediation steps",
+              "7. Recommend additional monitoring or detection rules if needed"
+            ].join("\n")
+          }
+        }
+      ]
+    })
+  );
+  server.prompt(
+    "agent-health-check",
+    "Perform a comprehensive health check on a Wazuh agent",
+    { agent_id: z11.string().describe("The agent ID to check") },
+    ({ agent_id }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: [
+              `Perform a health check on Wazuh agent ${agent_id}. Please:`,
+              "",
+              "1. Use get_agent to retrieve agent details and connection status",
+              "2. Use get_agent_stats to check CPU, memory, and disk usage",
+              "3. Use get_alerts with agent_id filter to find recent alerts for this agent",
+              "4. Identify any resource concerns (high CPU, low disk, memory pressure)",
+              "5. Flag any critical or high-severity alerts",
+              "6. Provide an overall health assessment and recommendations"
+            ].join("\n")
+          }
+        }
+      ]
+    })
+  );
+  server.prompt(
+    "security-overview",
+    "Generate a security overview of the Wazuh environment",
+    {},
+    () => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: [
+              "Generate a security overview of the Wazuh environment. Please:",
+              "",
+              "1. Use get_wazuh_version to confirm the Wazuh version",
+              "2. Use list_agents to see all agents and their status",
+              "3. Use get_alerts with sort=-timestamp to find the most recent alerts",
+              "4. Use get_alerts with level >= 12 to find critical alerts",
+              "5. Summarize:",
+              "   - Total agents (active vs disconnected)",
+              "   - Alert volume and severity distribution",
+              "   - Top triggered rules",
+              "   - Any MITRE ATT&CK techniques detected",
+              "   - Compliance coverage (PCI-DSS, HIPAA, GDPR)",
+              "6. Highlight any immediate concerns requiring attention"
+            ].join("\n")
+          }
+        }
+      ]
+    })
+  );
+}
+
+// src/index.ts
+async function main() {
+  const config = getConfig();
+  if (!config.verifySsl) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  }
+  const client = new WazuhClient(config);
+  const indexerClient = config.indexer ? new WazuhIndexerClient(config.indexer) : void 0;
+  const server = new McpServer({
+    name: "wazuh-mcp",
+    version: "1.0.0",
+    description: "MCP server for the Wazuh SIEM/XDR platform - query agents, alerts, rules, and decoders"
+  });
+  registerAgentTools(server, client);
+  registerAlertTools(server, client, indexerClient);
+  registerRuleTools(server, client);
+  registerDecoderTools(server, client);
+  registerVersionTools(server, client);
+  registerScaTools(server, client);
+  registerSyscollectorTools(server, client);
+  registerRootcheckTools(server, client);
+  registerSyscheckTools(server, client);
+  registerManagerTools(server, client);
+  registerGroupTools(server, client);
+  registerResources(server, client, indexerClient);
+  registerPrompts(server);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+main().catch((error) => {
+  console.error("Fatal error:", error);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map