x=hub

your toolset

    build deployment
    sign in

    wazuh-mcp-server

    projectother scanned
    io.github.gensecaihq/wazuh-mcp-server · v
    deploy just this

    Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # once, as root:
docker build -t mcp-local/wazuh:main 'https://github.com/gensecaihq/wazuh-mcp-server.git#main'

#!/usr/bin/env bash
# wazuh (io.github.gensecaihq/wazuh-mcp-server), recipe docker (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-wazuh.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec docker run --rm --name mcp-my-agent-wazuh -p 127.0.0.1:${PORT}:8000 mcp-local/wazuh:main

[Unit]
Description=MCP server wazuh (toolset my-agent), generated by Hub
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
SupplementaryGroups=docker
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/wazuh
WorkingDirectory=/var/lib/mcp/wazuh
ExecStart=/opt/mcp/my-agent/bin/wazuh.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/wazuh

[Install]
WantedBy=multi-user.target
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    docker build -t wazuh 'https://github.com/gensecaihq/wazuh-mcp-server.git#main'
docker run --rm -p 127.0.0.1:8101:8000 wazuh
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T20:26:30+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
#   cp .env.example .env    # fill the ${VAR}s
#   docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
  wazuh:
    build:
      context: https://github.com/gensecaihq/wazuh-mcp-server.git#main
    ports:
    - 127.0.0.1:8101:8000
    restart: unless-stopped
    x-note: 'CHANGE_ME: built from the repository''s Dockerfile, assuming it serves streamable HTTP at
      :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.'
volumes:
  npm-cache: {}
  uv-cache: {}
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T20:26:30+00:00).
#   kubectl create namespace mcp
#   kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
#   kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
  name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wazuh
  namespace: mcp
  labels: &id001
    app: wazuh
spec:
  replicas: 1
  selector:
    matchLabels: *id001
  template:
    metadata:
      labels: *id001
    spec:
      containers:
      - name: wazuh
        image: CHANGE_ME
        ports:
        - containerPort: 8000
          name: http
        env: []
---
apiVersion: v1
kind: Service
metadata:
  name: wazuh
  namespace: mcp
spec:
  selector:
    app: wazuh
  ports:
  - port: 8000
    targetPort: http
    name: http
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T20:26:30+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
  wazuh:
    enabled: true
    replicas: 1
    port: 8000
    path: /mcp
    container:
      name: wazuh
      image: CHANGE_ME
      ports:
      - containerPort: 8000
        name: http
      env: []

# helm install my-agent helm/my-agent -n mcp

    Scanned github.com/gensecaihq/wazuh-mcp-server at e751871c850d with [email protected][email protected] on 2026-10-17 before the build: 0 dependencies, no known vulnerabilities, nothing in the code that looks malicious.

    in the cloud

    one click: the provider's deploy form opens filled in, in your own account
    koyeb
    deploy to koyeb

    Clients connect to the service's https://…koyeb.app address plus /mcp.

    cloud run
    run on google cloud

    Cloud Shell clones the repository, builds its Dockerfile and deploys it to Cloud Run.

    Cloud Run sends requests to $PORT (8080); the recipe expects :8000, so the server has to read PORT, or set the container port on the service afterwards.

    connect to it

    copy what your client needs
    {
  "mcpServers": {
    "wazuh": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add wazuh -- CHANGE_ME

    {
  "mcpServers": {
    "wazuh": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    {
  "servers": {
    "wazuh": {
      "type": "stdio",
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.gensecaihq/wazuh-mcp-server
    • not probed yet: tools unpinned, ingest lists them
    • no tested recipe for target 'local' yet: build it from https://github.com/gensecaihq/Wazuh-MCP-Server by hand, or wait for the worker

    tools

    Probe result: faileddocker: the container exited: 2026-10-17 12:40:37,100 - wazuh_mcp_server.main - ERROR - [33baaf7a] Server error: AUTH_SECRET_KEY is required when ENVIRONMENT=production and AUTH_MODE is not 'none'. Generate one with: openssl rand -hex 32 Set it identically across all instances so tokens survive restarts and load balancing.

    runs · 1

    the latest tests of this entry by the hub and its workers, newest first
    dateworkermethodstatussandboxreason
    2026-10-17 12:40 local-mac-vm docker failed gvisor docker: the container exited: 2026-10-17 12:40:37,100 - wazuh_mcp_server.main - ERROR - [33baaf7a] Server error: AUTH_SECRET_KEY is required when ENVIRONMENT=pr…