// SCAN REPORT

Wazuh MCP Server

145 tools. 1 can modify or destroy data without limits.

1 write tool that can modify data. Rate limits recommended.

Last updated: 29 Jun 2026

1 can modify or destroy data

144 read-only

145 tools total

Community server · catalogue entry verified 29/06/2026

How to control Wazuh MCP Server ↓

TOOL MAP

What Wazuh MCP Server exposes to your agents

Read (144) Write / Execute (1) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Wazuh MCP Server tools

Execute · High build_dsql_query The 'build_dsql_query' function constructs dynamic SQL queries, which is an Execute-category capability.

1 of Wazuh MCP Server's 145 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Wazuh MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Wazuh MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "count_documents": {
    "limits": [
      {
        "counter": "count_documents_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Wazuh MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON WAZUH →

Instant setup, no code required.

FULL CATALOGUE

All 145 Wazuh MCP Server tools

EXECUTE 1 tools

Execute build_dsql_query build_dsql_query

READ 144 tools

Read count_documents count_documents Read error_info Error information - tools not available Read get_active_configuration get_active_configuration Read get_agent_component_stats get_agent_component_stats Read get_agent_daemon_stats get_agent_daemon_stats Read get_agent_hardware Return the agent's hardware info. Read get_agent_hotfixes get_agent_hotfixes Read get_agent_key Get the key of an agent. Read get_agent_netaddr get_agent_netaddr Read get_agent_netiface get_agent_netiface Read get_agent_netproto get_agent_netproto Read get_agent_os Return the agent's OS info. Read get_agent_packages get_agent_packages Read get_agent_ports get_agent_ports Read get_agent_processes get_agent_processes Read get_agent_sca_checks get_agent_sca_checks Read get_agent_sca_policy_checks get_agent_sca_policy_checks Read get_agents_ciscat get_agents_ciscat Read get_agents_hardware Return hardware info for all agents or a list of them. Read get_agents_hotfixes get_agents_hotfixes Read get_agents_in_group get_agents_in_group Read get_agents_info get_agents_info Read get_agents_netaddr get_agents_netaddr Read get_agents_netiface get_agents_netiface Read get_agents_netproto get_agents_netproto Read get_agents_os get_agents_os Read get_agents_overview Return agent summary information. Read get_agents_packages get_agents_packages Read get_agents_ports get_agents_ports Read get_agents_processes get_agents_processes Read get_api_config Shows the API configuration. Read get_api_info Return basic information about the API, as per Wazuh documentation. Read get_auth_context Get authentication context information for the current session. Read get_authentication_info get_authentication_info Read get_cat_allocation get_cat_allocation Read get_cat_health get_cat_health Read get_cat_indices get_cat_indices Read get_cat_nodes get_cat_nodes Read get_cat_pending_tasks get_cat_pending_tasks Read get_cat_plugins get_cat_plugins Read get_cat_shards get_cat_shards Read get_cat_thread_pool get_cat_thread_pool Read get_cdb_list_file_content Return the content of a specific CDB list file. Read get_cdb_lists_files Return the path and metadata of all CDB list files. Read get_cdb_lists_info Return the content of all CDB lists (key-value pairs). Read get_check_nodes_config get_check_nodes_config Read get_check_user_uninstall_permission Check if the user has permission to uninstall agents. Read get_ciscat_results get_ciscat_results Read get_cluster_allocation_explain get_cluster_allocation_explain Read get_cluster_health get_cluster_health Read get_cluster_healthcheck get_cluster_healthcheck Read get_cluster_nodes get_cluster_nodes Read get_cluster_pending_tasks get_cluster_pending_tasks Read get_cluster_settings get_cluster_settings Read get_cluster_stats get_cluster_stats Read get_cluster_status Return information about the cluster status. Read get_current_user_info Get the information of the current user. Read get_current_user_processed_policies Get the processed policies information for the current user. Read get_decoder_file_content get_decoder_file_content Read get_decoder_files get_decoder_files Read get_document_by_id get_document_by_id Read get_group_configuration Return the group configuration (agent.conf). Read get_group_file_content get_group_file_content Read get_group_files get_group_files Read get_groups get_groups Read get_index_aliases get_index_aliases Read get_index_info get_index_info Read get_index_mapping get_index_mapping Read get_index_settings get_index_settings Read get_index_stats get_index_stats Read get_index_templates get_index_templates Read get_list_agents get_list_agents Read get_list_agents_distinct get_list_agents_distinct Read get_list_agents_without_group get_list_agents_without_group Read get_list_decoders get_list_decoders Read get_list_outdated_agents get_list_outdated_agents Read get_list_rbac_actions get_list_rbac_actions Read get_local_node_config_cluster Return the current node cluster configuration. Read get_local_node_info_cluster Return basic information about the cluster node receiving the request. Read get_manager_active_config Return the active configuration for a specific component and configuration. Read get_manager_configuration Return Wazuh configuration (ossec.conf) in JSON or raw XML format. Read get_manager_daemon_stats Return Wazuh statistical information from specified daemons. Read get_manager_info Return basic information about the Wazuh manager. Read get_manager_logs Return the last 13000 entries of wazuh log file (ossec.log). Read get_manager_logs_summary Return a summary of the wazuh log file. Read get_manager_stats Return Wazuh statistical information for the current or specified date. Read get_manager_stats_hourly Return Wazuh statistical information per hour. Read get_manager_stats_weekly Return Wazuh statistical information per week. Read get_manager_status Return the status of all Wazuh daemons. Read get_mitre_groups get_mitre_groups Read get_mitre_metadata Return the metadata from MITRE database. Read get_mitre_mitigations get_mitre_mitigations Read get_mitre_references get_mitre_references Read get_mitre_software get_mitre_software Read get_mitre_tactics get_mitre_tactics Read get_mitre_techniques get_mitre_techniques Read get_node_active_config get_node_active_config Read get_node_config get_node_config Read get_node_daemon_stats get_node_daemon_stats Read get_node_info get_node_info Read get_node_logs get_node_logs Read get_node_logs_summary Return a summary of the last 2000 Wazuh log entries in the specified node. Read get_node_stats get_node_stats Read get_node_stats_hourly Return Wazuh statistical information per hour for the specified node. Read get_node_stats_weekly Return Wazuh statistical information per week for the specified node. Read get_node_status Return the status of all Wazuh daemons in the specified node. Read get_nodes_api_config get_nodes_api_config Read get_nodes_info get_nodes_info Read get_nodes_ruleset_sync_status get_nodes_ruleset_sync_status Read get_nodes_stats get_nodes_stats Read get_parent_decoders get_parent_decoders Read get_permissions_info get_permissions_info Read get_rbac_resources get_rbac_resources Read get_roles_info get_roles_info Read get_rootcheck_last_scan Return the timestamp of the last rootcheck scan of an agent. Read get_rootcheck_results get_rootcheck_results Read get_rule_files get_rule_files Read get_rule_groups get_rule_groups Read get_rules get_rules Read get_security_audit_log get_security_audit_log Read get_security_config get_security_config Read get_summarize_agents_os Get summary of agents by OS. Read get_summarize_agents_status Get summary of agents by status. Read get_syscheck_last_scan Return when the last syscheck scan started and ended. Read get_syscheck_results get_syscheck_results Read get_tasks_status get_tasks_status Read get_upgrade_results get_upgrade_results Read get_users_info get_users_info Read get_wazuh_version_info Return available updates for Wazuh, framework and ruleset. Read health_check Perform health check for the MCP server Read list_indices list_indices Read list_policies list_policies Read list_rbac_resources list_rbac_resources Read list_roles list_roles Read list_security_rules list_security_rules Read list_users list_users Read multi_search_simple multi_search_simple Read scroll_search scroll_search Read search_alerts search_alerts Read search_events search_events Read search_vulnerabilities search_vulnerabilities Read search_with_aggregations search_with_aggregations Read server_info Get Wazuh Indexer MCP server information Read validate_manager_configuration Check if Wazuh configuration is correct.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Wazuh MCP Server

Is the Wazuh MCP Server MCP server safe to use without restrictions? +

The Wazuh MCP Server server is primarily read-only with 144 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the Wazuh MCP Server MCP server expose? +

145 tools across 3 categories: Execute, Read, Write. 144 are read-only. 1 can modify, create, or delete data.

How do I enforce a policy on Wazuh MCP Server? +

Register the Wazuh MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Wazuh MCP Server tool call.

Deterministic rules across all 145 Wazuh MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON WAZUH →

Instant setup, no code required.

145 Wazuh MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.