Wazuh Agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Wazuh Agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude-powered MCP tool suite for interacting with a Wazuh SIEM manager. Exposes Wazuh REST API capabilities as MCP tools so Claude can triage alerts, monitor agent health, hunt threats, manage rules, and propose/execute active responses.
wazuh-agent/
├── mcp/
│ └── wazuh_mcp_server.py # MCP server — all tools registered here
├── agents/
│ ├── orchestrator.py # Routes queries to the right specialist agent
│ ├── triage.py # Alert severity analysis & MITRE mapping
│ ├── health.py # Fleet connectivity & health checks
│ ├── hunting.py # IOC search & behavioural pattern detection
│ ├── rules.py # Rule analysis & coverage gaps
│ └── response.py # Active response proposals & gated execution
├── config.py # Connection settings (credentials via env vars)
└── requirements.txtThe MCP server imports analysis functions from each agent module and exposes them as MCP tools. Claude (via Claude Code or another client) uses these tools to reason over real-time Wazuh data.
pip install -r requirements.txtCreate a .env file (never commit this):
WAZUH_USER=your_api_user
WAZUH_PASSWORD=your_api_passwordOr set environment variables directly in your shell.
Add to your Claude Code MCP settings (claude_desktop_config.json or .claude/settings.json):
{
"mcpServers": {
"wazuh": {
"command": "python",
"args": ["G:/claudeai/wazuh-agent/mcp/wazuh_mcp_server.py"],
"env": {
"WAZUH_USER": "${WAZUH_USER}",
"WAZUH_PASSWORD": "${WAZUH_PASSWORD}"
}
}
}
}| Tool | Description |
|---|---|
get_agents | List all agents by status |
get_agent_details | Details for a specific agent |
get_alerts | Recent alerts with optional level/agent filter |
get_manager_info | Manager version and status |
get_manager_stats | Events/alerts per hour |
get_agent_processes | Running processes (syscollector) |
get_agent_ports | Open ports (syscollector) |
get_agent_packages | Installed packages (syscollector) |
get_agent_vulnerabilities | CVEs by agent and severity |
get_rules | Search detection rules |
get_rule_by_id | Look up a specific rule |
| Tool | Description |
|---|---|
triage_alerts | Severity buckets, top rules, MITRE tactic counts |
check_health | Fleet health: disconnected/stale agents, unknowns |
hunt_ioc | Search all alerts for an IP, hash, domain, or username |
hunt_patterns | Detect brute-force, lateral movement, priv-esc patterns |
analyze_rules | Rule coverage summary and category breakdown |
propose_response | Ranked active-response options (no execution) |
execute_active_response | Execute a response — requires `confirmed=True` |
| ID | Name | Notes |
|---|---|---|
| 000 | wazuh | Manager |
| 001 | kali | |
| 002 | Area-51 | |
| 003 | Prism | |
| 004 | DESKTOP-GPLJ6GT | |
| 005 | vert-server | |
| 006 | pve610 | Disconnected |
| 007 | pve720XD | |
| 008 | pve720 |
Active response commands modify target systems immediately and some are irreversible.
The workflow is always:
propose_response(agent_id, threat_summary) → review optionsexecute_active_response(..., confirmed=True) only after approvalexecute_active_response called without confirmed=True returns a blocked status and never touches the Wazuh API.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.