Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
65e2c55
Update README.md
gbrigandi May 7, 2025
13494cf
Wazuh MCP server successfully tested with Claude
gbrigandi May 13, 2025
cd8e1e1
Added support for handling initialized and exit notifications
gbrigandi May 13, 2025
d18c088
Improved documentation
gbrigandi May 15, 2025
6f65c7e
added screenshot
gbrigandi May 15, 2025
66410e8
automated builds
gbrigandi May 16, 2025
2e40125
added permission
gbrigandi May 16, 2025
ccb3fce
Enhanced documentation and pointing to releases page for installation
gbrigandi May 16, 2025
53c5f74
minor README.md changes
gbrigandi May 16, 2025
8b491fe
removed somehow redundant features section
gbrigandi May 16, 2025
5574dcc
remove redundant Claude configuration
gbrigandi May 16, 2025
87ac8a6
Port mcp-server-wazuh to rmcp framework
gbrigandi May 22, 2025
13f93cc
Update README with correct MCP flow for rmcp implementation
gbrigandi May 22, 2025
f9efb70
* Ported code to RMCP
gbrigandi May 23, 2025
bfffdbf
Replaced bespoke indexer client with full fledges indexer and manager…
gbrigandi Jun 18, 2025
d86a4e1
feat: migrate to wazuh-client crate and add rules tool
gbrigandi Jun 18, 2025
2fd14a0
fixed minor issues with passing configuration as environment variables.
gbrigandi Jun 18, 2025
47b3341
feat: comprehensive Wazuh integration with Docker CI/CD and expanded …
gbrigandi Jun 18, 2025
d23eef6
Bumped to new 0.2.0 version
gbrigandi Jun 19, 2025
168bb7b
Using used wazuh-client-rs with rusttls support
gbrigandi Jun 19, 2025
e95b3fb
addressing opessl issue
gbrigandi Jun 19, 2025
cc6f087
fix
gbrigandi Jun 19, 2025
5254df7
Bumped Wazuh API version which fixes vulnerability fetching
gbrigandi Jun 23, 2025
943fabd
release bump
gbrigandi Jun 23, 2025
77914b5
Upgraded to latest wazuh client that fixes fetching critical vulnerab…
gbrigandi Jun 24, 2025
2df4408
version bump to 0.2.3
gbrigandi Jun 24, 2025
b9327e0
Added glama.json file
gbrigandi Jun 24, 2025
e160888
several fixes and improvements around playing nice with MCP tool sele…
gbrigandi Jun 25, 2025
6e74633
Fixed get_wazuh_log_collector_stats mcp tool
gbrigandi Jun 26, 2025
4e39ca6
Improved design by factoring out tool-speciic logic into their own
gbrigandi Jun 27, 2025
5f452ba
feat: Refactor tools and upgrade wazuh-client
gbrigandi Jul 10, 2025
68ba87b
Create prp-prd
starterclic Nov 16, 2025
0f440df
feat: Créer application complète Sentinelle-MCP selon PRP-PRD
claude Nov 16, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Backend
backend/node_modules
backend/dist
backend/logs
backend/.env

# Frontend
frontend/node_modules
frontend/.next
frontend/out
frontend/.env

# Rust
target/debug
target/doc

# Git
.git
.gitignore

# Documentation
*.md
!README.md

# IDE
.vscode
.idea

# OS
.DS_Store
Thumbs.db

# Logs
*.log
48 changes: 39 additions & 9 deletions .env.example
Original file line number Diff line number Diff line change
@@ -1,9 +1,39 @@
# Wazuh API Configuration
WAZUH_HOST=localhost
WAZUH_PORT=55000
WAZUH_USER=admin
WAZUH_PASS=admin
VERIFY_SSL=false

# MCP Server Configuration
MCP_SERVER_PORT=8000
# Wazuh MCP Server Environment Configuration Example
#
# Copy this file to .env and fill in your specific values.
# Lines starting with # are comments.

# Wazuh Manager API Configuration
# Hostname or IP address of the Wazuh Manager API server.
WAZUH_API_HOST=localhost
# Port number for the Wazuh Manager API.
WAZUH_API_PORT=55000
# Username for Wazuh Manager API authentication.
WAZUH_API_USERNAME=wazuh
# Password for Wazuh Manager API authentication.
WAZUH_API_PASSWORD=wazuh

# Wazuh Indexer API Configuration
# Hostname or IP address of the Wazuh Indexer API server.
WAZUH_INDEXER_HOST=localhost
# Port number for the Wazuh Indexer API.
WAZUH_INDEXER_PORT=9200
# Username for Wazuh Indexer API authentication.
WAZUH_INDEXER_USERNAME=admin
# Password for Wazuh Indexer API authentication.
WAZUH_INDEXER_PASSWORD=admin

# SSL Configuration for Wazuh Connections
# Set to "true" to verify SSL certificates for Wazuh API and Indexer connections.
# Set to "false" to disable SSL verification (not recommended for production).
WAZUH_VERIFY_SSL=false

# Protocol for Wazuh Connections (Optional)
# Overrides the default protocol used by the wazuh-client.
# Typically "http" or "https". If not set, the client's default (usually https) will be used.
# WAZUH_TEST_PROTOCOL=https

# Logging Configuration
# Controls the log level for the application and its dependencies.
# Examples: "info", "debug", "trace", "mcp_server_wazuh=debug,wazuh_client=info"
RUST_LOG=info
117 changes: 117 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
name: Release Build

on:
push:
tags:
- 'v*' # Trigger on version tags like v0.1.0

permissions:
contents: write # Needed to create releases
packages: write # Needed to push to GitHub Container Registry

jobs:
create_release:
name: Create Release
runs-on: ubuntu-latest
outputs:
upload_url: ${{ steps.create_release.outputs.upload_url }}
steps:
- name: Create Release
id: create_release
uses: actions/create-release@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
tag_name: ${{ github.ref_name }}
release_name: Release ${{ github.ref_name }}
draft: false
prerelease: false

build_binaries:
name: Build Binaries for ${{ matrix.target }}
needs: create_release
runs-on: ${{ matrix.os }}
strategy:
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-musl
asset_name_suffix: linux-amd64
output_name: mcp-server-wazuh
- os: windows-latest
target: x86_64-pc-windows-msvc
asset_name_suffix: windows-amd64.exe
output_name: mcp-server-wazuh.exe
- os: macos-latest # Intel runner
target: x86_64-apple-darwin
asset_name_suffix: macos-amd64
output_name: mcp-server-wazuh
- os: macos-14 # ARM64/M1 runner
target: aarch64-apple-darwin
asset_name_suffix: macos-arm64
output_name: mcp-server-wazuh
steps:
- uses: actions/checkout@v4

- name: Set up Rust for target ${{ matrix.target }}
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}

- name: Install musl-tools (Linux MUSL target only)
if: matrix.os == 'ubuntu-latest' && contains(matrix.target, 'musl')
run: |
sudo apt-get update -y
sudo apt-get install -y musl-tools

- name: Build binary
run: cargo build --verbose --release --target ${{ matrix.target }}

- name: Upload Release Asset
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ needs.create_release.outputs.upload_url }}
asset_path: ./target/${{ matrix.target }}/release/${{ matrix.output_name }}
asset_name: mcp-server-wazuh-${{ matrix.asset_name_suffix }}
asset_content_type: application/octet-stream

build_docker:
name: Build and Push Docker Image
needs: create_release
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ghcr.io/gbrigandi/mcp-server-wazuh
tags: |
type=ref,event=tag
type=raw,value=latest

- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max

29 changes: 16 additions & 13 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,25 +1,29 @@
[package]
name = "mcp-server-wazuh"
version = "0.1.0"
version = "0.2.4"
edition = "2021"
description = "Wazuh SIEM MCP Server"
authors = ["Gianluca Brigandi <[email protected]>"]
license = "MIT"
repository = "https://github.com/gbrigandi/mcp-server-wazuh"
readme = "README.md"

[dependencies]
tokio = { version = "1.45", features = ["full"] }
axum = "0.8"
wazuh-client = "0.1.7"
rmcp = { version = "0.1.5", features = ["server", "transport-io"] }
tokio = { version = "1", features = ["full"] }
reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
chrono = { version = "0.4", features = ["serde"] }
anyhow = "1.0"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
schemars = "0.8"
clap = { version = "4.5", features = ["derive"] }
dotenv = "0.15"
thiserror = "2.0"
jsonwebtoken = "9.3"
tower-http = { version = "0.6", features = ["trace"] }
async-trait = "0.1"
anyhow = "1.0"
chrono = "0.4.41"
openssl-sys = { version = "0.9", features = ["vendored"] }

[dev-dependencies]
mockito = "1.7"
Expand All @@ -29,8 +33,7 @@ uuid = { version = "1.16", features = ["v4"] }
once_cell = "1.21"
async-trait = "0.1"
regex = "1.11"

[[bin]]
name = "mcp_client_cli"
path = "tests/mcp_client_cli.rs"
tokio-test = "0.4"
serde_json = "1.0"
tempfile = "3.0"

Loading