# INFOKOM-KI/Wazuh-MCP-Server

Source: https://glimind.com/server/github%2Finfokom-ki%2Fwazuh-mcp-server
Registry id: `github/infokom-ki/wazuh-mcp-server`
Status: unknown

## Tools (47)

- `argus_ip_lookup`: Aggregated threat intelligence lookup from multiple providers
- `blueteam_ai_bot_recon`: Surface AI/LLM-driven reconnaissance and scanning
- `blueteam_alert_cluster`: HDBSCAN clustering over source IP entities
- `blueteam_alert_cluster_assign`: Assign source IP to nearest cluster centroid
- `blueteam_asset_context`: CMDB asset criticality and owner lookup
- `blueteam_breach_check`: Check if an email appears in known breaches
- `blueteam_curated_threat_report`: Generate curated threat report with filters
- `blueteam_export_report`: Export report to DOCX/XLSX/PPTX
- `blueteam_false_positive_tracker`: Rule ID to false-positive summary cross-reference
- `blueteam_index_schema`: Discover index field mappings
- `blueteam_investigation_history`: Get investigation history
- `blueteam_investigation_summary`: Get investigation summary
- `blueteam_ioc_search`: Single-IP IOC search with detail levels
- `blueteam_ioc_search_bulk`: Bulk IOC search for 1-25 IPs, one request each
- `blueteam_ip_intel_bulk`: Bulk IP intelligence lookup for 1-50 IPs in one request
- `blueteam_memory_recall`: Recall prior decisions for a source IP
- `blueteam_metrics`: Prometheus metrics endpoint
- `blueteam_misp_ioc_lookup`: Look up an indicator in MISP instance
- `blueteam_mitre_lookup`: ATT&CK technique/group lookup
- `blueteam_playbook_run`: Run a named playbook workflow
- `blueteam_prompt_route`: Natural-language prompt to tool router
- `blueteam_rag_fp_validate`: Validate false positives against local corpus
- `blueteam_rag_ingest`: Rebuild a corpus label for RAG
- `blueteam_rag_query`: Vector recall query with optional cross-encoder
- `blueteam_semantic_search`: BM25 ranking over Wazuh rules/alerts with reranking
- `blueteam_sigma_rule_convert`: Convert Sigma rule to OpenSearch formats
- `blueteam_sigma_rule_generate`: Draft Sigma rule from alert or text
- `blueteam_sigma_rule_save`: Write Sigma rule YAML to staging directory
- `blueteam_sigma_rule_validate`: Validate Sigma rule with YAML and schema checks
- `blueteam_source_forecast`: Rank candidate next-observed source IPs from history
- `blueteam_stix_export`: Write STIX 2.1 bundle for peer CSIRT
- `blueteam_subnet_calc`: Offline CIDR arithmetic for split/merge operations
- `blueteam_tactic_forecast`: Fit or query tactic-transition model
- `blueteam_threat_card`: One-call full picture of a source IP threat
- `blueteam_threat_hunt`: Named DSL query templates per adversary technique
- `blueteam_unified_threat_score`: Combine multiple sources into single 0.0-1.0 threat score
- `blueteam_volume_forecast`: Fit or query PoissonHMM over alert counts
- `blueteam_wazuh_export`: Scroll-export alerts to JSONL
- `blueteam_yara_rule_generate`: Draft YARA rule from alert, file, or text
- `blueteam_yara_rule_save`: Write validated YARA rule to staging directory
- `blueteam_yara_rule_validate`: Compile and validate a YARA rule
- `jarm_fingerprint`: Active TLS server fingerprinting without API key
- `netra_ip_analysis`: Multi-source IP analysis with extended time budget
- `wazuh_alert_aggregate_analysis`: Zero-doc full-index statistical summary of alerts
- `wazuh_alert_dsl_query`: Raw OpenSearch DSL query with script-injection guard
- `wazuh_alert_focused_crawl`: Surgical alert deep-dive with filters
- `wazuh_attack_velocity`: Check if attacks from an IP are accelerating

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.