Connectors · MSP & PSA
Wazuh MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Wazuh and the rest of your systems. It gives your agent 178 Wazuh actions (115 reads, 38 writes and 25 that wait for a confirmation) and holds the Wazuh credential itself, so the agent never does. It paces Wazuh's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "wazuh.security.users_list", intent: "check which Wazuh account is connected"}# List users · read · 1 upstream call- 178actionsin one signed file
- 115readlook, never change
- 38writecreate and update
- 25wait for a yesdestructive, confirmed first
Set up
Connect Wazuh in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Wazuh.
Session login. actionlake opens the session and renews it when it expires. actionlake stores what you paste write-only, sealed under your tenant's key.
usernameWazuh API user (a user from Server management > Security, e.g. `wazuh-wui`, or a dedicated user with the RBAC roles…passwordPassword of that Wazuh API userhostWhere your Wazuh lives: your host
account { op: "connections.requirements", service: "wazuh" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "wazuh.security.users_list" }# list users · read · 1 upstream callcheck { action: "wazuh.security.users_create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Wazuh at a glance
- Sign-in
- Session login. actionlake opens the session and renews it when it expires.
- You provide
usernamepassword- Setup fields
host- Limits we pace to
- 300 calls a minute, per connection
- API covered
- Wazuh server API 4.14 (OpenAPI 3.0.0, spec v4.14.9), at your Wazuh instance's API base URL, which you enter when connecting
- Built from
- Wazuh's documentation, read 23 October 2026OpenAPI spec (GitHub)documentation.wazuh.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 115 of 115 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 4, so ask can line Wazuh up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Wazuh.
178 actions in 21 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 115readlook, never change
- 38writecreate and update
- 25destructivewait for a confirmation
Security
319 read · 10 write · 12 destructive
List users · List roles · Add user · Update users
Agents
3014 read · 12 write · 4 destructive
List agents · Add agent · Delete agents · Restart agent
Cluster
2320 read · 3 write · 0 destructive
Get node logs · Get nodes info · Reloads the analysisd process for the nodes · Get nodes API config
Manager
1815 read · 3 write · 0 destructive
Get logs · Reloads the analysisd process for the master or local node · Get API config · Get active configuration
Syscollector
1313 read · 0 write · 0 destructive
Get agent browser extensions · Get agent groups · Get agent hotfixes · Get agent netaddr
Experimental
1210 read · 0 write · 2 destructive
Get agents CIS-CAT results · Get agents hardware · Get agents hotfixes · Get agents netaddr
Groups
85 read · 2 write · 1 destructive
Get agents in a group · Get group configuration · Create a group · Get group files
Mitre
77 read · 0 write · 0 destructive
Get MITRE groups · Get MITRE mitigations · Get MITRE references · Get MITRE software
13 more areas · 36 actions
- Rules 7
- Decoders 6
- Lists 5
- Rootcheck 4
- Syscheck 4
- Logtest 2
- Sca 2
- Active response 1
- API 1
- Ciscat 1
- Events 1
- Overview 1
- Tasks 1
Top actions
The Wazuh API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 17 of Wazuh's 17 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
wazuh.security.users_listList users | List users. | read | identity.user.list474 connectors |
wazuh.security.roles_listList roles | List roles. | read | identity.role.list184 connectors |
wazuh.security.users_createAdd user | Add user. | write | identity.user.create262 connectors |
wazuh.security.roles_createAdd role | Add role. | write | identity.role.create105 connectors |
wazuh.agents.listList agents | List agents. | read | device.endpoint.list65 connectors |
wazuh.security.users_deleteDelete users | Delete users. | destructive | identity.user.delete253 connectors |
wazuh.security.policies_listList policies | List policies. | read | security.policy.list36 connectors |
wazuh.security.meGet current user info | Get current user info. | read | identity.current_user.get307 connectors |
wazuh.agents.createAdd agent | Add agent. | write | device.endpoint.create12 connectors |
wazuh.security.policies_createAdd policy | Add policy. | write | security.policy.create25 connectors |
wazuh.rules.listList rules | List rules. | read | this connector |
wazuh.agents.insertAdd agent full | Add agent full. | write | this connector |
Try it
Prompts to paste into Claude.
Each one names the Wazuh actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which Wazuh devices have not checked in for a week?
calls
wazuh.agents.list - Writewrite
Add user in Wazuh. Show me exactly what you will send before you save it.
calls
wazuh.security.users_create
Governance for Wazuh
Destructive actions wait for a yes.
25 Wazuh actions are destructive. These are all of them:
- Delete users
wazuh.security.users_delete - Delete roles
wazuh.security.roles_delete - Delete agents
wazuh.agents.delete - Delete policies
wazuh.security.policies_delete - Delete groups
wazuh.groups.delete - Delete rules file
wazuh.rules.file_delete - Remove agent from group
wazuh.agents.group_remove - Restore default security config
wazuh.security.config_reset - Delete security rules
wazuh.security.rules_delete - Add security rules to role
wazuh.security.role_rules_add - Add roles to user
wazuh.security.user_roles_add - Remove agents from group
wazuh.agents.bulk_group_remove - Remove agent from groups
wazuh.agents.groups_remove_all - Add policies to role
wazuh.security.role_policies_add - Remove security rules from role
wazuh.security.role_rules_remove - Revoke JWT tokens
wazuh.security.tokens_revoke_all - Remove roles from user
wazuh.security.user_roles_remove - Remove policies from role
wazuh.security.role_policies_remove - Delete CDB list file
wazuh.lists.file_delete - End session
wazuh.logtest.session_end - Delete decoders file
wazuh.decoders.file_delete - Clear results
wazuh.syscheck.results_clear - Clear results
wazuh.rootcheck.results_clear - Clear agents FIM results
wazuh.experimental.syscheck_clear - Clear rootcheck results
wazuh.experimental.rootcheck_clear
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete agents?
intent: the user asked me to delete agents
account { op: "keys.create", name: "wazuh-agent", allowed_actions: ["wazuh.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "wazuh.security.users_delete", approver: "[email protected]" }, { match: "wazuh.security.roles_delete", approver: "[email protected]" }, { match: "wazuh.agents.delete", approver: "[email protected]" } ]}Cost
What Wazuh costs on actionlake.
Every Wazuh action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Wazuh refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 178 Wazuh actions
- 178actions pageeach page of a long list is one call
- 115reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Wazuh action.
178 actions by area: the id your agent calls, what it does, and its effect.
Security31
wazuh.security.config_getGet security configreadwazuh.security.config_resetRestore default security configdestructivewazuh.security.config_updateUpdate security configwritewazuh.security.meGet current user inforeadwazuh.security.my_policiesGet current user processed policiesreadwazuh.security.policies_createAdd policywritewazuh.security.policies_deleteDelete policiesdestructivewazuh.security.policies_listList policiesreadwazuh.security.policies_updateUpdate policywritewazuh.security.rbac_actions_listList RBAC actionsreadwazuh.security.rbac_resources_listList RBAC resourcesreadwazuh.security.role_policies_addAdd policies to roledestructivewazuh.security.role_policies_removeRemove policies from roledestructivewazuh.security.role_rules_addAdd security rules to roledestructivewazuh.security.role_rules_removeRemove security rules from roledestructivewazuh.security.roles_createAdd rolewritewazuh.security.roles_deleteDelete rolesdestructivewazuh.security.roles_listList rolesreadwazuh.security.roles_updateUpdate rolewritewazuh.security.rules_createAdd security rulewritewazuh.security.rules_deleteDelete security rulesdestructivewazuh.security.rules_listList security rulesreadwazuh.security.rules_updateUpdate security rulewritewazuh.security.tokens_revoke_allRevoke JWT tokensdestructivewazuh.security.user_roles_addAdd roles to userdestructivewazuh.security.user_roles_removeRemove roles from userdestructivewazuh.security.users_createAdd userwritewazuh.security.users_deleteDelete usersdestructivewazuh.security.users_listList usersreadwazuh.security.users_run_as_setEnable/Disable run_aswritewazuh.security.users_updateUpdate userswrite
Agents30
wazuh.agents.bulk_group_assignAssign agents to groupwritewazuh.agents.bulk_group_removeRemove agents from groupdestructivewazuh.agents.bulk_restartRestart agentswritewazuh.agents.component_statsGet agent's component statsreadwazuh.agents.config_getGet active configurationreadwazuh.agents.createAdd agentwritewazuh.agents.daemon_statsGet Wazuh daemon stats from an agentreadwazuh.agents.deleteDelete agentsdestructivewazuh.agents.distinct_fieldsList agents distinctreadwazuh.agents.group_assignAssign agent to groupwritewazuh.agents.group_removeRemove agent from groupdestructivewazuh.agents.group_sync_statusGet configuration sync statusreadwazuh.agents.groups_remove_allRemove agent from groupsdestructivewazuh.agents.insertAdd agent fullwritewazuh.agents.key_getGet keyreadwazuh.agents.listList agentsreadwazuh.agents.list_outdatedList outdated agentsreadwazuh.agents.list_ungroupedList agents without groupreadwazuh.agents.quick_createAdd agent quickwritewazuh.agents.reconnectForce reconnect agentswritewazuh.agents.restartRestart agentwritewazuh.agents.restart_by_groupRestart agents in groupwritewazuh.agents.restart_by_nodeRestart agents in nodewritewazuh.agents.summarySummarize agents informationreadwazuh.agents.summary_osSummarize agents OSreadwazuh.agents.summary_statusSummarize agents statusreadwazuh.agents.uninstall_permissionCheck user's permission to uninstall agentsreadwazuh.agents.upgradeUpgrade agentswritewazuh.agents.upgrade_customUpgrade agents customwritewazuh.agents.upgrade_resultsGet upgrade resultsread
Cluster23
wazuh.cluster.analysisd_reloadReloads the analysisd process for the nodeswritewazuh.cluster.api_configGet nodes API configreadwazuh.cluster.configuration_validateCheck nodes configreadwazuh.cluster.healthcheckGet nodes healthcheckreadwazuh.cluster.local_configGet local node configreadwazuh.cluster.local_infoGet local node inforeadwazuh.cluster.node_component_config_getGet node active configurationreadwazuh.cluster.node_configuration_getGet node configreadwazuh.cluster.node_configuration_updateUpdate node configurationwritewazuh.cluster.node_daemon_statsGet Wazuh daemon stats from a cluster nodereadwazuh.cluster.node_infoGet node inforeadwazuh.cluster.node_logs_listGet node logsreadwazuh.cluster.node_logs_summaryGet node logs summaryreadwazuh.cluster.node_statsGet node statsreadwazuh.cluster.node_stats_analysisdGet node stats analysisdreadwazuh.cluster.node_stats_hourlyGet node stats hourreadwazuh.cluster.node_stats_remotedGet node stats remotedreadwazuh.cluster.node_stats_weeklyGet node stats weekreadwazuh.cluster.node_statusGet node statusreadwazuh.cluster.nodes_listGet nodes inforeadwazuh.cluster.restartRestart nodeswritewazuh.cluster.ruleset_sync_statusGet cluster nodes ruleset synchronization statusreadwazuh.cluster.statusGet cluster statusread
Manager18
wazuh.manager.analysisd_reloadReloads the analysisd process for the master or local nodewritewazuh.manager.api_configGet API configreadwazuh.manager.component_config_getGet active configurationreadwazuh.manager.configuration_getGet configurationreadwazuh.manager.configuration_updateUpdate Wazuh configurationwritewazuh.manager.configuration_validateCheck configreadwazuh.manager.daemon_statsGet Wazuh daemon statsreadwazuh.manager.infoGet informationreadwazuh.manager.logs_listGet logsreadwazuh.manager.logs_summaryGet logs summaryreadwazuh.manager.restartRestart managerwritewazuh.manager.statsGet statsreadwazuh.manager.stats_analysisdGet stats analysisdreadwazuh.manager.stats_hourlyGet stats hourreadwazuh.manager.stats_remotedGet stats remotedreadwazuh.manager.stats_weeklyGet stats weekreadwazuh.manager.statusGet statusreadwazuh.manager.version_checkCheck available updatesread
Syscollector13
wazuh.syscollector.browser_extensions_listGet agent browser extensionsreadwazuh.syscollector.groups_listGet agent groupsreadwazuh.syscollector.hardwareGet agent hardwarereadwazuh.syscollector.hotfixes_listGet agent hotfixesreadwazuh.syscollector.netaddr_listGet agent netaddrreadwazuh.syscollector.netiface_listGet agent netifacereadwazuh.syscollector.netproto_listGet agent netprotoreadwazuh.syscollector.osGet agent OSreadwazuh.syscollector.packages_listGet agent packagesreadwazuh.syscollector.ports_listGet agent portsreadwazuh.syscollector.processes_listGet agent processesreadwazuh.syscollector.services_listGet agent servicesreadwazuh.syscollector.users_listGet agent usersread
Experimental12
wazuh.experimental.ciscat_results_listGet agents CIS-CAT resultsreadwazuh.experimental.hardware_listGet agents hardwarereadwazuh.experimental.hotfixes_listGet agents hotfixesreadwazuh.experimental.netaddr_listGet agents netaddrreadwazuh.experimental.netiface_listGet agents netifacereadwazuh.experimental.netproto_listGet agents netprotoreadwazuh.experimental.os_listGet agents OSreadwazuh.experimental.packages_listGet agents packagesreadwazuh.experimental.ports_listGet agents portsreadwazuh.experimental.processes_listGet agents processesreadwazuh.experimental.rootcheck_clearClear rootcheck resultsdestructivewazuh.experimental.syscheck_clearClear agents FIM resultsdestructive
Groups8
wazuh.groups.agents_listGet agents in a groupreadwazuh.groups.configuration_getGet group configurationreadwazuh.groups.configuration_updateUpdate group configurationwritewazuh.groups.createCreate a groupwritewazuh.groups.deleteDelete groupsdestructivewazuh.groups.file_getGet a file in groupreadwazuh.groups.files_listGet group filesreadwazuh.groups.listGet groupsread
Mitre7
wazuh.mitre.groups_listGet MITRE groupsreadwazuh.mitre.metadataGet MITRE metadatareadwazuh.mitre.mitigations_listGet MITRE mitigationsreadwazuh.mitre.references_listGet MITRE referencesreadwazuh.mitre.software_listGet MITRE softwarereadwazuh.mitre.tactics_listGet MITRE tacticsreadwazuh.mitre.techniques_listGet MITRE techniquesread
Rules7
wazuh.rules.file_deleteDelete rules filedestructivewazuh.rules.file_getGet rules file contentreadwazuh.rules.file_putUpdate rules filewritewazuh.rules.files_listGet filesreadwazuh.rules.groups_listGet groupsreadwazuh.rules.listList rulesreadwazuh.rules.requirement_values_listGet requirementsread
Decoders6
wazuh.decoders.file_deleteDelete decoders filedestructivewazuh.decoders.file_getGet decoders file contentreadwazuh.decoders.file_putUpdate decoders filewritewazuh.decoders.files_listGet filesreadwazuh.decoders.listList decodersreadwazuh.decoders.parents_listGet parent decodersread
Lists5
wazuh.lists.file_deleteDelete CDB list filedestructivewazuh.lists.file_getGet CDB list file contentreadwazuh.lists.file_putUpdate CDB list filewritewazuh.lists.files_listGet CDB lists filesreadwazuh.lists.listGet CDB lists inforead
Rootcheck4
wazuh.rootcheck.last_scanGet last scan datetimereadwazuh.rootcheck.results_clearClear resultsdestructivewazuh.rootcheck.results_listGet resultsreadwazuh.rootcheck.runRun scanwrite
Syscheck4
wazuh.syscheck.files_listGet resultsreadwazuh.syscheck.last_scanGet last scan datetimereadwazuh.syscheck.results_clearClear resultsdestructivewazuh.syscheck.runRun scanwrite
Logtest2
wazuh.logtest.runRun logtestwritewazuh.logtest.session_endEnd sessiondestructive
Sca2
wazuh.sca.checks_listGet policy checksreadwazuh.sca.policies_listGet resultsread
Active response1
wazuh.active_response.runRun commandwrite
API1
wazuh.api.infoGet API inforead
Ciscat1
wazuh.ciscat.results_listGet resultsread
Events1
wazuh.events.ingestIngest eventswrite
Overview1
wazuh.overview.agentsGet agents overviewread
Tasks1
wazuh.tasks.status_listList tasksread
Questions
The Wazuh MCP server, answered.
Is there a Wazuh MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 178 Wazuh actions across security, agents, cluster and manager, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Wazuh.
What do I need to connect Wazuh?
Wazuh API user (a user from Server management > Security, e.g. `wazuh-wui`, or a dedicated user with the RBAC roles… and Password of that Wazuh API user. Plus your host. The free call account { op: "connections.requirements", service: "wazuh" } lists exactly what to paste.
Can an AI agent delete or change things in Wazuh?
Only if its key allows it, and only with an explicit confirmation. 25 Wazuh actions are destructive, including delete users, delete roles and delete agents. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Wazuh API limit?
actionlake paces every call to the limits in the Wazuh service file: 300 calls a minute per connection. Repeated reads are answered from cache (115 Wazuh actions can be), which never reaches Wazuh.
What does a Wazuh action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (178 Wazuh actions page). Cache hits, searches, dry runs and calls Wazuh refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Wazuh API does it cover?
The Wazuh server API 4.14 (OpenAPI 3.0.0, spec v4.14.9) at your Wazuh instance's API base URL, which you enter when connecting. It is built from Wazuh's documentation as read on 23 October 2026. 178 actions in 21 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Wazuh data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Wazuh credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Wazuh today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
