mcp-server-wazuh (gbrigandi) — agentic threat model

Not certain from the listing — The tool itself does not include a foundation model, but as an MCP server for Claude Desktop, it is vulnerable to indirect prompt injection where malicious data inside Wazuh alerts could manipulate the host LLM's behavior.

Exposes highly sensitive live SIEM data (alerts, agents, rules). The primary threat is data exfiltration of network topology, active vulnerabilities, and security incidents to unauthorized parties via the LLM interface.

Integrates via the Model Context Protocol (MCP). Risks include insecure tool orchestration where the LLM may be tricked into executing overly broad queries or exposing raw SIEM payloads without sanitization.

Runs as a local or server-side process bridging Claude Desktop to Wazuh. Requires secure storage of Wazuh API credentials; compromise of the host environment exposes these high-privilege SIEM credentials.

Not certain from the listing — There is no mention of built-in guardrails, logging of LLM queries, or anomaly detection to identify when the LLM is being used to harvest SIEM data maliciously.

Inherits the compliance and data-egress considerations of SIEM integrations. Strict access controls and audit logging must be enforced to ensure LLM users do not bypass standard Wazuh RBAC policies.

Not certain from the listing — While designed for the MCP ecosystem, there is no explicit multi-agent coordination, though cascading risks exist if other connected MCP tools can read Claude's context containing Wazuh data.