[GallaGit]

Read-only Wazuh adapter (#982), built on the loginBasicAuth flag from #1460 (merged).

Adapter: intl/wazuh.json, 15 read-only GET tools on the Wazuh 4.x server API (manager info/status, agents and summaries, outdated agents, rules, rule groups, decoders, SCA policies/checks, syscheck files and last scan). Alerts and vulnerabilities live in the indexer and are out of scope, as agreed.

Auth: LOGIN_TOKEN with loginBasicAuth: true on POST /security/user/authenticate, tokenJsonPath data.token, Bearer ${token}, refreshOn401. Error 1701 inside data.failed_items is mapped to 404. Instructions cover SSRF_ALLOWED_HOSTS and the self-signed TLS default (NODE_EXTRA_CA_CERTS).

Tested against Wazuh v4.14.9 (wazuh/wazuh-manager:4.14.9 in Docker):

• wazuh.live.spec.ts with RUN_WAZUH_LIVE=1: 31/31, all 15 tools through the real RestEngine and LoginTokenService, plus a wrong-password case returning 401 without echoing credentials.
• validate-adapters --warn: no warnings for Wazuh; adapter-count --check and generate-llms-txt --check: OK.

[GallaGit]

Sorry for the slow reply, @helpcodeai, and thanks for fixing the generated docs on #1460. I've rebased this onto main, so it now contains only the Wazuh adapter (695 adapters). Live spec against Wazuh v4.14.9: 31/31, and adapter-count, generate-llms-txt and validate-adapters pass. Marking it ready for review.

[helpcodeai]

Thanks for the rebase, @GallaGit. The PR is clean now: only the Wazuh adapter, the generated counts and the spec. I read the whole adapter. It is careful work: read-only GETs, a dedicated readonly API user, the password marked secret, and good hints for 401, 403 and 404.

Two things before we can merge:

1. Encode the path parameters. Four tools put a model-supplied value into the path: wazuh_list_sca_policies, wazuh_list_sca_checks, wazuh_list_syscheck_files and wazuh_get_syscheck_last_scan. The engine does not enforce the pattern on string parameters, so ^\d{3,}$ on agent_id is only a hint, and policy_id has no pattern at all. A value like ../../security/users would then reach another endpoint of the API. Please add "encodePathParams": true to the endpointMapping of these four tools (see intl/podio.json for an example), and a short assertion in the spec that every tool with a {param} in its path sets it.

2. Add the logo. icon is wazuh, but packages/frontend/public/logos/connectors/wazuh.svg is missing (step 6 in AGENTS.md). Without it the catalog shows a broken image.

CI is running on the new commit. Once these two are in, I will do a last pass and merge.

[GallaGit]

Thanks for the review, @helpcodeai. Both points are in 4e348fc:

1. encodePathParams: true on the four tools with path params (SCA policies/checks, syscheck files/last scan), plus a static spec assertion that every tool with a {param} in its path sets it. Re-tested live against Wazuh v4.14.9: 32/32.
2. Added wazuh.svg, taken from Wazuh's official wazuh-dashboard-plugins repo (Simple Icons has no Wazuh). It's the horizontal wordmark; happy to swap it for a square mark if you prefer.

[helpcodeai]

Thanks, @GallaGit. I checked 4e348fc and both points are done:

1. encodePathParams: true is set on all four tools with a {param} in the path. Your spec assertion also lists exactly those four, so a new path tool without the flag will fail the test.
2. The logo is in. The wordmark works: our tiles have a white background and object-contain, and other connectors also use wide logos.

validate-adapters reports no warnings for wazuh.json, adapter-count --check matches 695, and CI is green on the head commit. Merging now. Thanks for the careful work and the live testing against v4.14.9.

[helpcodeai]

Thanks @GallaGit, merged. The Wazuh adapter will be on AnythingMCP Cloud with the next deploy, and in the next self-hosted release. Thanks also for the live test against v4.14.9 and the path parameter check.