Wiz MCP Server – Cloud Security Context
The Wiz MCP Server gives AI agents access to Wiz security context so they can translate natural-language security questions into Wiz-specific operations. Use it for cloud inventory review, configuration investigation, security issue analysis, threat triage, and remediation planning across authorized Wiz data.
Overview
The Wiz MCP Server is Wiz's Model Context Protocol implementation for bringing
Wiz cloud-security context into MCP-compatible AI tools. Wiz describes it as an
MCP-compatible service that translates plain-language prompts into Wiz-specific
operations, helping security teams investigate posture, risks, resources, and
threats without manually switching through multiple consoles and APIs.
What the MCP server enables
The server is designed to unify Wiz security data behind an AI agent workflow.
Based on Wiz's public documentation and marketplace listing, an authorized agent
can use it to:
- Query Wiz resources and cloud inventory from natural-language requests.
- Assess security risks, configurations, and active security issues.
- Investigate critical Wiz Code findings and support remediation workflows.
- Explore Wiz Defend threat context, affected resources, exposure, and blast radius.
- Enrich investigations with contextual intelligence from Wiz security data.
- Support remediation planning, impact assessment, and follow-up verification.
When to use it
Use Wiz MCP when an AI workflow needs live cloud-security context from Wiz.
Practical examples include asking which production resources have critical
findings, investigating exposed databases, reviewing toxic risk combinations,
identifying resources impacted by active threats, summarizing issue details for
developers, and preparing remediation steps for human review. It is especially
useful for security teams that want AI assistance across cloud posture,
application security, and threat response workflows.
Connection and authentication
Wiz's public AWS Marketplace listing provides a container-image deployment for
Amazon Bedrock AgentCore. It identifies the product as an MCP server and lists a
container delivery option. To allow the server to access a Wiz tenant, users
create a Wiz MCP integration from the Wiz console, keep the recommended API
scopes, and copy the generated client ID and client secret.
The marketplace deployment passes these credentials through environment
variables named WIZ_CLIENT_ID and WIZ_CLIENT_SECRET. Its example runtime
configuration also includes Wiz_MCP_TRANSPORT, Wiz_MCP_PORT, and
Wiz_MCP_HOST for the hosted container process. Store all values in a secrets
manager or protected deployment environment rather than in this YAML.
Key considerations
Wiz states that the MCP Server is available for Wiz customers and that detailed
setup instructions may be available through customer-access documentation. Access
is governed by the Wiz integration credentials and configured scopes. Treat Wiz
findings, cloud inventory, threat data, and business context as sensitive.
Review the MCP host's data-handling and training settings before connecting Wiz
because prompts and retrieved context can be processed by the selected host.
Require human approval for remediation, infrastructure changes, exposure fixes,
pull requests, and other high-impact actions.
Supported Transports
streamable_http
URL: http://${WIZ_MCP_HOST}:${WIZ_MCP_PORT}/mcp
stdio
Command: docker
Args:
run-i--rm-eWIZ_CLIENT_ID-eWIZ_CLIENT_SECRET-eWiz_MCP_TRANSPORT-eWiz_MCP_PORT-eWiz_MCP_HOST${WIZ_MCP_CONTAINER_IMAGE}
Frequently Asked Questions
- When should an AI agent use the Wiz MCP Server?
- Use it when a security workflow needs live Wiz context, such as reviewing cloud inventory, investigating critical security issues, assessing exposed resources, triaging active threats, or preparing remediation plans for human approval.
- What does the Wiz MCP Server add to an AI agent's capabilities?
- It gives the agent access to Wiz security context and Wiz-specific operations, allowing it to translate plain-language prompts into cloud security investigations instead of relying only on static model knowledge or manually pasted findings.
- What can an AI agent access or manage through Wiz MCP?
- Depending on the configured Wiz integration and scopes, the agent can work with cloud inventory, configurations, security issues, threat context, affected resources, exposure information, and contextual risk intelligence surfaced by Wiz.
- How is authentication configured for the Wiz MCP Server?
- A Wiz MCP integration is created in the Wiz console. The generated client ID and client secret are supplied to the server as WIZ_CLIENT_ID and WIZ_CLIENT_SECRET environment variables. Store these values securely and use the minimum scopes appropriate for the workflow.
- Which transport should be used for the Wiz MCP Server?
- Use a hosted HTTP MCP endpoint when deploying the Wiz container through a managed runtime such as Amazon Bedrock AgentCore. Use the stdio container invocation only for MCP clients or gateways that launch the container as a local process. No universal public Wiz-hosted MCP endpoint is included here.