Wiz MCP Server: Setup, Tools & Real Limits
Wiz MCP brings cloud-risk context into AI clients, but its gated documentation, dynamic toolsets, and sensitive data path demand a cautious rollout.
Wiz MCP is Wiz’s hosted bridge between an MCP-capable AI client and the Wiz Security Graph. Once authorized, an agent can investigate resources, vulnerabilities, exposure, identities, and attack paths across monitored cloud environments. It is useful for triage, not autonomous remediation.
Table of contents
Jump to the section that matches your task.
- What Wiz MCP actually is
- What exists today
- Setup
- Tools you get
- Permissions and blast radius
- Real limits
- When not to use it
What Wiz MCP actually is
Wiz MCP is a first-party remote MCP server that lets an external host ask Wiz for security context. An IDE, operations agent, or chat client can resolve a resource and inspect its vulnerabilities, misconfigurations, secrets, threats, data findings, exposure, and identities without navigating the Wiz console.
The important distinction is that MCP supplies structured tools and results; the model still decides when and how to call them. Wiz says the server can search cloud inventory, assess security issues, examine toxic combinations, and support workflows spanning Wiz Cloud, Wiz Defend, and Wiz Code. Wiz also warns that queries and returned Wiz data pass through the MCP host, so that host’s retention and training settings matter (Wiz launch announcement).
That makes Wiz MCP best at interactive investigation. I would use it to ask whether an EC2 instance is exposed and linked to an active threat. I would not let a model alter a security issue or production resource from an ambiguous prompt. Compare the best MCP servers and the MCP capabilities clients support.
What exists today
A real first-party Wiz MCP server exists at Wiz’s hosted endpoint; it is not the similarly named PyPI package for KubeSphere Wizard or a server for WiZ smart lights. Wiz introduced its server in April 2025 as a customer preview, and newer public integration material identifies the hosted service as the “Wiz Remote MCP Server.” Public setup detail remains thinner than the product claims, while tenant documentation sits behind Wiz access.
| Option | Ownership | Transport and auth | Production view |
|---|---|---|---|
| Wiz Remote MCP Server | Wiz | Hosted HTTPS with OAuth | Preferred: first-party data path and current server-side toolsets |
| Tracecat Wiz MCP integration | Tracecat | Hosted HTTP with Tracecat-managed OAuth flow | Useful inside Tracecat, but adds another processor and its own tool contract |
| Generic Wiz GraphQL wrapper | Your team or a community maintainer | Usually local/hosted, using Wiz API credentials | Only sensible when audited, pinned, and narrowly scoped |
Wiz’s endpoint is corroborated by an AWS sample that registers https://mcp.app.wiz.io/?toolset=devops and requires OAuth as a Wiz user (AWS DevOps Agent sample). That is stronger evidence than directory pages advertising an unverified mcp-server-wiz package. My view: start with the first-party remote service; use a wrapper only when its visible source and fixed contract solve a requirement Wiz does not. Browse other vendor-run options in the official server collection.
Setup
Setup means enabling the integration in Wiz, registering its remote URL in a client that supports remote MCP and OAuth, then approving access as a deliberately restricted Wiz identity. Do not install a package called wiz-mcp merely because the name matches the query.
- Confirm that your Wiz tenant includes the MCP integration and that your chosen host supports remote HTTP MCP plus browser-based OAuth. Wiz’s original announcement places access in the Wiz integration portal.
- Create or select a dedicated Wiz identity, restrict it to the required projects, and grant read permissions only for the data the workflow needs. For the documented DevOps toolset, the identity needs read access to resources, findings, issues, threats, and detections.
- Add the exact Wiz-issued endpoint to the client. For the AWS DevOps Agent workflow, the documented URL is
https://mcp.app.wiz.io/?toolset=devops; do not append that selector for another workflow unless Wiz’s tenant docs instruct you to. - Complete the OAuth browser flow and review the requested access. Remote MCP commonly uses an OAuth authorization flow rather than secrets embedded in local JSON (MCP authorization guide).
- Inspect and allowlist the required tools. Test read-only against a noncritical project, checking resources, timestamps, and project boundaries against Wiz.
There is no mcpServers block here because client keys differ and Wiz publishes no universal block. Use the client UI or adapt tenant instructions with the MCP config generator. If authentication never opens, confirm the client supports remote OAuth discovery.
Tools you get
The discovered list is authoritative. Only one first-party name is verifiable publicly; the other names below belong to Tracecat and must not be assumed on Wiz’s endpoint.
| Verified tool name | Where it exists | What it does |
|---|---|---|
devops_resource_auditing_skill | Wiz toolset=devops | Returns Wiz-maintained, read-only investigation guidance that directs the agent through the other DevOps tools |
list_issues | Tracecat Wiz integration | Lists issues using severity, status, project, and resource filters |
get_issue | Tracecat Wiz integration | Retrieves one issue with evidence and remediation detail |
update_issue | Tracecat Wiz integration | Changes issue fields such as status, assignee, severity, or notes |
list_vulnerabilities | Tracecat Wiz integration | Lists vulnerability findings across supported workloads |
list_cloud_resources | Tracecat Wiz integration | Lists cloud resources discovered by Wiz |
get_cloud_resource | Tracecat Wiz integration | Returns configuration and risk context for one resource |
list_configuration_findings | Tracecat Wiz integration | Lists CSPM findings against rules and frameworks |
graphql_query | Tracecat Wiz integration | Runs a Wiz GraphQL query for advanced investigations |
Tracecat documents those eight names and an OAuth-based connection flow (Tracecat Wiz MCP catalog). MCP itself allows a tool list to change and to vary with authorization, so hard-coded blog lists age badly; clients should call tool discovery and show users what the model can invoke (MCP tools specification).
Permissions and blast radius
Begin read-only, use a dedicated identity, and separate investigation from remediation. The main blast radius is not merely “the model sees Wiz”: it can expose sensitive cloud topology, secrets findings, vulnerable asset details, identity relationships, and attack paths to the MCP host and anyone who can access its transcripts.
Scope the Wiz identity to selected projects and the minimum read permissions. Keep tokens out of repositories and logs, rotate credentials, review Wiz audit records, and disable tools the workflow does not need. MCP’s security guidance recommends scope minimization, per-client consent, restricted privileges, and clear human confirmation for tool calls (MCP security best practices).
A write-capable connector raises a second risk. A careless update_issue call can reassign, downgrade, annotate, or close the record analysts depend on, even though it does not fix the underlying cloud configuration. A separate AWS CLI or GitHub tool can go further and change network rules or code. I would require approval at that boundary, retain the proposed command or diff, and never give the Wiz-facing identity cloud-provider administrator rights.
Real limits
Wiz MCP is constrained by Wiz coverage, scan freshness, server pagination and throttling, and the model’s context window. It cannot make an unmonitored resource visible, turn an old scan into live telemetry, or safely fit an enterprise-wide finding dump into one prompt.
The AWS sample states the practical boundaries plainly: only resources monitored by Wiz have context; findings reflect the most recent scan; an unavailable or non-allowlisted tool breaks the workflow; and its read-only DevOps integration does not remediate resources (AWS sample limitations). Treat “no finding” as either clean evidence or a coverage gap, never automatically as proof of safety.
Large inventories may be paginated, truncated, or summarized before every record reaches the model. Filter by project, resource type, severity, and time; paginate explicitly; aggregate outside chat when completeness matters. Compare counts with Wiz before an audit.
Wiz publishes no universal MCP rate-limit number, so precise requests-per-minute claims are suspect. Expect tenant- and query-dependent throttling. Use bounded backoff, cache stable lookups, and ask support for limits. The server cannot itself repair cloud resources or code; Wiz’s examples use separate AWS CLI or GitHub actions.
When not to use it
Do not use Wiz MCP for fixed, high-volume exports, deterministic compliance jobs, or situations where security data must stay inside Wiz. Choose Mika AI for in-product questions, and choose a plain Wiz API script for repeatable machine-to-machine processing.
Mika AI avoids sending the workflow through an external MCP host and is the cleaner choice when an analyst only needs conversational help inside Wiz. A GraphQL script is better when you need exact fields, explicit pagination, stable tests, scheduled execution, or a complete CSV with reproducible counts. Wiz describes its MCP server as complementary to Mika rather than a replacement (Wiz MCP announcement).
Avoid MCP during response if the client cannot show calls, preserve an audit trail, or confirm writes. Natural-language investigation is faster, but scripts and native UI give tighter control and repeatable evidence. Use Wiz MCP for bounded, human-reviewed exploration—not as an unattended control plane.