How to Use the Cortex XSIAM MCP in CrewAI

Q: Can I restrict which Cortex XSIAM tools my CrewAI agents use?

Yes. Use the toolfilter in your server configuration to limit which tools are exposed to specific agents in your crew.

Deploy a specialized crew of autonomous agents to manage your Cortex XSIAM security operations.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cortex XSIAM MCP to CrewAI

Create your Vinkius account to connect Cortex XSIAM to CrewAI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cortex XSIAM with CrewAI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Coordinated threat hunting with CrewAI

Create a team where one agent runs `get_indicators` and another performs `run_xql_query`. They share information to build a complete picture of an attack. This collaboration happens in real-time. Your agents communicate their findings and refine their search queries based on the data they get back.

Automated SOC escalation in CrewAI

Assign agents to monitor the incident queue. When `get_incidents` returns a high-severity alert, the moderator agent triggers `execute_playbook` immediately. It mimics a human SOC team. One agent watches, one agent investigates, and one agent takes action to resolve the issue.

Endpoint auditing for CrewAI

Use a specialized agent to maintain your fleet. It cycles through `get_endpoints` to spot unauthorized devices or missing agents. If it finds a risk, the agent flags it for review. You maintain a clean environment without manually checking every host.

Setup guide

Set up Cortex XSIAM MCP in CrewAI

Prerequisites

Python 3.10+ installed
crewai package (pip install crewai)
Active Vinkius subscription with a valid endpoint token

1

Install CrewAI
Run pip install crewai to install the framework. MCP support is built-in via the mcps parameter.
2

Add the MCP URL to your agent
Pass your Vinkius endpoint directly to the mcps list. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. CrewAI handles tool discovery and caching automatically.
3

Kick off your crew
Create a Crew with your agent and tasks. Call crew.kickoff() — the agent will automatically invoke Cortex XSIAM tools as needed.

crew.py

from crewai import Agent, Task, Crew

agent = Agent(
    role="Cortex XSIAM Analyst",
    goal="Access and analyze Cortex XSIAM data via MCP.",
    backstory="Expert analyst with direct Cortex XSIAM access.",
    mcps=[
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ],
)

task = Task(
    description="List recent Cortex XSIAM transactions",
    agent=agent,
    expected_output="A summary of recent activity",
)

crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff()
print(result)

Get your connection token →

Prerequisites

Python 3.10+ installed
crewai + crewai-tools packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install crewai crewai-tools. The MCPServerAdapter handles lifecycle management and tool conversion.
2

Connect with MCPServerAdapter
Use MCPServerAdapter as a context manager with SseServerParameters pointing to your Vinkius endpoint. The adapter automatically manages connection lifecycle.
3

Assign tools and run
Pass the returned mcp_tools to your agent's tools parameter. The adapter converts MCP tools to native BaseTool objects compatible with all CrewAI agents.

crew.py

from crewai import Agent, Task, Crew
from crewai_tools import MCPServerAdapter
from mcp import SseServerParameters

server_params = SseServerParameters(
    url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)

with MCPServerAdapter(server_params) as mcp_tools:
    agent = Agent(
        role="Cortex XSIAM Analyst",
        goal="Access and analyze Cortex XSIAM data via MCP.",
        backstory="Expert analyst with direct Cortex XSIAM access.",
        tools=mcp_tools,
    )

    task = Task(
        description="List recent Cortex XSIAM transactions",
        agent=agent,
        expected_output="A summary of recent activity",
    )

    crew = Crew(agents=[agent], tasks=[task])
    result = crew.kickoff()
    print(result)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cortex XSIAM. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cortex XSIAM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cortex XSIAM MCP in CrewAI

They use shared memory. When one agent fetches data from Cortex XSIAM, the other agents in the crew can access that context to make decisions.

Yes. Use the tool_filter in your server configuration to limit which tools are exposed to specific agents in your crew.

It does. Each agent in the crew acts independently, allowing for parallel investigations and faster response times across your environment.

All communication occurs within a zero-trust sandbox. Your security logs and incident artifacts are never exposed outside the managed environment.

The server only reads incident logs, indicator lists, and endpoint statuses. It does not store these details; it simply passes them to your agents for processing.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript