How to Use the Cortex XSIAM MCP in OpenAI Agents SDK

Q: Can my OpenAI Agents SDK system run custom XQL queries in Cortex XSIAM?

Yes. Your agent uses the runxqlquery tool to execute any valid XQL query. The raw log results return directly to your agent for immediate parsing.

Run automated playbooks and isolate compromised hosts directly from your OpenAI Agents SDK production deployment using this MCP Server.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cortex XSIAM MCP to OpenAI Agents SDK

Create your Vinkius account to connect Cortex XSIAM to OpenAI Agents SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cortex XSIAM with OpenAI Agents SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Isolate threats instantly through OpenAI Agents SDK

The `isolate_endpoint` tool lets your agent quarantine infected machines the second a high-severity alert triggers. Instead of waiting for a human analyst to log into the console, your deployment handles the network isolation instantly. You can pair this with `scan_endpoint` to run a deep malware scan right after isolation. This gives your security team clean forensics without letting the threat spread across your subnet.

Run complex threat hunts using raw XQL

The `run_xql_query` tool lets your agent execute raw Cortex Query Language searches across your entire data lake. This means your agent can dig through millions of firewall, endpoint, and cloud logs to find hidden threat patterns. You get the raw query results back directly in your Python code. This lets you chain investigations by passing the output to other tools like `get_indicators` to check for known malicious IPs or file hashes.

Automate incident triage and playbook execution

The `execute_playbook` tool triggers automated response workflows inside your XSIAM console. This lets your agent kick off pre-configured security playbooks to reset compromised user credentials or block malicious traffic. Before running a playbook, your agent can pull full context using `get_incident_details` and `get_alerts`. This ensures the agent only executes remediations when the incident data matches your exact criteria.

Setup guide

Set up Cortex XSIAM MCP in OpenAI Agents SDK

Prerequisites

Python 3.10+ installed
openai-agents package (pip install openai-agents)
Active Vinkius subscription with a valid endpoint token

1

Install the SDK

Run pip install openai-agents to install the OpenAI Agents SDK. The MCP integration is built-in — no extra dependencies needed.
2

Connect via SSE transport

Use MCPServerSse with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. The SDK auto-discovers all Cortex XSIAM tools at runtime.
3

Create your Agent

Pass the MCP to Agent(mcp_servers=[server]). The agent receives Cortex XSIAM tools as native definitions — JSON schemas resolve automatically.
4

Run the agent

Call Runner.run(agent, prompt) to execute. The agent invokes the appropriate Cortex XSIAM tools and returns structured results. Copy the full example on the right to get started.

agent.py

import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerSse

async def main():
    async with MCPServerSse(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ) as server:
        agent = Agent(
            name="Cortex XSIAM Agent",
            instructions="You have access to Cortex XSIAM tools.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List recent transactions")
        print(result.final_output)

asyncio.run(main())

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cortex XSIAM. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cortex XSIAM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cortex XSIAM MCP in OpenAI Agents SDK

Install the SDK first. Then initialize the connection using `MCPServerStreamableHttp` with your Vinkius endpoint URL. Pass this server instance in the `mcp_servers` list when creating your Agent.

Yes. Your agent uses the `run_xql_query` tool to execute any valid XQL query. The raw log results return directly to your agent for immediate parsing.

The SDK automatically discovers all nine security tools when you boot the agent. Set `cacheToolsList=True` in your configuration to speed up initialization times.

You can restrict actions by configuring guardrails in your Python code. This prevents the agent from calling tools like `isolate_endpoint` or `execute_playbook` without manual approval.

Vinkius runs the server in an isolated V8 sandbox that never stores your query logs or incident details. All API calls pass through ephemeral connections, meaning your security telemetry is processed in-memory and immediately discarded.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript