How to Use the Cortex XSIAM MCP in VS Code Copilot

Q: Can I execute security playbooks from VS Code Copilot?

Yes, the agent can call executeplaybook with specific parameters to trigger incident response plans. This allows you to run automated remediation steps directly from the chat interface.

Q: How do we query Cortex XSIAM logs inside VS Code Copilot?

You can use the runxqlquery tool to search your logs using Cortex Query Language. The agent executes the query and prints the raw data or formats it into a readable markdown table.

Q: Can I check endpoint coverage with this setup?

The agent uses the getendpoints tool to list all managed devices and audit coverage. This helps your team identify disconnected hosts or verify which systems need security updates.

Build and test security automations in VS Code Copilot with direct access to Cortex XSIAM incident data.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cortex XSIAM MCP to VS Code Copilot

Create your Vinkius account to connect Cortex XSIAM to VS Code Copilot and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cortex XSIAM with VS Code Copilot

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Team-Wide Security Operations in VS Code Copilot

This MCP Server integrates your team's security telemetry directly into your shared development environment. Your engineering team uses `get_incidents` to track active SOC queues and coordinate response efforts without leaving their IDE. Sharing incident context across your team is straightforward when you check your configuration into Git. Developers can instantly pull deep threat analysis using `get_incident_details` to debug custom integrations or security dashboards with real-time data.

Custom Log Analysis and Threat Hunting

Direct log analysis is powered by the `run_xql_query` tool, which lets you execute complex database searches from your chat window. Your agent runs queries against network, system, and endpoint logs to find patterns of compromise using the MCP Server. Correlating these logs with external threat feeds is simple. The agent uses `get_indicators` to verify if suspicious indicators of compromise match known malicious profiles, writing the results directly into your workspace.

Direct Endpoint Remediation via the MCP Server

Network isolation capabilities are exposed directly to your workspace through the `isolate_endpoint` tool. If a critical vulnerability is detected, your agent can instantly quarantine the compromised device to prevent lateral spread. Running follow-up security actions is just as fast. You can initiate malware scans using `scan_endpoint` or run automated response playbooks using `execute_playbook` to reset user passwords or block bad IPs.

Setup guide

Set up Cortex XSIAM MCP in VS Code Copilot

Prerequisites

VS Code 1.99 or later with GitHub Copilot extension
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and run "MCP: Add Server". Select HTTP (Streamable) as the server type. VS Code will create .vscode/mcp.json in your workspace.
2

Add the Cortex XSIAM MCP

Paste the JSON snippet shown on the right into your .vscode/mcp.json. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Switch to Agent mode

Open Copilot Chat (Cmd+Shift+I / Ctrl+Shift+I) and switch to Agent mode using the dropdown. MCP tools are only available in Agent mode — they do not appear in Edit or Ask modes.
4

Verify the connection

In the Copilot Chat input, type # to list available tools. You should see the Cortex XSIAM tools listed. Try asking: "List my recent Cortex XSIAM transactions" and Copilot will invoke them automatically.

.vscode/mcp.json

{
  "mcpServers": {
    "cortex-xsiam-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cortex XSIAM. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cortex XSIAM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cortex XSIAM MCP in VS Code Copilot

Add the server configuration details to your project's .vscode/mcp.json file. This makes the MCP tools available to your entire team as soon as they open the workspace in VS Code.

Yes, the agent can call `execute_playbook` with specific parameters to trigger incident response plans. This allows you to run automated remediation steps directly from the chat interface.

You can use the `run_xql_query` tool to search your logs using Cortex Query Language. The agent executes the query and prints the raw data or formats it into a readable markdown table.

The agent uses the `get_endpoints` tool to list all managed devices and audit coverage. This helps your team identify disconnected hosts or verify which systems need security updates.

Your incident payloads, endpoint details, and security alerts are kept strictly confidential. Vinkius routes all MCP tool executions through a secure, ephemeral sandbox that never stores your API credentials or query histories.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript