Cortex XSIAM MCP Server for Mastra AI 9 tools — connect in under 2 minutes

Name: Cortex XSIAM
Availability: InStock
Author: Vinkius

docs.mastra.ai/docs/agents/mcp-tools

Built by Vinkius GDPR 9 Tools SDK

Mastra AI is a TypeScript-native agent framework built for modern web stacks. Connect Cortex XSIAM through Vinkius and Mastra agents discover all tools automatically. type-safe, streaming-ready, and deployable anywhere Node.js runs.

Get MCP Server for AI Agents

ASK AI ABOUT THIS MCP SERVER

Open in ChatGPT Open in Claude Open in Perplexity

Vinkius supports streamable HTTP and SSE.

typescript

import { Agent } from "@mastra/core/agent";
import { createMCPClient } from "@mastra/mcp";
import { openai } from "@ai-sdk/openai";

async function main() {
  // Your Vinkius token. get it at cloud.vinkius.com
  const mcpClient = await createMCPClient({
    servers: {
      "cortex-xsiam": {
        url: "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp",
      },
    },
  });

  const tools = await mcpClient.getTools();
  const agent = new Agent({
    name: "Cortex XSIAM Agent",
    instructions:
      "You help users interact with Cortex XSIAM " +
      "using 9 tools.",
    model: openai("gpt-4o"),
    tools,
  });

  const result = await agent.generate(
    "What can I do with Cortex XSIAM?"
  );
  console.log(result.text);
}

main();

Fully ManagedVinkius Servers

60%Token savings

High SecurityEnterprise-grade

IAMAccess control

EU AI ActCompliant

DLPData protection

V8 IsolateSandboxed

Ed25519Audit chain

<40msKill switch

Stream every event to Splunk, Datadog, or your own webhook in real-time

* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure

About Cortex XSIAM MCP Server

Connect Cortex XSIAM to any AI agent via MCP.

How to Connect Cortex XSIAM to Mastra AI via MCP

Follow these steps to integrate the Cortex XSIAM MCP Server with Mastra AI.

Install dependencies

Run npm install @mastra/core @mastra/mcp @ai-sdk/openai

Replace the token

Replace [YOUR_TOKEN_HERE] with your Vinkius token

Run the agent

Save to agent.ts and run with npx tsx agent.ts

Explore tools

Mastra discovers 9 tools from Cortex XSIAM via MCP

Why Use Mastra AI with the Cortex XSIAM MCP Server

Mastra AI provides unique advantages when paired with Cortex XSIAM through the Model Context Protocol.

Mastra's agent abstraction provides a clean separation between LLM logic and tool infrastructure. add Cortex XSIAM without touching business code

Built-in workflow engine chains MCP tool calls with conditional logic, retries, and parallel execution for complex automation

TypeScript-native: full type inference for every Cortex XSIAM tool response with IDE autocomplete and compile-time checks

One-command deployment to any Node.js host. Vercel, Railway, Fly.io, or your own infrastructure

Cortex XSIAM + Mastra AI Use Cases

Practical scenarios where Mastra AI combined with the Cortex XSIAM MCP Server delivers measurable value.

Automated workflows: build multi-step agents that query Cortex XSIAM, process results, and trigger downstream actions in a typed pipeline

SaaS integrations: embed Cortex XSIAM as a first-class tool in your product's AI features with Mastra's clean agent API

Background jobs: schedule Mastra agents to query Cortex XSIAM on a cron and store results in your database automatically

Multi-agent systems: create specialist agents that collaborate using Cortex XSIAM tools alongside other MCP servers

Cortex XSIAM MCP Tools for Mastra AI (9)

These 9 tools become available when you connect Cortex XSIAM to Mastra AI via MCP:

execute_playbook

g., enrich IOCs, block IP, reset password). Requires playbook name and optional input arguments. Use this to speed up response times and ensure consistent handling of incidents. Execute an automated incident response playbook in Cortex XSIAM

get_alerts

Use this to review detection rules firing or analyze threat patterns. List security alerts detected by Cortex XSIAM

get_endpoints

Use this to audit endpoint coverage, identify disconnected hosts, or target remediation actions. List managed endpoints (hosts/devices) in Cortex XSIAM

get_incident_details

Requires the incident ID. Use this for deep investigation or context before taking action. Get detailed information about a specific security incident

get_incidents

Use this to monitor SOC queue, identify high-severity incidents, or track analyst workload. Supports sorting and limiting results. List security incidents in Cortex XSIAM

get_indicators

Use this to review threat intelligence or check if specific artifacts are known malicious. List indicators of compromise (IOCs) tracked in Cortex XSIAM

isolate_endpoint

Requires the endpoint ID. Use this immediately upon confirming a severe compromise to prevent lateral movement. Isolate a compromised endpoint from the network

run_xql_query

XQL allows searching logs, endpoints, network data, and more. Requires a valid XQL query string. Returns the results of the query. Use this for custom threat hunting, compliance reporting, or data analysis. Execute an XQL (Cortex Query Language) query for advanced threat hunting

scan_endpoint

Supports "quick" or "deep" scan types. Requires the endpoint ID. Use this to verify if a host is infected or after cleaning a threat. Trigger a malware scan on a specific endpoint