How to Use the Datadog Cloud SIEM MCP in Vercel AI SDK

Q: Can my UI display the logic behind a specific detection rule?

Your agent calls getdetectionrule to fetch the query logic, severity bindings, and routing targets. The SDK then streams this structured JSON directly into your frontend components for immediate review.

Pipe live Datadog Cloud SIEM alert data directly into your Next.js frontend with Vercel AI SDK.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Datadog Cloud SIEM MCP to Vercel AI SDK

Create your Vinkius account to connect Datadog Cloud SIEM to Vercel AI SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Datadog Cloud SIEM with Vercel AI SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Live Incident Triage in Vercel AI SDK UI

The `triage_signal` tool lets your agent change incident states from open to archived directly from your user interface. When a developer flags a false positive, the Vercel AI SDK streams this state update live to the screen. You see the status change to archived without waiting for a full page reload. Behind the scenes, the agent passes the required archive reason through this MCP Server to your Datadog dashboard. This setup runs on Edge Functions to keep latency under 50ms, giving security teams instant feedback during active incidents.

Instant Log Threat Hunting via MCP Server

The `search_raw_logs` tool pulls VPC flow logs and application stack traces from the last 15 minutes directly into your chat window. Instead of waiting for a slow API response, the Vercel AI SDK renders log lines as they arrive. Security engineers can inspect active breaches in real-time. After identifying an attacker footprint, the agent triggers `get_raw_log_context` to pull the surrounding 100 log messages. Running this on Vercel's edge network means your team gets immediate visibility into raw payloads without loading spinners.

Live Security Rule Management

The `create_detection_rule` tool builds and auto-activates new Lucene-based queries based on natural language requests. Your team can describe a threat, and the Vercel AI SDK immediately displays the newly built rule structure. If a rule causes too much noise, your agent uses `delete_detection_rule` to remove custom JSON configurations instantly. This MCP integration ensures your security team edits active detection matrices without leaving their custom internal dashboard.

Setup guide

Set up Datadog Cloud SIEM MCP in Vercel AI SDK

Prerequisites

Node.js 18+ and a TypeScript project
ai + @modelcontextprotocol/sdk packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies

Run npm install ai @modelcontextprotocol/sdk plus your preferred model provider (e.g. @ai-sdk/openai).
2

Create the Streamable HTTP transport

Use StreamableHTTPClientTransport with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and use tools

Call mcpClient.tools() to auto-discover all Datadog Cloud SIEM tools. Pass them directly to generateText() or streamText() — no manual schema definitions needed.
4

Works with any model provider

Swap openai("gpt-4o") for any AI SDK provider — Anthropic, Google, Mistral. The MCP tools work identically across all supported models.

index.ts

import { experimental_createMCPClient as createMCPClient } from "ai";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp";
import { generateText } from "ai";
import { openai } from "@ai-sdk/openai";

const transport = new StreamableHTTPClientTransport(
  new URL("https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp")
);

const mcpClient = await createMCPClient({ transport });
const tools = await mcpClient.tools();

const { text } = await generateText({
  model: openai("gpt-4o"),
  tools,
  prompt: "List recent Datadog Cloud SIEM transactions",
});

console.log(text);
await mcpClient.close();

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Datadog Security. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Datadog Cloud SIEM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Datadog Cloud SIEM MCP in Vercel AI SDK

You pass the SIEM tools directly to streamText using the mcpClient. The Vercel AI SDK handles the streaming UI blocks, showing raw log outputs from search_raw_logs as they arrive.

Yes, this setup works with edge runtimes. Your agent can run list_detection_rules inside an Edge Function to check your AWS or Kubernetes security stance without cold-start delays.

Vinkius manages the underlying Datadog API keys securely. You only need to pass a single Vinkius endpoint token to createMCPClient in your Next.js backend, keeping your credentials hidden from the client browser.

Your agent calls get_detection_rule to fetch the query logic, severity bindings, and routing targets. The SDK then streams this structured JSON directly into your frontend components for immediate review.

Your raw SIEM logs, detection rules, and API keys remain isolated within the Vinkius V8 sandbox. No log payloads are stored on Vinkius servers, and all data transfers use encrypted transit tunnels directly to Datadog endpoints.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript