How to Use the Elastic Security MCP in Vercel AI SDK

Q: How do I query Elastic Security alerts using the Vercel AI SDK?

You call the searchsignals tool within your Vercel AI SDK stream. This fetches raw alerts directly from the SIEM to your application interface. It's the fastest way to get incident data into your frontend.

Q: Can I update an Elastic Security rule from the Vercel AI SDK?

Yes, you use the updaterule tool to modify or toggle existing detection logic. This lets your application respond to changing threat conditions without manual SIEM console work.

Q: Does the Vercel AI SDK allow me to whitelist hosts in Elastic Security?

You can use addexception to whitelist specific hostnames inside your existing exception lists. This prevents your SIEM from triggering on known-good administrative behavior directly from your UI.

Q: How do I audit my current rule coverage?

Use listdetectionrules to pull your active configuration. This helps you map your current detection logic against specific MITRE ATT&CK tactics.

Stream raw Elastic Security telemetry directly into your UI components with the Vercel AI SDK for real-time threat analysis.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Elastic Security MCP to Vercel AI SDK

Create your Vinkius account to connect Elastic Security to Vercel AI SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Elastic Security with Vercel AI SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Live Signal Monitoring in React

Feed security data straight into your frontend without waiting for background jobs to finish. Use `search_signals` to pull the latest alerts and display them to your users the second they hit the SIEM. Your interface stays responsive while the AI processes incoming logs. Developers can bind these results to dynamic UI components for immediate incident visualization.

Manage Detection Rules Programmatically

Adjust your security posture from your admin dashboard using `update_rule` and `create_rule`. You can toggle detection logic or define new thresholds without leaving your application code. This gives your team a way to respond to emerging threats directly from your custom internal tools. It turns your SIEM into an extension of your own product's control panel.

Automated Exception Handling

Stop false positives from cluttering your dashboard by piping user-defined exceptions through `add_exception`. This keeps your alert feed clean and focused on actual security events. Your users can whitelist known-good hostnames in one click. The MCP server handles the underlying logic, ensuring the SIEM ignores the noise while you focus on the signal.

Setup guide

Set up Elastic Security MCP in Vercel AI SDK

Prerequisites

Node.js 18+ and a TypeScript project
ai + @modelcontextprotocol/sdk packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies

Run npm install ai @modelcontextprotocol/sdk plus your preferred model provider (e.g. @ai-sdk/openai).
2

Create the Streamable HTTP transport

Use StreamableHTTPClientTransport with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and use tools

Call mcpClient.tools() to auto-discover all Elastic Security tools. Pass them directly to generateText() or streamText() — no manual schema definitions needed.
4

Works with any model provider

Swap openai("gpt-4o") for any AI SDK provider — Anthropic, Google, Mistral. The MCP tools work identically across all supported models.

index.ts

import { experimental_createMCPClient as createMCPClient } from "ai";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp";
import { generateText } from "ai";
import { openai } from "@ai-sdk/openai";

const transport = new StreamableHTTPClientTransport(
  new URL("https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp")
);

const mcpClient = await createMCPClient({ transport });
const tools = await mcpClient.tools();

const { text } = await generateText({
  model: openai("gpt-4o"),
  tools,
  prompt: "List recent Elastic Security transactions",
});

console.log(text);
await mcpClient.close();

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Elastic Security. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Elastic Security now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Elastic Security MCP in Vercel AI SDK

You call the `search_signals` tool within your Vercel AI SDK stream. This fetches raw alerts directly from the SIEM to your application interface. It's the fastest way to get incident data into your frontend.

Yes, you use the `update_rule` tool to modify or toggle existing detection logic. This lets your application respond to changing threat conditions without manual SIEM console work.

You can use `add_exception` to whitelist specific hostnames inside your existing exception lists. This prevents your SIEM from triggering on known-good administrative behavior directly from your UI.

Use `list_detection_rules` to pull your active configuration. This helps you map your current detection logic against specific MITRE ATT&CK tactics.

The server only touches your SIEM alert telemetry and rule configurations. It does not store your hostnames or IP addresses; it just passes them to the Elastic Security API as required for rule management.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript