How to Use the Elastic Security MCP in VS Code Copilot

Q: Can I audit my team's rules using Elastic Security in VS Code Copilot?

Yes. Use listdetectionrules to view current configurations. It's the fastest way to confirm your team's security settings.

Q: How do I look up rule details in Elastic Security with VS Code Copilot?

Use getrule with the rule ID. It provides the exact query logic and severity level so you can verify it against your requirements.

Q: Can I search past alerts using Elastic Security and VS Code Copilot?

Yes. searchsignals allows you to pull past alert data to investigate why a specific event triggered, right in the editor.

Deploy Elastic Security tools across your team in VS Code Copilot. Standardize threat hunting and rule management for every engineer.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Elastic Security MCP to VS Code Copilot

Create your Vinkius account to connect Elastic Security to VS Code Copilot and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Elastic Security with VS Code Copilot

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Team-wide security tools in VS Code Copilot

Commit your mcp.json to the repo so everyone on your team uses the same detection logic. Use `list_detection_rules` to ensure everyone is looking at the same security baseline. This keeps your SOC operations consistent. No more drift between what individual engineers see in their editors.

Manage exceptions via VS Code Copilot

When a build triggers a false positive, fix it globally for the team. Use `add_exception` to update your bypass lists directly from your IDE. It prevents everyone else from getting hit by the same noisy alert. Your team stays focused on actual development instead of incident cleanup.

Review threat status in VS Code Copilot

Check your environment health without leaving your editor. Use `get_prepackaged_rules_status` to verify that everyone's local rules align with official threat models. If something is outdated, you'll know immediately. It ensures your entire team is operating on the latest security intelligence.

Setup guide

Set up Elastic Security MCP in VS Code Copilot

Prerequisites

VS Code 1.99 or later with GitHub Copilot extension
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and run "MCP: Add Server". Select HTTP (Streamable) as the server type. VS Code will create .vscode/mcp.json in your workspace.
2

Add the Elastic Security MCP

Paste the JSON snippet shown on the right into your .vscode/mcp.json. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Switch to Agent mode

Open Copilot Chat (Cmd+Shift+I / Ctrl+Shift+I) and switch to Agent mode using the dropdown. MCP tools are only available in Agent mode — they do not appear in Edit or Ask modes.
4

Verify the connection

In the Copilot Chat input, type # to list available tools. You should see the Elastic Security tools listed. Try asking: "List my recent Elastic Security transactions" and Copilot will invoke them automatically.

.vscode/mcp.json

{
  "mcpServers": {
    "elastic-security-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Elastic Security. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Elastic Security now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Elastic Security MCP in VS Code Copilot

Commit the mcp.json file to your repository. VS Code will pick it up, and your team can access the tools via Copilot Chat.

Yes. Use `list_detection_rules` to view current configurations. It's the fastest way to confirm your team's security settings.

The server manages all authentication centrally. Your team only interacts with the SIEM through secure, scoped tool calls.

Use `get_rule` with the rule ID. It provides the exact query logic and severity level so you can verify it against your requirements.

Yes. `search_signals` allows you to pull past alert data to investigate why a specific event triggered, right in the editor.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript

Mastra AI sdk-typescript

Start using the Elastic Security MCP today

We host it, we monitor it, we maintain it. You just paste one token.

Get started