How to Use the IBM QRadar MCP in Mastra AI

Q: Can Mastra AI automatically retry failed IBM QRadar AQL queries?

Yes, Mastra's workflow engine wraps the executeaql and getaqlstatus tools in retry blocks. If QRadar returns a busy status, the workflow waits and retries before fetching data with getaqlresults.

Q: Can a Mastra AI agent inspect my IBM QRadar rules to flag misconfigurations?

Absolutely, your agent can call getrules to read active correlation logic. It analyzes the rules against your current log sources from getlogsources to find gaps in your detection coverage.

Q: How do I register the QRadar tools in my Mastra agent?

Instantiate the MCPClient with the Vinkius endpoint URL, call listTools(), and spread those tools directly into your Mastra agent configuration block.

Build stateful Mastra AI workflows to automate IBM QRadar offense triage and execute complex Ariel queries with auto-retries.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect IBM QRadar MCP to Mastra AI

Create your Vinkius account to connect IBM QRadar to Mastra AI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup IBM QRadar with Mastra AI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Stateful offense triage workflows with Mastra AI

Stop manually checking the same security alerts every morning using this MCP integration. Build a Mastra workflow that runs on a schedule, grabs open alerts via `get_offenses`, and pulls deep context using `get_offense_details` to determine priority. If the alert matches known false-positive criteria, the workflow automatically runs `update_offense` to close it. If it looks like a real breach, Mastra routes it to your on-call team via Slack.

Resilient Ariel queries with automatic backoff

Ariel queries can fail when your QRadar console is under heavy load. This MCP Server integration allows Mastra to handle these hiccups by automatically retrying searches that hit rate limits. Your agent triggers `execute_aql` and polls `get_aql_status` within a stateful step. If the query times out, Mastra uses exponential backoff before calling `get_aql_results`, keeping your automation pipelines from breaking.

Human-in-the-loop validation for rule updates

Never let an autonomous agent modify your SIEM rules or reference sets without a sanity check. Use this MCP setup with Mastra's approval gates to halt the workflow before writing changes back to your security console. The agent compares incoming threats against `get_rules` and `get_reference_sets` to find anomalies. If it wants to update a blocklist, the workflow pauses and waits for an analyst to click approve before executing the update.

Setup guide

Set up IBM QRadar MCP in Mastra AI

Prerequisites

Node.js 18+ and a TypeScript project
@mastra/mcp + @mastra/core packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run npm install @mastra/mcp @mastra/core plus your preferred model provider (e.g. @ai-sdk/openai).
2

Configure the MCPClient
Create an MCPClient with your Vinkius endpoint as a URL object. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and inject tools
Call mcpClient.listTools() and spread the result into your agent's tools object. All IBM QRadar tools become native Mastra tools.
4

Run with any model
Swap openai("gpt-4o") for any AI SDK-compatible provider. Call agent.generate() and the agent routes tool calls through MCP automatically.

agent.ts

import { MCPClient } from "@mastra/mcp";
import { Agent } from "@mastra/core/agent";
import { openai } from "@ai-sdk/openai";

const mcpClient = new MCPClient({
  id: "ibm-qradar-mcp-client",
  servers: {
    "ibm-qradar-mcp": {
      url: new URL(
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
      ),
    },
  },
});

const agent = new Agent({
  name: "IBM QRadar Agent",
  model: openai("gpt-4o"),
  instructions: "You have access to IBM QRadar tools.",
  tools: {
    ...(await mcpClient.listTools()),
  },
});

const result = await agent.generate(
  "List recent IBM QRadar transactions"
);
console.log(result.text);

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by IBM QRadar. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect IBM QRadar now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about IBM QRadar MCP in Mastra AI

Yes, Mastra's workflow engine wraps the `execute_aql` and `get_aql_status` tools in retry blocks. If QRadar returns a busy status, the workflow waits and retries before fetching data with `get_aql_results`.

Use Mastra's approval feature on the workflow step that triggers `update_offense`. The agent gathers the offense details, presents them to an analyst, and pauses until a human signs off on the change.

Absolutely, your agent can call `get_rules` to read active correlation logic. It analyzes the rules against your current log sources from `get_log_sources` to find gaps in your detection coverage.

Instantiate the `MCPClient` with the Vinkius endpoint URL, call `listTools()`, and spread those tools directly into your Mastra agent configuration block.

Your API tokens and security credentials remain encrypted within the ephemeral Vinkius sandbox. No raw credentials or sensitive rule configurations from `get_rules` are exposed to the LLM provider.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript