How to Use the Kolide MCP in CrewAI

Q: How can a CrewAI team use Kolide to investigate a security alert?

Assign a MonitorAgent to find issues with listkolideissues. It then passes the issue data to an InvestigatorAgent, which uses getissuedetails and getdevicedetails to build a complete report before escalating.

Q: Can I create a CrewAI agent that just watches Kolide audit logs?

Yes. Give a dedicated agent the task of regularly calling listkolideauditlogs. It can look for specific events, like new device enrollments, and trigger another agent in the crew when it finds one.

Q: How do I give my CrewAI agents access to these Kolide tools?

The easiest way is to pass your Vinkius MCP URL into the mcps list when defining an Agent. For more fine-grained control, use the MCPServerHTTP class from crewai.mcp to filter exactly which tools each agent can access.

Deploy an autonomous security crew to monitor and manage your Kolide fleet using CrewAI.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Kolide MCP to CrewAI

Create your Vinkius account to connect Kolide to CrewAI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Kolide with CrewAI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Assemble a Security Monitoring Crew

Define a `MonitorAgent` in your crew with one job: periodically run `list_kolide_issues`. When it finds a new, critical issue, its task is complete. It passes the issue ID to the next agent in the sequence. An `InvestigatorAgent` then takes over. It uses the ID to run `get_issue_details`, `get_device_details`, and `get_person_details`. This agent gathers all the context—the problem, the machine, and the user—before passing a complete brief to a human or another agent.

Build an Autonomous Auditor Agent

Delegate fleet auditing to a specialized agent. Your `AuditorAgent` can run on a schedule, execute `list_kolide_devices`, and cross-reference the output with your HR system's employee list. It can use `get_person_details` to check the owner of each device. If a device has no owner or is assigned to a former employee, the agent's job is to flag it and pass the device ID to a `DecommissioningAgent`. This is how you automate fleet hygiene.

A CrewAI Team for Fleet Reporting

This MCP server lets you build an intelligence-gathering crew. Assign a `StatsAgent` to call `get_kolide_fleet_stats` for the big picture. At the same time, a `LogAgent` can pull recent events using `list_kolide_audit_logs`. A final `ReportingAgent` receives the data from both agents and assembles a daily security brief. CrewAI manages the information handoff, letting each agent focus on its specific tool and task.

Setup guide

Set up Kolide MCP in CrewAI

Prerequisites

Python 3.10+ installed
crewai package (pip install crewai)
Active Vinkius subscription with a valid endpoint token

1

Install CrewAI
Run pip install crewai to install the framework. MCP support is built-in via the mcps parameter.
2

Add the MCP URL to your agent
Pass your Vinkius endpoint directly to the mcps list. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. CrewAI handles tool discovery and caching automatically.
3

Kick off your crew
Create a Crew with your agent and tasks. Call crew.kickoff() — the agent will automatically invoke Kolide tools as needed.

crew.py

from crewai import Agent, Task, Crew

agent = Agent(
    role="Kolide Analyst",
    goal="Access and analyze Kolide data via MCP.",
    backstory="Expert analyst with direct Kolide access.",
    mcps=[
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ],
)

task = Task(
    description="List recent Kolide transactions",
    agent=agent,
    expected_output="A summary of recent activity",
)

crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff()
print(result)

Get your connection token →

Prerequisites

Python 3.10+ installed
crewai + crewai-tools packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install crewai crewai-tools. The MCPServerAdapter handles lifecycle management and tool conversion.
2

Connect with MCPServerAdapter
Use MCPServerAdapter as a context manager with SseServerParameters pointing to your Vinkius endpoint. The adapter automatically manages connection lifecycle.
3

Assign tools and run
Pass the returned mcp_tools to your agent's tools parameter. The adapter converts MCP tools to native BaseTool objects compatible with all CrewAI agents.

crew.py

from crewai import Agent, Task, Crew
from crewai_tools import MCPServerAdapter
from mcp import SseServerParameters

server_params = SseServerParameters(
    url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)

with MCPServerAdapter(server_params) as mcp_tools:
    agent = Agent(
        role="Kolide Analyst",
        goal="Access and analyze Kolide data via MCP.",
        backstory="Expert analyst with direct Kolide access.",
        tools=mcp_tools,
    )

    task = Task(
        description="List recent Kolide transactions",
        agent=agent,
        expected_output="A summary of recent activity",
    )

    crew = Crew(agents=[agent], tasks=[task])
    result = crew.kickoff()
    print(result)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Kolide. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Kolide now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Kolide MCP in CrewAI

Assign a `MonitorAgent` to find issues with `list_kolide_issues`. It then passes the issue data to an `InvestigatorAgent`, which uses `get_issue_details` and `get_device_details` to build a complete report before escalating.

Yes. Give a dedicated agent the task of regularly calling `list_kolide_audit_logs`. It can look for specific events, like new device enrollments, and trigger another agent in the crew when it finds one.

That's exactly how CrewAI is designed to work. Your first agent uses `list_kolide_devices` to get a device ID. The second agent receives that ID as input for its task, which is to call `get_person_details` and identify the user.

The easiest way is to pass your Vinkius MCP URL into the `mcps` list when defining an Agent. For more fine-grained control, use the `MCPServerHTTP` class from `crewai.mcp` to filter exactly which tools each agent can access.

This server is read-only and only touches endpoint security data like device names, OS versions, and associated user info. Vinkius processes every API call in a fresh, single-use environment that is destroyed after the request, ensuring no data persists.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript