How to Use the Trend Micro MCP in LangChain

Q: What data types can I query with Trend Micro and LangChain?

You access asset telemetry, including endpoint activities (listendpointactivitylogs), security alerts from listsecurityalerts, and lists of suspicious network objects.

Build multi-step security pipelines for LangChain agents using Vision One data.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Trend Micro MCP to LangChain

Create your Vinkius account to connect Trend Micro to LangChain and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Trend Micro with LangChain

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Investigate alerts with the MCP Server.

You can use `list_security_alerts` to pull a full roster of current security incidents from Trend Micro. Then, if you spot something suspicious, call `get_alert_details` to get all the context—who was involved and what exactly triggered it. This allows your agent to perform deep, multi-step investigations. Start with a broad list, narrow it down by getting specific details, and build a full narrative of the threat without needing human intervention.

Audit asset status for LangChain agents.

To check what's running on your network, first call `list_managed_endpoints` to get all connected assets. Next, run `list_endpoint_activity_logs` to see exactly what each of those endpoints was doing in a specific timeframe. This sequence lets the agent track lateral movement or pinpoint which asset initiated an unusual action. It's perfect for creating audit chains that follow a clear path from discovery to evidence.

Triage threat intelligence with MCP Server.

If your investigation leads you to a suspicious IP address or URL, run `list_suspicious_objects` to pull all known bad data. You can then cross-reference this list against recent activity by running `list_recent_detections`. This pairing lets the agent check if any assets interacted with known threats. It moves beyond just listing alerts; it connects the dots between global threat feeds and your internal telemetry.

Setup guide

Set up Trend Micro MCP in LangChain

Prerequisites

Python 3.10+ installed
langchain-mcp-adapters + langgraph packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install langchain-mcp-adapters langgraph langchain-openai. The MCP adapters package converts MCP tools into native LangChain BaseTool objects.
2

Connect via HTTP transport
Use MultiServerMCPClient with "transport": "http" pointing to your Vinkius endpoint. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Create a ReAct agent
Pass the discovered tools to create_react_agent() from LangGraph. The agent automatically routes Trend Micro tool calls through the MCP protocol.
4

Run with any LLM
Swap ChatOpenAI for ChatAnthropic, ChatGoogleGenerativeAI, or any LangChain-compatible model. The MCP tools work identically across all providers.

agent.py

from langchain_mcp_adapters.client import MultiServerMCPClient
from langgraph.prebuilt import create_react_agent
from langchain_openai import ChatOpenAI

async with MultiServerMCPClient({
    "trend-micro-mcp": {
        "transport": "http",
        "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp",
    }
}) as client:
    tools = client.get_tools()

    agent = create_react_agent(
        ChatOpenAI(model="gpt-4o"),
        tools,
    )
    result = await agent.ainvoke({
        "messages": "List recent Trend Micro transactions"
    })
    print(result["messages"][-1].content)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Trend Micro. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Trend Micro now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Trend Micro MCP in LangChain

You use the MCP Server to get raw Vision One telemetry. The output of a tool, like `list_endpoint_activity_logs`, becomes the structured input for the next step in your LangChain chain.

You access asset telemetry, including endpoint activities (`list_endpoint_activity_logs`), security alerts from `list_security_alerts`, and lists of suspicious network objects.

Yes. The server handles structured telemetry, meaning you're working with logs and object metadata. Your agent doesn't need to process raw personal communication details; it focuses on machine-readable threat artifacts.

The adapter supports aggregating tools from multiple MCP Servers, letting your LangChain agent combine data sources into one coherent workflow.

The goal is to build complex, multi-step reasoning agents. Instead of just getting a report, your agent decides the sequence of API calls needed to answer a security question.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript