How to Use the Wazuh (SIEM) MCP in Vercel AI SDK

Q: How do I run a basic threat hunt query using Wazuh (SIEM) and Vercel AI SDK?

Use getmitre with the WQL filter you need. The results stream into your frontend immediately, letting users interact with the data as it arrives.

Q: Can I check manager logs using Wazuh (SIEM) and Vercel AI SDK?

Yep. Calling getmanagerlogs fetches the current activity log from the Wazuh manager daemon. This data is streamed live to your user interface.

Q: What if I need to verify agent enrollment using Wazuh (SIEM) and Vercel AI SDK?

You can check who's on the network by calling listagents. This tool uses WQL filtering, giving you specific results that stream directly into your React component.

Q: Does this MCP Server support deleting agents using Wazuh (SIEM) and Vercel AI SDK?

It does. The deleteagents tool lets you specify which agents to remove using WQL criteria, making agent removal a single programmatic step.

Q: What data type is handled when I update the Wazuh rules via Vercel AI SDK?

This server handles rule file content. You use updaterulefile to push new rule sets, ensuring your SIEM logic stays current.

Real-time Wazuh (SIEM) data streams directly into your React UI using Vercel AI SDK.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Wazuh (SIEM) MCP to Vercel AI SDK

Create your Vinkius account to connect Wazuh (SIEM) to Vercel AI SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Wazuh (SIEM) with Vercel AI SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Check Agent Status with the MCP Server

Need to know if your agents are connected? Call `list_agents` and get a real-time count of all deployed Wazuh endpoints. You can also check cluster health by calling `list_cluster_nodes`. The data streams instantly, so users see the agent list appear live—no loading spinner needed.

Audit Security Policies for Your AI SDK

Run security assessments and get immediate results. Use `get_sca` to check your Wazuh Security Configuration Assessment status. Or, verify file integrity changes by calling `get_syscheck`. The data comes through the stream right as it's ready.

Manage Rules and Decoders via Your AI SDK

Don't want to manually update rules? You can call `update_rule_file` to push changes programmatically. This updates core Wazuh rules instantly. Need to see what you're working with? Use `list_rules` or `list_decoders` to pull the current set of loaded definitions.

Setup guide

Set up Wazuh (SIEM) MCP in Vercel AI SDK

Prerequisites

Node.js 18+ and a TypeScript project
ai + @modelcontextprotocol/sdk packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies

Run npm install ai @modelcontextprotocol/sdk plus your preferred model provider (e.g. @ai-sdk/openai).
2

Create the Streamable HTTP transport

Use StreamableHTTPClientTransport with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and use tools

Call mcpClient.tools() to auto-discover all Wazuh (SIEM) tools. Pass them directly to generateText() or streamText() — no manual schema definitions needed.
4

Works with any model provider

Swap openai("gpt-4o") for any AI SDK provider — Anthropic, Google, Mistral. The MCP tools work identically across all supported models.

index.ts

import { experimental_createMCPClient as createMCPClient } from "ai";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp";
import { generateText } from "ai";
import { openai } from "@ai-sdk/openai";

const transport = new StreamableHTTPClientTransport(
  new URL("https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp")
);

const mcpClient = await createMCPClient({ transport });
const tools = await mcpClient.tools();

const { text } = await generateText({
  model: openai("gpt-4o"),
  tools,
  prompt: "List recent Wazuh (SIEM) transactions",
});

console.log(text);
await mcpClient.close();

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Wazuh. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Wazuh (SIEM) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Wazuh (SIEM) MCP in Vercel AI SDK

Use `get_mitre` with the WQL filter you need. The results stream into your frontend immediately, letting users interact with the data as it arrives.

Yep. Calling `get_manager_logs` fetches the current activity log from the Wazuh manager daemon. This data is streamed live to your user interface.

You can check who's on the network by calling `list_agents`. This tool uses WQL filtering, giving you specific results that stream directly into your React component.

It does. The `delete_agents` tool lets you specify which agents to remove using WQL criteria, making agent removal a single programmatic step.

This server handles rule file content. You use `update_rule_file` to push new rule sets, ensuring your SIEM logic stays current.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python