Vectra AI

You run a Vectra AI MCP Server to connect AI assistants with your Vectra AI security platform. It enables natural language threat investigations, guided incident response actions within Vectra, data correlation through prompts, dynamic visual analysis, and automated reporting from conversational prompts. This server supports multiple MCP clients and transports, so you can use Claude Desktop, Cursor, VS Code, and other MCP-enabled tools to interact with your security data.

How to use

Interact with your Vectra AI MCP Server through MCP clients to investigate threats, take actions in Vectra, and generate analyses and reports from natural language prompts. Use HTTP-based MCP clients to query and visualize data, or run the local stdio server to connect with desktop MCP clients directly.

How to install

Prerequisites and installation steps help you set up the Vectra AI MCP Server locally or in production.

# Prerequisites
# 1. Install Python (check the required version in the project configuration)

# 2. Install uv (Python package manager)
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

# Or via pip
pip install uv

Configure the project and environment variables, then create a virtual environment and install dependencies.

# Clone or download the project
# Navigate to the project directory
cd your-project-directory

# Copy the example environment file and edit values
cp .env.example .env
# Edit VECTRA_BASE_URL, VECTRA_CLIENT_ID, VECTRA_CLIENT_SECRET in .env

# Create and activate a virtual environment
uv venv
# macOS/Linux
source .venv/bin/activate
# Windows
.venv\Scripts\activate

# Install dependencies
uv sync

Run the MCP server using one of the transport options. Each option is described below with its typical usage.

# Standard IO transport (default, for Claude Desktop)
python server.py
python server.py --transport stdio

# SSE transport (HTTP-based MCP clients)
python server.py --transport sse --host 0.0.0.0 --port 8000

# Streamable HTTP transport (production HTTP deployments)
python server.py --transport streamable-http --host 0.0.0.0 --port 8000

# Enable debug logging
python server.py --debug

Environment variables provide alternate configuration without editing startup commands. Set these in your shell and start the server again.

export VECTRA_MCP_TRANSPORT=streamable-http
export VECTRA_MCP_HOST=0.0.0.0
export VECTRA_MCP_PORT=8000
export VECTRA_MCP_DEBUG=true
python server.py

Additional content

MCP client configuration examples show how to connect different clients to the server. You can connect via HTTP endpoints for production use or via stdio for local desktop clients.

{
  "mcpServers": {
    "vectra-ai-mcp": {
      "transport": {
        "type": "http",
        "url": "http://localhost:8000/"
      }
    }
  }
}

Claude Desktop MCP integration

If you use Claude Desktop, you can add an MCP server entry that points at your local MCP server. The example below shows how to configure Claude Desktop to launch the MCP server via the uv command and run the server script.

{
  "mcpServers": {
    "vectra-ai-mcp": {
      "command": "/path/to/your/uv/binary",
      "args": [
        "--directory",
        "/path/to/your/project/directory",
        "run",
        "server.py"
      ]
    }
  }
}

Troubleshooting and notes

• For HTTP-based MCP clients, the server typically exposes an endpoint at the host and port you specify (for example, http://localhost:8000/). Use this URL in your MCP client configuration.

• If you modify environment variables, restart the server to apply changes.

• The MCP client configuration shown includes both an HTTP endpoint and a local stdio configuration. Use the HTTP endpoint for production deployments and stdio for desktop workflows.

Docker deployment and build notes

You can deploy the Vectra AI MCP Server using Docker for production or easier setup. Two transport options are highlighted: streamable-http for production HTTP deployments and SSE for server-sent events.

To run with a pre-built image, configure environment variables in a .env file and start the container with the desired transport.

If you prefer to build from source, you can build the Docker image locally and run it with the chosen transport. The container supports the same environment variables as the local setup.

Available tools

investigate_threats

Investigate threats in natural language by querying the Vectra AI platform and composing investigations through your MCP-enabled AI client.

take_actions

Execute response actions directly in the Vectra AI platform from your AI agent, enabling automated containment or remediation steps.

correlate_data

Correlate and analyze security data using prompts to derive insights and relationships across detections, assets, and events.

visualize_data

Dynamically build advanced visualizations for analysis, dashboards, and incident context from natural language prompts.

generate_reports

Generate investigation or incident reports from natural language descriptions and data gathered from the Vectra AI platform.