Skip to main content
Glama
vectra-ai-research

Vectra AI MCP Server

by vectra-ai-research
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
VECTRA_BASE_URLYesYour Vectra portal URL
VECTRA_MCP_HOSTNoHost to bind to for HTTP transports0.0.0.0
VECTRA_MCP_PORTNoPort for HTTP transports8000
VECTRA_CLIENT_IDYesYour client ID from Vectra
VECTRA_MCP_DEBUGNoEnable debug loggingfalse
VECTRA_CLIENT_SECRETYesYour client secret from Vectra
VECTRA_MCP_TRANSPORTNoTransport protocol (stdio, sse, or streamable-http)stdio

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": false
}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
list_detection_idsC
    List detection IDs with filtering and sorting options. Use this to get a list of detection IDs based on various criteria.

    Returns:
        str: JSON string with list of detection IDs.
list_detections_with_basic_infoB
    List detections with basic information and filtering options. Use this to get a quick overview of detections without detailed information.
    
    Returns:
        str: JSON string with list of detections ids.
list_detections_with_detailsB
    List detections with filtering and sorting options. Use this to get a detailed list of detections based on various criteria.

    Returns:
        str: JSON string with list of detections.
list_entity_detectionsC
    List all detections with full details for a specific entity. 
    
    Returns:
        str: JSON string with list of detections for the entity.
get_detection_countC
    Get the total count of detections matching the specified criteria.

    Returns:
        str: Count of detections matching the criteria.
get_detection_detailsC
    Get complete detailed information for a particular detection.
    
    Returns:
        str: JSON string with detection details.

    Raises:
        Exception: If fetching detection details fails.
get_detection_summaryB
    Get a concise summary of a detection including its ID, name, category, last timestamp, triage status, state, entity type, and detection summary. The detection summary includes key details about the detection including event specific details and description.
    
    Returns:
        str: Formatted string with detection summary.
get_detection_pcapC
    Get pcap file for a specific detection.
    
    Returns:
        str: Base64 encoded pcap data or error message.

    Raises:
        Exception: If retrieval fails.
list_entitiesC
    List entities (hosts & accounts) in Vectra platform based on various filters. This tool returns entities with all their detailed information.

    Returns:
        str: Formatted string with list of detections.
lookup_entity_info_by_nameB
    Retrieve information about an entity (account or host) by its name. Search is case-insensitive and can match partial names.

    Returns:
        str: Formatted string with entity information including name, ID, type, last detection timestamp, prioritization status, urgency score, state, and IP address (when available).
        If no entities are found, returns a message indicating that no matches were found.
lookup_host_by_ipA
    Retrieve information about a host entity by its IP address.
    
    Returns:
        str: Formatted string with host information including name, ID, type, last detection timestamp, prioritization status, urgency score, state, and IP address.
        If no hosts are found with the specified IP address, returns a message indicating that no matches were found.
        If an error occurs during the request, raises an exception with the error message.
get_host_detailsB
    Get complete detailed information about a specific host entity.
    
    Returns:
        str: Formatted string with detailed information about the host entity. 
        If the host is not found, returns a message indicating that no host was found with the specified ID.
        If an error occurs during the request, raises an exception with the error message.
get_account_detailsB
    Get complete detailed information about a specific account entity. This tool returns account details including detections, scoring information, associated accounts, access history, detection summaries, external data, and more. Response can be customized using various parameters to include or exclude specific fields and related data.
    
    Returns:
        str: JSON string with detailed information about the account. It includes detections, scoring information, associated accounts, access history, detection summaries, external data, and more.
        If the account is not found, returns a message indicating that no account was found with the specified ID.
        If an error occurs during the request, raises an exception with the error message.
create_assignmentC
    Create investigation assignment for an account or host
    
    Returns:
        str: Formatted string with assignment details.
    Raises:
        Exception: If assignment creation fails.
list_assignmentsC
    List all investigation assignments with optional filtering by timestamp and resolved state.
    
    Returns:
        str: JSON string with list of assignments.
list_assignments_for_userC
    List all investigation assignments assigned to a user/analyst.
    
    Returns:
        str: JSON string with list of assignments.
delete_assignmentA
    Unassign or delete an investigation assignment by its ID. Use list_assignments and list_assignments_for_user to fetch assignment IDs.

    Returns:
        str: Confirmation message of deletion.
    Raises:
        Exception: If deleting assignment fails.
get_assignment_detail_by_idB
    Retrieve details of a specific investigation assignment.

    Returns:
        str: JSON string with details of the assignment.
    Raises:
        Exception: If fetching assignment details fails.
get_assignment_for_entityC
    Retrieve investigation assignment for a specific account.

    Returns:
        str: JSON string with assignment details for the account.
    Raises:
        Exception: If fetching assignment fails.
create_entity_noteC
    Add an investigation note to an entity (host or account).
    
    Returns:
        str: Confirmation message with note details.
mark_detection_fixedB
    Marks or unmark detection as fixed.
    For marking as fixed, the detection will be closed as remediated, indicating it has been addressed.
    
    Returns:
        str: Confirmation message of operation.
    Raises:
        Exception: If marking detections fails.
list_platform_usersC
    List users in the Vectra platform.
    
    Returns:
        str: JSON string with list of users.
list_lockdown_entitiesB
    List entities that are currently in lockdown.
    
    Returns:
        str: JSON string with list of entities in lockdown.

Prompts

Interactive templates invoked by user choice

NameDescription
Summarize DetectionGet a detailed summary of a specific detection in Vectra AI platform.
Visualize Entity DetectionsVisualize realtionship of detections related to a specific entity in Vectra AI platform with a interactive graph.

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.2/5.0

Scored across 23 tools

Disambiguation4/5

Most tools have distinct purposes, but there is some overlap that could cause confusion. For example, list_detection_ids, list_detections_with_basic_info, and list_detections_with_details all serve similar functions with varying detail levels, which might lead to misselection. However, descriptions help clarify differences, and other tools like create_assignment or get_detection_pcap are clearly unique.

Naming Consistency5/5

Tool names follow a consistent verb_noun pattern throughout, such as create_assignment, get_account_details, list_detections_with_details, and mark_detection_fixed. All tools use snake_case, and verbs like create, get, list, delete, and mark are applied predictably across different nouns, making the set easy to navigate.

Tool Count3/5

With 23 tools, the count is borderline high for the security investigation domain, potentially feeling heavy. While the tools cover various aspects like assignments, detections, entities, and users, some could be consolidated (e.g., multiple detection listing tools) to reduce complexity without losing functionality.

Completeness4/5

The tool set provides comprehensive coverage for security investigation workflows, including CRUD operations for assignments and notes, detailed retrieval for accounts, hosts, and detections, and listing functions with filtering. Minor gaps exist, such as no tools for updating assignments or managing users beyond listing, but agents can likely work around these with the available tools.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources