google/mcp-security

This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google's security products and services:
1. Remote MCP Server for Google SecOps - Fully managed, enterprise-ready MCP server (Recommended)
2. Google Security Operations (Chronicle) - For threat detection, investigation, and hunting
3. Google Security Operations SOAR - For security orchestration, automation, and response
4. Google Threat Intelligence (GTI) - For access to Google's threat intelligence data
5. Security Command Center (SCC) - For cloud security and risk management
For the new Remote MCP Server, please see the launch announcement and the setup guide.
Each server can be enabled and run separately, allowing flexibility for environments that don't require all capabilities.
## Documentation
Comprehensive documentation is available in the docs folder. You can:
1. Read the markdown files directly in the repository
2. View the documentation website at https://google.github.io/mcp-security/
3. Generate HTML documentation locally using Sphinx (see instructions in the docs folder)
The documentation covers:
Detailed information about each MCP server
Configuration options and requirements
Usage examples and best practices
To get started with the documentation, see docs/index.md.
## Authentication
The server uses Google's authentication. Make sure you have either:
1. Set up Application Default Credentials (ADC)
2. Set a GOOGLEAPPLICATIONCREDENTIALS environment variable
3. Used gcloud auth application-default login
## Standalone Usage
Each MCP server can be installed and used as a standalone package.
### Installation
You can install the packages using uv tool install (recommended):
bash
# Install packages
uv tool install google-secops-mcp
uv tool install gti-mcp
uv tool install scc-mcp
uv tool install secops-soar-mcp
Alternatively, you can use pip:
bash
pip install google-secops-mcp
pip install gti-mcp
pip install scc-mcp
pip install secops-soar-mcp
### Running Standalone
After installation, you can run the servers directly using uvx:
bash
# Run SecOps MCP server
uvx --from google-secops-mcp secopsmcp
# Run GTI MCP server
uvx gtimcp
# Run SCC MCP server
uvx sccmcp
# Run SecOps SOAR MCP server (with optional integrations)
uvx secopssoarmcp --integrations CSV,OKTA
With environment variables:
bash
CHRONICLEPROJECTID="your-project-id" \
CHRONICLECUSTOMERID="01234567-abcd-4321-1234-0123456789ab" \
CHRONICLEREGION="us" \
uvx secopsmcp
### Using with MCP Clients (Recommended)
You can configure MCP clients to use the installed packages with uvx. Here's an example configuration:
json
"mcpServers": {
"secops": {
"command": "uvx",
"args": [
"--from",
"google-secops-mcp",
"secopsmcp"
],
"env": {
"CHRONICLEPROJECTID": "your-project-id",
"CHRONICLECUSTOMERID": "01234567-abcd-4321-1234-0123456789ab",
"CHRONICLEREGION": "us"
},
"gti": {
"command": "uvx",
"args": [
"gtimcp"
],
"env": {
"VTAPIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
},
"scc-mcp": {
"command": "uvx",
"args": [
"sccmcp"
],
"env": {}
},
"secops-soar": {
"command": "uvx",
"args": [
"secopssoarmcp",
"--integrations",
"CSV,OKTA"
],
"env": {