Google Security
About
Access Google's security products and services, including Chronicle, SOAR, Threat Intelligence (GTI), and Security Command Center (SCC).
Details
- Author
- Categories
- Cloud Service, Security, Other, Infrastructure
Jump to
Setup
Install Google Security in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/google/mcp-security
Follow the installation instructions in the repository README, then restart your MCP client.
Google Security Operations and Threat Intelligence MCP Server
This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google's security products and services:
- Remote MCP Server for Google SecOps- Fully managed, enterprise-ready MCP server (Recommended)
- Google Security Operations (Chronicle)- For threat detection, investigation, and hunting
- Google Security Operations SOAR- For security orchestration, automation, and response
- Google Threat Intelligence (GTI)- For access to Google's threat intelligence data
- Security Command Center (SCC)- For cloud security and risk management
For the newRemote MCP Server, please see thelaunch announcementand thesetup guide.
Each server can be enabled and run separately, allowing flexibility for environments that don't require all capabilities.
Comprehensive documentation is available in thedocsfolder. You can:
- Read the markdown files directly in the repository
- View the documentation website athttps://google.github.io/mcp-security/
- Generate HTML documentation locally using Sphinx (see instructions in the docs folder)
- Detailed information about each MCP server
- Configuration options and requirements
- Usage examples and best practices
To get started with the documentation, seedocs/index.md.
The server uses Google's authentication. Make sure you have either:
- Set up Application Default Credentials (ADC)
- Set a GOOGLE_APPLICATION_CREDENTIALS environment variable
- Usedgcloud auth application-default login
Each MCP server can be installed and used as a standalone package.
You can install the packages usinguv tool install(recommended):
# Install packages uv tool install google-secops-mcp uv tool install gti-mcp uv tool install scc-mcp uv tool install secops-soar-mcp
pip install google-secops-mcp pip install gti-mcp pip install scc-mcp pip install secops-soar-mcp
After installation, you can run the servers directly using uvx:
# Run SecOps MCP server uvx --from google-secops-mcp secops_mcp # Run GTI MCP server uvx gti_mcp # Run SCC MCP server uvx scc_mcp # Run SecOps SOAR MCP server (with optional integrations) uvx secops_soar_mcp --integrations CSV,OKTA
CHRONICLE_PROJECT_ID="your-project-id" \ CHRONICLE_CUSTOMER_ID="01234567-abcd-4321-1234-0123456789ab" \ CHRONICLE_REGION="us" \ uvx secops_mcp
You can configure MCP clients to use the installed packages with uvx. Here's an example configuration:
{ "mcpServers": { "secops": { "command": "uvx", "args": [ "--from", "google-secops-mcp", "secops_mcp" ], "env": { "CHRONICLE_PROJECT_ID": "your-project-id", "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab", "CHRONICLE_REGION": "us" } }, "gti": { "command": "uvx", "args": [ "gti_mcp" ], "env": { "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" } }, "scc-mcp": { "command": "uvx", "args": [ "scc_mcp" ], "env": {} }, "secops-soar": { "command": "uvx", "args": [ "secops_soar_mcp", "--integrations", "CSV,OKTA" ], "env": { "SOAR_URL": "https://yours-here.siemplify-soar.com:443", "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab" } } } }
You can also use environment files with uvx:
{ "mcpServers": { "secops": { "command": "uvx", "args": [ "--env-file", "/path/to/.env", "secops_mcp" ] } } }
The MCP servers from this repo can be used with the following clients
- Cline, Claude Desktop, and other MCP supported clients
- Google ADK(Agent Development Kit)Agents (a prebuilt agent is provided, detailsbelow)
- Google SecOps Extension- Install our example extension for Gemini CLI to get specialized security skills (Triage, Investigate, Hunt).
The configuration for Claude Desktop and Cline is the same (provided below foruvandpip). We use the stdio transport.
Using the prebuilt Google ADK agent as client
Please refer to theREADME filefor both - locally running the prebuilt agent andCloud Rundeployment.
MCP clients all use the same JSON configuration format (see theMCP Server Configuration Reference), but they expect the file in different locations.
- %USERPROFILE%→C:\Users\<username>
- %APPDATA%→C:\Users\<username>\AppData\Roaming
- <project-root>→ folder opened in VS Code or IDE for the project
- <extension-id>→ name of the installed extension folder (e.g.,saoudrizwan.claude-devfor Claude/Cline)
If you use multiple MCP clients, you can maintain asingle config fileand symlink it into each expected location. This avoids drift and keeps your server definitions consistent.
{ "mcpServers": { "secops": { "command": "uv", "args": [ "--directory", "/path/to/the/repo/server/secops/secops_mcp", "run", "server.py" ], "env": { "CHRONICLE_PROJECT_ID": "your-project-id", "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab", "CHRONICLE_REGION": "us" } }, "secops-soar": { "command": "uv", "args": [ "--directory", "/path/to/the/repo/server/secops-soar/secops_soar_mcp", "run", "server.py", "--integrations", "CSV,OKTA" ], "env": { "SOAR_URL": "https://yours-here.siemplify-soar.com:443", "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab" } }, "gti": { "command": "uv", "args": [ "--directory", "/path/to/the/repo/server/gti/gti_mcp", "run", "server.py" ], "env": { "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" } }, "scc-mcp": { "command": "uv", "args": [ "--directory", "/path/to/the/repo/server/scc", "run", "scc_mcp.py" ], "env": { } } } }
NOTE:uvalso supports passing an.envfile like so:
"command": "uv", "args": [ "--directory", "/path/to/the/repo/server/...", "run", "--env-file", "/path/to/the/repo/server/.env", "server.py" ]
SOAR_APP_KEYandVT_APIKEYare good candidates for.env
You can also use pip instead of uv to install and run the MCP servers. This approach uses a bash command to:
- Change to the server directory
- Install the package in development mode
- Run the server binary
{ "mcpServers": { "secops": { "command": "/bin/bash", "args": [ "-c", "cd /path/to/the/repo/server/secops && pip install -e . && secops_mcp" ], "env": { "CHRONICLE_PROJECT_ID": "your-project-id", "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab", "CHRONICLE_REGION": "us" }, "alwaysAllow": [ ] }, "gti": { "command": "/bin/bash", "args": [ "-c", "cd /path/to/the/repo/server/gti && pip install -e . && gti_mcp" ], "env": { "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" }, "alwaysAllow": [ ] }, "scc-mcp": { "command": "/bin/bash", "args": [ "-c", "cd /path/to/the/repo/server/scc && pip install -e . && scc_mcp" ], "env": { }, "alwaysAllow": [] }, "secops-soar": { "timeout": 60, "command": "/bin/bash", "args": [ "-c", "cd /path/to/the/repo/server/secops-soar && pip install -e . && python secops_soar_mcp/server.py" ], "env": { "SOAR_URL": "https://yours-here.siemplify-soar.com:443", "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab" }, "transportType": "stdio" } } }
- uv: Recommended for most users because it offers faster package installation, better dependency resolution, and isolated environments. It also supports loading environment variables from a file.
- pip: Use when you prefer the standard Python package manager or when you have specific environment setup requirements.
The--env-fileoption allowsuvto use a .env file for environment variables. You can create this file or use system environment variables as described in the usage guide.
Alternatively, you can setUV_ENV_FILEto your.envfile and omit the--env-fileportion of the configuration.
Refer to theusage guidefor detailed instructions on how to set up these environment variables.
Running the MCP Server from the CLI (and outside of your MCP client) can reveal issues:
uv --verbose \ --directory "/Users/dandye/Projects/google-mcp-security/server/scc" \ run \ --env-file "/Users/dandye/Projects/google-mcp-security/.env" \ scc_mcp.py
which uv# you may need to restart MCP Client after installing uv
To use the MCP servers with Claude Desktop:
- Install Claude Desktop
- Open Claude Desktop and select "Settings" from the Claude menu
- Click on "Developer" in the lefthand bar, then click "Edit Config"
- Update yourclaude_desktop_config.jsonwith the configuration (replace paths with your actual paths)
- Save the file and restart Claude Desktop
- You should now see the hammer icon in the Claude Desktop interface, indicating the MCP server is active
- Install cline.bot extension in VSCode
- Update yourcline_mcp_settings.jsonwith the configuration (replace paths with your actual paths)
- Save the file and restart VS Code
Interact with Google's Chronicle Security Operations suite.
Administer Google Workspace using the GAM command-line tool.
Analyze files and extract Indicators of Compromise (IOCs) by interacting with the Joe Sandbox Cloud service.
This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Deploy and operate workloads, secrets, and networking across AWS, GCP, Azure, and private clouds.
An MCP Server that connects to Gemini Cloud Assist APIs, enabling you to manage and troubleshoot your Google Cloud environment using natural language.
Interact with the RAD Security platform which provides AI-powered security insights for Kubernetes and cloud environments.
AISG MCP Gateway — a security & DLP proxy for the Model Context Protocol. Aggregates your MCP servers behind one endpoint and enforces policy on every tool call
Manage Akamai's edge platform, including properties, DNS, certificates, security, and performance optimization, using AI assistants.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
