Google Security Operations and Threat Intelligence MCP Server
This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google's security products and services:
Remote MCP Server for Google SecOps - Fully managed, enterprise-ready MCP server (Recommended)
Google Security Operations (Chronicle) - For threat detection, investigation, and hunting
MCP Security
ดาว
532
เครื่องมือ
—
อัปไทม์
—
Google Security Operations SOAR - For security orchestration, automation, and response
Google Threat Intelligence (GTI) - For access to Google's threat intelligence data
Security Command Center (SCC) - For cloud security and risk management
After installation, you can run the servers directly using uvx:
# Run SecOps MCP server
uvx --from google-secops-mcp secops_mcp
# Run GTI MCP server
uvx gti_mcp
# Run SCC MCP server
uvx scc_mcp
# Run SecOps SOAR MCP server (with optional integrations)
uvx secops_soar_mcp --integrations CSV,OKTA
Google SecOps Extension - Install our example extension for Gemini CLI to get specialized security skills (Triage, Investigate, Hunt).
The configuration for Claude Desktop and Cline is the same (provided below for uv and pip). We use the stdio transport.
Using the Google ADK Autonomous SOC Agent
The repository includes a prebuilt Autonomous Security Operations Center (SOC) Agent powered by Google ADK v2 and the Model Context Protocol in run-with-google-adk.
It can be run locally via an interactive CLI REPL or launched as a FastAPI service for Google Cloud Run:
cd run-with-google-adk
cp .env.example .env
# Interactive terminal investigation REPL
uv run mcp-security-agent chat
# Web UI and Cloud Run REST API server
uv run mcp-security-agent serve --port 8080
For full setup, architecture details, and Cloud Run deployment guides, see the ADK Agent Guide.
MCP Client Config Locations
MCP clients all use the same JSON configuration format (see the MCP Server Configuration Reference), but they expect the file in different locations.
Exact path varies by VS Code variant and platform. <extension-id> corresponds to the installed extension folder (e.g., saoudrizwan.claude-dev).
Additional Notes for Windows
%USERPROFILE% → C:\Users\<username>
%APPDATA% → C:\Users\<username>\AppData\Roaming
<project-root> → folder opened in VS Code or IDE for the project
<extension-id> → name of the installed extension folder (e.g., saoudrizwan.claude-dev for Claude/Cline)
Tip: Single Config with Symlinks
If you use multiple MCP clients, you can maintain a single config file and symlink it into each expected location. This avoids drift and keeps your server definitions consistent.
uv: Recommended for most users because it offers faster package installation, better dependency resolution, and isolated environments. It also supports loading environment variables from a file.
pip: Use when you prefer the standard Python package manager or when you have specific environment setup requirements.
UV_ENV_FILE
The --env-file option allows uv to use a .env file for environment variables. You can create this file or use system environment variables as described in the usage guide.
Alternatively, you can set UV_ENV_FILE to your .env file and omit the --env-file portion of the configuration.
Refer to the usage guide for detailed instructions on how to set up these environment variables.
Troubleshooting
Running the MCP Server from the CLI (and outside of your MCP client) can reveal issues: