mcp-security

This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.

394 stars PythonOthers Updated Oct 30, 2025

Documentation

Google Security Operations and Threat Intelligence MCP Server

This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google's security products and services:

1. Remote MCP Server for Google SecOps - Fully managed, enterprise-ready MCP server (Recommended)

2. Google Security Operations (Chronicle) - For threat detection, investigation, and hunting

3. Google Security Operations SOAR - For security orchestration, automation, and response

4. Google Threat Intelligence (GTI) - For access to Google's threat intelligence data

5. Security Command Center (SCC) - For cloud security and risk management

For the new Remote MCP Server, please see the launch announcement and the setup guide.

Each server can be enabled and run separately, allowing flexibility for environments that don't require all capabilities.

Documentation

Comprehensive documentation is available in the `docs` folder. You can:

1. Read the markdown files directly in the repository

2. View the documentation website at https://google.github.io/mcp-security/

3. Generate HTML documentation locally using Sphinx (see instructions in the docs folder)

The documentation covers:

Detailed information about each MCP server
Configuration options and requirements
Usage examples and best practices

To get started with the documentation, see docs/index.md.

Authentication

The server uses Google's authentication. Make sure you have either:

1. Set up Application Default Credentials (ADC)

2. Set a GOOGLE_APPLICATION_CREDENTIALS environment variable

3. Used `gcloud auth application-default login`

Standalone Usage

Each MCP server can be installed and used as a standalone package.

Installation

You can install the packages using `uv tool install` (recommended):

bash

# Install packages
uv tool install google-secops-mcp
uv tool install gti-mcp
uv tool install scc-mcp
uv tool install secops-soar-mcp

Alternatively, you can use pip:

bash

pip install google-secops-mcp
pip install gti-mcp
pip install scc-mcp
pip install secops-soar-mcp

Running Standalone

After installation, you can run the servers directly using uvx:

bash

# Run SecOps MCP server
uvx --from google-secops-mcp secops_mcp

# Run GTI MCP server
uvx gti_mcp

# Run SCC MCP server
uvx scc_mcp

# Run SecOps SOAR MCP server (with optional integrations)
uvx secops_soar_mcp --integrations CSV,OKTA

With environment variables:

bash

CHRONICLE_PROJECT_ID="your-project-id" \
CHRONICLE_CUSTOMER_ID="01234567-abcd-4321-1234-0123456789ab" \
CHRONICLE_REGION="us" \
uvx secops_mcp

Using with MCP Clients (Recommended)

You can configure MCP clients to use the installed packages with uvx. Here's an example configuration:

json

{
  "mcpServers": {
    "secops": {
      "command": "uvx",
      "args": [
        "--from",
        "google-secops-mcp",
        "secops_mcp"
      ],
      "env": {
        "CHRONICLE_PROJECT_ID": "your-project-id",
        "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab",
        "CHRONICLE_REGION": "us"
      }
    },
    "gti": {
      "command": "uvx",
      "args": [
        "gti_mcp"
      ],
      "env": {
        "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      }
    },
    "scc-mcp": {
      "command": "uvx",
      "args": [
        "scc_mcp"
      ],
      "env": {}
    },
    "secops-soar": {
      "command": "uvx",
      "args": [
        "secops_soar_mcp",
        "--integrations",
        "CSV,OKTA"
      ],
      "env": {
        "SOAR_URL": "https://yours-here.siemplify-soar.com:443",
        "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab"
      }
    }
  }
}

You can also use environment files with uvx:

json

{
  "mcpServers": {
    "secops": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "secops_mcp"
      ]
    }
  }
}

Client Configurations

The MCP servers from this repo can be used with the following clients

1. Cline, Claude Desktop, and other MCP supported clients

2. Google ADK(Agent Development Kit) Agents (a prebuilt agent is provided, details below)

3. Google SecOps Extension - Install our example extension for Gemini CLI to get specialized security skills (Triage, Investigate, Hunt).

The configuration for Claude Desktop and Cline is the same (provided below for uv and pip). We use the stdio transport.

Using the prebuilt Google ADK agent as client

Please refer to the README file for both - locally running the prebuilt agent and Cloud Run deployment.

MCP Client Config Locations

MCP clients all use the same JSON configuration format (see the MCP Server Configuration Reference), but they expect the file in different locations.

Client Application	Scope	macOS / Linux Location	Windows Location	Notes
Gemini CLI	Global	`~/.gemini/settings.json`	`%USERPROFILE%\.gemini\settings.json`	File must include `mcpServers`. Confirmed in Google Security Ops post.
Claude Desktop	Global	`~/Claude/claude_desktop_config.json`	`%USERPROFILE%\Claude\claude_desktop_config.json`	Config accessible via Claude > Settings > Developer > Edit Config.
Claude Code	Global	`~/.claude.json`	`%USERPROFILE%\.claude.json`	Primary config file for Claude Code CLI and extensions.
Cursor IDE (Global)	Global	`~/.cursor/mcp.json`	`%USERPROFILE%\.cursor\mcp.json`	Enables MCP servers globally across all projects.
Cursor IDE (Project)	Project	`/.cursor/mcp.json`	`/.cursor/mcp.json`	Workspace/project-specific config file.
VS Code (Workspace)	Workspace	`/.vscode/mcp.json`	`/.vscode/mcp.json`	Workspace-level config used when an MCP extension (like Cline) is installed. Overrides global config if present.
Cline (VS Code Ext.)	Global	Inside VS Code extension data	`%APPDATA%\Code\User\globalStorage\\settings\cline_mcp_settings.json`	Exact path varies by VS Code variant and platform. `` corresponds to the installed extension folder (e.g., `saoudrizwan.claude-dev`).

Additional Notes for Windows

`%USERPROFILE%` → `C:\Users\`
`%APPDATA%` → `C:\Users\\AppData\Roaming`
`` → folder opened in VS Code or IDE for the project
`` → name of the installed extension folder (e.g., `saoudrizwan.claude-dev` for Claude/Cline)

Tip: Single Config with Symlinks

If you use multiple MCP clients, you can maintain a single config file and symlink it into each expected location. This avoids drift and keeps your server definitions consistent.

Using uv (Recommended)

json

{
  "mcpServers": {
    "secops": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/the/repo/server/secops/secops_mcp",
        "run",
        "server.py"
      ],
      "env": {
        "CHRONICLE_PROJECT_ID": "your-project-id",
        "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab",
        "CHRONICLE_REGION": "us"
      }
    },
    "secops-soar": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/the/repo/server/secops-soar/secops_soar_mcp",
        "run",
        "server.py",
        "--integrations",
        "CSV,OKTA"
      ],
      "env": {
        "SOAR_URL": "https://yours-here.siemplify-soar.com:443",
        "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab"
      }
    },
    "gti": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/the/repo/server/gti/gti_mcp",
        "run",
        "server.py"
      ],
      "env": {
        "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      }
    },
    "scc-mcp": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/the/repo/server/scc",
        "run",
        "scc_mcp.py"
      ],
      "env": {
      }
    }
  }
}

NOTE: `uv` also supports passing an `.env` file like so:

code

"command": "uv",
      "args": [
        "--directory",
        "/path/to/the/repo/server/...",
        "run",
        "--env-file",
        "/path/to/the/repo/server/.env",
        "server.py"
      ]

`SOAR_APP_KEY` and `VT_APIKEY` are good candidates for `.env`

Using pip

You can also use pip instead of uv to install and run the MCP servers. This approach uses a bash command to:

1. Change to the server directory

2. Install the package in development mode

3. Run the server binary

json

{
  "mcpServers": {
    "secops": {
      "command": "/bin/bash",
      "args": [
        "-c",
        "cd /path/to/the/repo/server/secops && pip install -e . && secops_mcp"
      ],
      "env": {
        "CHRONICLE_PROJECT_ID": "your-project-id",
        "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab",
        "CHRONICLE_REGION": "us"
      },
      "alwaysAllow": [
      ]
    },
    "gti": {
      "command": "/bin/bash",
      "args": [
        "-c",
        "cd /path/to/the/repo/server/gti && pip install -e . && gti_mcp"
      ],
      "env": {
        "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      },
      "alwaysAllow": [
      ]
    },
    "scc-mcp": {
      "command": "/bin/bash",
      "args": [
        "-c",
        "cd /path/to/the/repo/server/scc && pip install -e . && scc_mcp"
      ],
      "env": {
      },
      "alwaysAllow": []
    },
    "secops-soar": {
      "timeout": 60,
      "command": "/bin/bash",
      "args": [
        "-c",
        "cd /path/to/the/repo/server/secops-soar && pip install -e . && python secops_soar_mcp/server.py"
      ],
      "env": {
        "SOAR_URL": "https://yours-here.siemplify-soar.com:443",
        "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab"
      },
      "transportType": "stdio"
    }
  }
}

When to use uv vs pip

uv: Recommended for most users because it offers faster package installation, better dependency resolution, and isolated environments. It also supports loading environment variables from a file.
pip: Use when you prefer the standard Python package manager or when you have specific environment setup requirements.

`UV_ENV_FILE`

The `--env-file` option allows `uv` to use a .env file for environment variables. You can create this file or use system environment variables as described in the usage guide.

Alternatively, you can set `UV_ENV_FILE` to your `.env` file and omit the `--env-file` portion of the configuration.

Refer to the usage guide for detailed instructions on how to set up these environment variables.

Troubleshooting

Running the MCP Server from the CLI (and outside of your MCP client) can reveal issues:

code

uv --verbose \
  --directory "/Users/dandye/Projects/google-mcp-security/server/scc" \
  run \
  --env-file "/Users/dandye/Projects/google-mcp-security/.env" \
  scc_mcp.py

Check your PATH(s):

which uv``` # you may need to restart MCP Client after installing uv

// Code block

python --version || python3 --version```

### Installing in Claude Desktop

To use the MCP servers with Claude Desktop:

1. Install Claude Desktop
2. Open Claude Desktop and select "Settings" from the Claude menu
3. Click on "Developer" in the lefthand bar, then click "Edit Config"
4. Update your `claude_desktop_config.json` with the configuration (replace paths with your actual paths)
5. Save the file and restart Claude Desktop
6. You should now see the hammer icon in the Claude Desktop interface, indicating the MCP server is active

### Installing in cline (vscode extension)

1. Install cline.bot extension in VSCode
2. Update your `cline_mcp_settings.json` with the configuration (replace paths with your actual paths)
3. Save the file and restart VS Code

## License

Apache 2.0

Frequently asked questions

What is mcp-security?

mcp-security is This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.

How do I install mcp-security?

Open the GitHub repository and follow its README. Most MCP servers are added to your client's MCP config, then called by your agent.

Is mcp-security open source?

Yes — it is hosted on GitHub at https://github.com/google/mcp-security and has 394 stars.

Related MCP tools

mem0-mcp

5. Update .env file in the root directory with your mem0 API key: for the Model Context Protocol. Enhance AI assistants with powerful integrations.

499 Python

a-share-mcp-is-just-i-need

Model Context Protocol integration for Python. Enhance AI assistants with powerful Python-based capabilities and integration support.

440 Python

browser-use-mcp-server

Browse the web, directly from Cursor etc. Built for the Model Context Protocol to enhance AI capabilities. Python-based implementation.

760 Python

browserbrowser-usecursor+3

jupyter-mcp-server

🪐 ✨ Model Context Protocol (MCP) Server for Jupyter. Python-based implementation. Trusted by 700+ developers. Trusted by 700+ developers.

741 Python

aijupytermcp+2

kubectl-mcp-server

Chat with your Kubernetes Cluster using AI tools and IDEs like Claude and Cursor! for the Model Context Protocol. Enhance AI assistants with powerful integratio

732 Python

aideploymentdevops+6

qgis_mcp

Model Context Protocol (MCP) that allows LLMs to use QGIS Desktop Python-based implementation. Trusted by 600+ developers.

686 Python

Run your own MCP server? See who uses it and what to fix.

Measure it with TrackMCP