Google MCP Security
Official Google MCP servers for SecOps, SOAR, Threat Intelligence and Security Command Center, plus a Gemini CLI extension for alert triage
- 535 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The servers read investigation data, security events and cases and pass them into a language model's context
- The SOAR server runs orchestration integrations that act in external systems such as OKTA
- Google credentials and the VT_APIKEY and SOAR_APP_KEY keys open access to an organization's security products
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/google-mcp-securityDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The servers read investigation data, security events and cases and pass them into a language model's context
- The SOAR server runs orchestration integrations that act in external systems such as OKTA
- Google credentials and the VT_APIKEY and SOAR_APP_KEY keys open access to an organization's security products
This is third-party code. Review the repository files before installing.
What it does
The repository bundles MCP servers for Google's security products. The SecOps server works with Google Security Operations (Chronicle) and helps hunt threats, investigate incidents and run detections. The SOAR server connects to response orchestration and automation, with the set of integrations chosen by a flag, for example CSV and OKTA. The GTI server reaches Google Threat Intelligence data through a VirusTotal key, and the SCC server exposes Security Command Center findings in the cloud. Each server installs and runs on its own. SecOps also has a managed remote server, labeled recommended: it needs no local Python environment, and access goes through the roles/mcp.toolUser role in Google Cloud. The repository also holds a ready autonomous SOC agent built on Google ADK, launched as an interactive console or as a service for Cloud Run. A separate Gemini CLI extension brings ready-made skills: triage for alert handling, investigate for investigations and hunt for threat hunting. Alongside sit a tool mapping between the local and remote servers and persona descriptions, from a tier 1 SOC analyst to a CISO.
Who it is for. For SOC analysts, detection engineers and threat hunters who already run Google SecOps, Google Threat Intelligence or Security Command Center.
Good fit when
- You need to work a Chronicle alert by protocol: gather case details, check duplicates and judge it a false positive, benign true positive or true positive
- You want to find events from a natural language query: the remote server first translates it into a UDM query, then runs the search
- A suspicious hash, domain or address needs checking against Google Threat Intelligence data through a VirusTotal key
- You need a response playbook in SOAR with only the CSV and OKTA integrations enabled
- You want a SOC agent on Google ADK up quickly: a console mode for investigations or a service on Cloud Run
Not a fit when
- You have no Chronicle, SOAR, Threat Intelligence or Security Command Center: the servers work only with these Google products
- You want to scan your own code for vulnerabilities: these servers handle alerts and incidents, not source code
- You need an offensive toolkit such as a port scanner: the servers call Google APIs, not pentest tools
- Company policy forbids passing investigation data to a language model: server responses land in the agent's context
- The managed remote server is enough and you do not want a local environment: then use only the remote option and skip the packages
Example request
Triage Chronicle case 4521 by protocol: gather the details, check for duplicates and say whether it is a false positive or needs an investigationMCP
- Transport
- stdio
- Authentication
- key is optional
Environment variables
CHRONICLE_PROJECT_IDrequired- The Google Cloud project ID for the SecOps server
CHRONICLE_CUSTOMER_IDrequired- The Chronicle customer ID as a UUID
CHRONICLE_REGIONrequired- The Chronicle region, for example us
VT_APIKEYsecret- The VirusTotal key for the Google Threat Intelligence server
SOAR_APP_KEYsecret- The application key for the SOAR server, used together with SOAR_URL
Limitations
The servers need Google credentials: Application Default Credentials, the GOOGLE_APPLICATION_CREDENTIALS variable or a sign-in with gcloud auth application-default login. SecOps takes CHRONICLE_PROJECT_ID, CHRONICLE_CUSTOMER_ID and CHRONICLE_REGION, GTI needs a VT_APIKEY key, and SOAR needs the SOAR_URL address and a SOAR_APP_KEY key.
The remote server must be enabled in your Google Cloud project with gcloud beta services mcp enable chronicle.googleapis.com/mcp. It uses the Chronicle REST API, so SOAR tools work only after migration to that API, while SIEM tools are available at once. Every request to the remote server needs a customer ID, region and project, which the docs suggest writing into a context file such as GEMINI.md.
Local servers use the stdio transport and run through uv or pip. The author does not say whether Google services are reachable from Russia.
How to disable. Remove the secops, gti, scc-mcp and secops-soar entries from your MCP configuration and restart the client. Installed packages come off with uv tool uninstall. The remote server is switched off in the Google Cloud project, and access is revoked by removing the roles/mcp.toolUser role.
FAQ
How do I connect Google SecOps MCP to Claude Code?
Install the package with uv tool install google-secops-mcp and add a secops server to the Claude Code configuration: command uvx, arguments --from google-secops-mcp secops_mcp, and the CHRONICLE_PROJECT_ID, CHRONICLE_CUSTOMER_ID and CHRONICLE_REGION variables in env. By the repository's table, Claude Code's configuration file is ~/.claude.json.
How does the remote SecOps server differ from the local packages?
The remote server is managed by Google, needs no Python environment and is the recommended option. It uses the Chronicle REST API, and access is limited by the roles/mcp.toolUser role. The local packages run on your machine through uv or pip and call the secops-py library.
Which skills does the Gemini CLI extension have?
Three working skills: triage for handling alerts and judging false positives, investigate for investigations and hunt for threat hunting. Two more, setup-gemini-cli and setup-antigravity, configure the connection to the remote server.
What does the Google Threat Intelligence server need?
A VirusTotal key in the VT_APIKEY variable. The server installs as the gti-mcp package and runs with uvx gti_mcp.
Can I limit which SOAR integrations the server loads?
Yes, with the --integrations flag and a comma-separated list, for example CSV,OKTA. The repository documents dozens of SOAR integrations, and you should load only the ones you use.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
A bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
CloudSword: cloud security testing
CloudSword
A security testing tool for Alibaba, Tencent and other Chinese cloud accounts that also runs as an MCP server for an agent.
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
A Google extension for Gemini CLI that finds vulnerabilities in branch changes and checks dependencies with OSV-Scanner
README in short
The document lists five components: the managed remote SecOps server and the local SecOps, SOAR, GTI and SCC servers. It then covers Google authentication, package installation through uv tool install or pip, launch with uvx and a client configuration example with environment variables. A table shows where the settings file lives in Gemini CLI, Claude Desktop, Claude Code, Cursor, VS Code and Cline. It closes with the autonomous SOC agent on Google ADK and instructions for Claude Desktop and Cline.