이 저장소에는 MCP 클라이언트(예: Claude Desktop 또는 cline.bot VS Code 확장)가 구글의 보안 제품과 서비스에 접근할 수 있도록 하는 모델 컨텍스트 프로토콜(MCP) 서버가 포함되어 있습니다:

1. Google SecOps용 원격 MCP 서버 - 완전 관리되고 엔터프라이즈용 MCP 서버 (권장)
2. Google Security Operations (Chronicle) - 위협 탐지, 조사 및 사냥을 위해
3. Google Security Operations SOAR - 보안 오케스트레이션, 자동화 및 대응을 위해
4. Google 위협 인텔리전스(GTI) - 구글의 위협 인텔리전스 데이터에 접근하기 위해
5. 보안 지휘 센터(SCC) - 클라우드 보안 및 리스크 관리를 위해

새로운 원격 MCP 서버에 대해서는 출시 발표와 설정 가이드를 참고해 주세요.

각 서버는 별도로 활성화하고 실행할 수 있어, 모든 기능이 필요하지 않은 환경에서도 유연성을 제공합니다.

문서

자세한 문서는 docs 폴더에서 확인할 수 있습니다. 다음과 같은 방법이 있습니다:

1. 저장소에서 마크다운 파일을 직접 읽습니다
2. 문서 웹사이트 [https://google.github.io/mcp-security/ 참조
3. Sphinx를 사용해 로컬에서 HTML 문서를 생성하기(문서 폴더의 지침 참조)

Google Security Operations and Threat Intelligence MCP Server

This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google’s security products and services:

1. Remote MCP Server for Google SecOps - Fully managed, enterprise-ready MCP server (Recommended)
2. Google Security Operations (Chronicle) - For threat detection, investigation, and hunting
3. Google Security Operations SOAR - For security orchestration, automation, and response
4. Google Threat Intelligence (GTI) - For access to Google’s threat intelligence data
5. Security Command Center (SCC) - For cloud security and risk management

For the new Remote MCP Server, please see the launch announcement and the setup guide.

Each server can be enabled and run separately, allowing flexibility for environments that don’t require all capabilities.

Documentation

Comprehensive documentation is available in the docs folder. You can:

1. Read the markdown files directly in the repository
2. View the documentation website at https://google.github.io/mcp-security/
3. Generate HTML documentation locally using Sphinx (see instructions in the docs folder)

The documentation covers:

• Detailed information about each MCP server
• Configuration options and requirements
• Usage examples and best practices

To get started with the documentation, see docs/index.md.

Authentication

The server uses Google’s authentication. Make sure you have either:

1. Set up Application Default Credentials (ADC)
2. Set a GOOGLE_APPLICATION_CREDENTIALS environment variable
3. Used gcloud auth application-default login

Standalone Usage

Each MCP server can be installed and used as a standalone package.

Installation

You can install the packages using uv tool install (recommended):

# Install packages
uv tool install google-secops-mcp
uv tool install gti-mcp
uv tool install scc-mcp
uv tool install secops-soar-mcp

Alternatively, you can use pip:

pip install google-secops-mcp
pip install gti-mcp
pip install scc-mcp
pip install secops-soar-mcp

Running Standalone

After installation, you can run the servers directly using uvx:

# Run SecOps MCP server
uvx --from google-secops-mcp secops_mcp

# Run GTI MCP server
uvx gti_mcp

# Run SCC MCP server
uvx scc_mcp

# Run SecOps SOAR MCP server (with optional integrations)
uvx secops_soar_mcp --integrations CSV,OKTA

With environment variables:

CHRONICLE_PROJECT_ID="your-project-id" \
CHRONICLE_CUSTOMER_ID="01234567-abcd-4321-1234-0123456789ab" \
CHRONICLE_REGION="us" \
uvx secops_mcp

Using with MCP Clients (Recommended)