该仓库包含模型上下文协议（MCP）服务器，使MCP客户端（如Claude Desktop或cline.bot VS Code扩展）能够访问谷歌的安全产品和服务：

1. Google SecOps 远程 MCP 服务器 - 全托管、企业级 MCP 服务器（推荐）
2. 谷歌安全运营（纪事） - 用于威胁检测、调查和狩猎
3. Google Security Operations SOAR - 用于安全编排、自动化和响应
4. 谷歌威胁情报（GTI） - 访问谷歌的威胁情报数据
5. 安全指挥中心（SCC）——用于云安全和风险管理

关于新的远程MCP服务器，请参见发布公告和设置指南。

每个服务器都可以单独启用并运行，为不需要所有功能环境提供灵活性。

文献资料

详尽的文档可在 docs 文件夹中找到。您可以：

1. 直接读取仓库中的标记文件
2. 访问文档网站 https://google.github.io/mcp-security/
3. 使用Sphinx本地生成HTML文档（详见文档文件夹中的说明）

Google Security Operations and Threat Intelligence MCP Server

This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google’s security products and services:

1. Remote MCP Server for Google SecOps - Fully managed, enterprise-ready MCP server (Recommended)
2. Google Security Operations (Chronicle) - For threat detection, investigation, and hunting
3. Google Security Operations SOAR - For security orchestration, automation, and response
4. Google Threat Intelligence (GTI) - For access to Google’s threat intelligence data
5. Security Command Center (SCC) - For cloud security and risk management

For the new Remote MCP Server, please see the launch announcement and the setup guide.

Each server can be enabled and run separately, allowing flexibility for environments that don’t require all capabilities.

Documentation

Comprehensive documentation is available in the docs folder. You can:

1. Read the markdown files directly in the repository
2. View the documentation website at https://google.github.io/mcp-security/
3. Generate HTML documentation locally using Sphinx (see instructions in the docs folder)

The documentation covers:

• Detailed information about each MCP server
• Configuration options and requirements
• Usage examples and best practices

To get started with the documentation, see docs/index.md.

Authentication

The server uses Google’s authentication. Make sure you have either:

1. Set up Application Default Credentials (ADC)
2. Set a GOOGLE_APPLICATION_CREDENTIALS environment variable
3. Used gcloud auth application-default login

Standalone Usage

Each MCP server can be installed and used as a standalone package.

Installation

You can install the packages using uv tool install (recommended):

# Install packages
uv tool install google-secops-mcp
uv tool install gti-mcp
uv tool install scc-mcp
uv tool install secops-soar-mcp

Alternatively, you can use pip:

pip install google-secops-mcp
pip install gti-mcp
pip install scc-mcp
pip install secops-soar-mcp

Running Standalone

After installation, you can run the servers directly using uvx:

# Run SecOps MCP server
uvx --from google-secops-mcp secops_mcp

# Run GTI MCP server
uvx gti_mcp

# Run SCC MCP server
uvx scc_mcp

# Run SecOps SOAR MCP server (with optional integrations)
uvx secops_soar_mcp --integrations CSV,OKTA

With environment variables:

CHRONICLE_PROJECT_ID="your-project-id" \
CHRONICLE_CUSTOMER_ID="01234567-abcd-4321-1234-0123456789ab" \
CHRONICLE_REGION="us" \
uvx secops_mcp

Using with MCP Clients (Recommended)