Plenty of security integrations let a model read alerts. This one lets it write the rule, validate it, generate synthetic events to test it against and check what coverage it adds — which is the slow, skilled part of running a SIEM. Two things to settle before deploying it: the managed server is the maintained path and needs the SOAR API migration before case tools work, and the local servers each want their own credential, so scope them separately rather than handing one identity everything.
Google's repository of MCP servers for its security stack. There are four local servers — Chronicle SecOps, SecOps SOAR, Google Threat Intelligence and Security Command Center — and, for SecOps, a fully managed remote server that Google now recommends over running the Python ones yourself.
- Hunt across your telemetry — udm_search runs UDM queries, translate_udm_query turns a description into one, and summarize_entity pulls together what is known about an IP, domain or file
- Detection engineering end to end — create_rule, test_rule, validate_rule, list_rules, get_rule, list_rule_detections and list_rule_errors, with evaluate_rule_coverage and generate_threat_detection_opportunity to find the gaps
- Parsers and ingestion — create_parser, run_parser, activate_parser, list_log_types and import_logs, plus generate_synthetic_events for testing a rule without waiting for real traffic
- Reference lists and data tables that rules read from — get_reference_list, update_reference_list, list_data_tables, add_rows_to_data_table and delete_data_table_row
- Case work in SOAR — list_cases, get_case, update_case, list_case_alerts, get_case_alert, update_case_alert, create_case_comment and execute_bulk_close_case
- Response actions — list_integrations, list_integration_actions, execute_manual_action, list_playbooks and trigger_investigation, with the SOAR server taking an --integrations flag so you register only the ones you use
- Threat intelligence on indicators, malware families and threat actors through the GTI server, and cloud posture and vulnerabilities through the SCC server
- Documented SOAR integrations for third-party products, including Okta, Rapid7 InsightIDR and InsightVM, Symantec Endpoint Protection, Ivanti Endpoint Manager, F5 BIG-IP, DomainTools and MXToolBox
Google Cloud credentials — either Application Default Credentials or GOOGLE_APPLICATION_CREDENTIALS pointing at a service account. The managed SecOps server needs the MCP service enabled on your project and the caller holding roles/mcp.toolUser, and every request must carry your customer id, region and project id, so those belong in the client's context file. Running the local servers instead means uv or pip and per-server configuration: CHRONICLE_PROJECT_ID, CHRONICLE_CUSTOMER_ID and CHRONICLE_REGION for SecOps; SOAR_URL and SOAR_APP_KEY for SOAR; VT_APIKEY for threat intelligence. On the managed server the SIEM tools work immediately, but SOAR tools require migrating to the Chronicle API first. Apache 2.0 licensed.
One command plus a key — uvx --from google-secops-mcp secops_mcp, then supply credentials