# Google Security Operations MCP Server

> Draft · awaiting review.

> MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration.

- Badge: `reach 3 · not run yet`
- Type: MCP server; tier: not run yet
- Tasks: Alert triage, Detection engineering; mission: Defensive; works with: Any MCP client, Claude Code, Gemini CLI, Cursor
- Source: https://github.com/google/mcp-security (server/secops), pinned to `ceb703a` (secops-v0.7.1), licence Apache-2.0
- Last checked: 2026-10-21; next check: 2027-01-19; method v0.1, reach-v0.1

## At a glance

- **What it is:** An MCP server that connects MCP clients to Google's Chronicle Security Operations suite, with tools for event search, alerts, detection rules, log ingestion and SIEM configuration. An MCP server is a program that gives your AI client extra tools; the client's model decides when to call them.
- **Made for:** Gives MCP clients access to Google Security Operations (Chronicle) for threat detection, investigation and hunting. +2 more
- **Runs:** On your machine, started by your AI client. Other modes: standalone (on your machine, started by you).
- **Sends data to:** Google SecOps Chronicle API (always), Gemini in Chronicle (if you turn it on), Chronicle natural-language translation (if you turn it on). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, according to the capabilities read.
- **Needs:** A Google Security Operations (Chronicle) instance, identified by Google Cloud project ID, Chronicle customer ID and region · Google Cloud Application Default Credentials by default, set up with gcloud auth application-default login · Optionally a service account JSON key file, whose path is read from SECOPS_SA_PATH · +5 more

Profile read at commit `ceb703a` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

An MCP server that connects MCP clients to Google's Chronicle Security Operations suite, with tools for event search, alerts, detection rules, log ingestion and SIEM configuration. (server/secops/README.md#L3-4)

Made for (the author says):

- Gives MCP clients access to Google Security Operations (Chronicle) for threat detection, investigation and hunting. (README.md#L6)
- Performs security operations tasks in Chronicle, including natural-language event search. (server/secops/secops_mcp/server.py#L16-17)
- Gets data into Chronicle through raw log and UDM event ingestion, custom parsers and feed configuration. (server/secops/README.md#L253-259)

Documented uses:

- Retrieve and monitor security alerts from Chronicle. [Alert triage] (server/secops/README.md#L241)
- Run detection rules against historical data as retrohunts and track their results. [Detection engineering] (server/secops/README.md#L244)
- Look up IPs, domains, hashes and other indicators against Chronicle log history. [Threat intel enrichment] (server/secops/README.md#L242)
- Create and deploy rule exclusions to filter false positives and tune detection rules. [Detection engineering] (server/secops/README.md#L248)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Security Tools | Searches events (natural language or UDM), alerts, entities, IoC matches and rules; asks Gemini; runs retrohunts; creates rules and updates alert status and verdict. (server/secops/secops_mcp/tools/security_alerts.py#L285) | reads, changes | yes |
| Log Ingestion Tools | Ingests raw logs (single or batch) and pre-formatted UDM events into Chronicle and lists the log types available for ingestion. (server/secops/secops_mcp/tools/log_ingestion.py#L127) | reads, changes | yes |
| Parser Management Tools | Creates, lists, reads, activates and deactivates log parsers and tests parser code against sample logs. (server/secops/secops_mcp/tools/parser_management.py#L121) | reads, changes | yes |
| Data Table Management Tools | Creates data tables for use in detection rules, adds and lists rows, and deletes rows by ID. (server/secops/secops_mcp/tools/data_table_management.py#L459) | reads, changes, deletes | yes |
| Reference List Management Tools | Creates, reads and updates reference lists (STRING, CIDR or REGEX) used in detection rules; supplied entries replace the existing ones. (server/secops/secops_mcp/tools/reference_list_management.py#L324-333) | reads, changes | yes |
| Feed Management Tools | Lists, reads, creates, updates, enables, disables and deletes ingestion feeds and generates new feed authentication secrets. (server/secops/secops_mcp/tools/feed_management.py#L500) | reads, changes, deletes | yes |
| Curated Rules Management Tools | Lists and reads Google-curated rules, rule sets and detections, and changes rule-set deployment (enabled, precision, alerting). (server/secops/secops_mcp/tools/curated_rules_management.py#L701) | reads, changes | yes |
| Rule Exclusions Management Tools | Creates, reads, lists and patches rule exclusions, changes their deployment and computes how many events they excluded. (server/secops/secops_mcp/tools/rule_exclusions.py#L113) | reads, changes | yes |
| Watchlist Management Tools | Creates, updates, reads, lists and deletes watchlists that apply risk score multipliers to entities. (server/secops/secops_mcp/tools/watchlist_management.py#L302) | reads, changes, deletes | yes |
| Investigation Management Tools | Lists and reads investigations, triggers a new investigation for an alert and fetches investigations linked to alerts or cases. (server/secops/secops_mcp/tools/investigation_management.py#L231) | reads, changes | yes |

## How it runs

A Python FastMCP server that the MCP client starts and talks to over stdio; each tool call builds a SecOpsClient from the secops SDK, which calls the Chronicle API in Google Cloud. (server/secops/secops_mcp/server.py#L94)

- Starts: On your machine, started by your AI client. The MCP client starts the server as a local process (uv, uvx or a bash/pip command) and talks to it over stdio. (README.md#L165)
- Can also run: On your machine, started by you (standalone, switch `uvx --from google-secops-mcp secops_mcp`). After installation the package can be started directly with uvx --from google-secops-mcp secops_mcp. (README.md#L65-69)
- Your AI client: **MCP client configuration**: mcpServers entry in the client settings that starts the server and passes CHRONICLE_* and SECOPS_SA_PATH environment variables. (server/secops/README.md#L278)
- Your machine: **secops_mcp server**: Python FastMCP process that registers the SecOps tools and serves them over stdio. (server/secops/secops_mcp/server.py#L28)
- Your machine: **secops SDK (SecOpsClient)**: Python library the tools call to reach the Chronicle API. (server/secops/secops_mcp/server.py#L25)
- Your machine: **Google Cloud credentials**: Application Default Credentials from gcloud, or a service account JSON key file named by SECOPS_SA_PATH. (server/secops/README.md#L392-393)
- Outside your machine: **Chronicle API (Google SecOps)**: Google-hosted SIEM instance, selected by project ID, customer ID and region, that runs every search and change the tools request. (server/secops/secops_mcp/server.py#L77-78)
- Outside your machine: **Gemini in Chronicle**: Model inside SecOps that answers threat intelligence questions sent by get_threat_intel. (server/secops/secops_mcp/tools/threat_intel.py#L33)
- Sends data to Google SecOps Chronicle API (vendor API, always): Sends queries, rule text, log data and configuration changes to the Chronicle instance and receives events, alerts and settings. (server/secops/secops_mcp/server.py#L77-79)
- Sends data to Gemini in Chronicle (vendor API, if you turn it on): get_threat_intel sends the question text to Chronicle's integrated Gemini model and returns its answer. (server/secops/secops_mcp/tools/threat_intel.py#L78)
- Sends data to Chronicle natural-language translation (vendor API, if you turn it on): search_security_events sends the natural-language query text to Chronicle to translate it into a UDM query. (server/secops/secops_mcp/tools/security_events.py#L137)

## What you need

- Account: A Google Security Operations (Chronicle) instance, identified by Google Cloud project ID, Chronicle customer ID and region. (server/secops/README.md#L360-362)
- Credentials: Google Cloud Application Default Credentials by default, set up with gcloud auth application-default login. (server/secops/README.md#L381-387)
- Credentials: Optionally a service account JSON key file, whose path is read from SECOPS_SA_PATH. (server/secops/secops_mcp/server.py#L71-73)
- Runtime: Python 3.11 or later. (server/secops/pyproject.toml#L6)
- Other tools: uv (recommended by the author) or pip to install and run the package. (server/secops/README.md#L282)
- Other tools: The gcloud CLI to create Application Default Credentials. (server/secops/README.md#L387)
- Authorisation: Chronicle API access for the identity in use, listed as a requirement for the integration tests. (server/secops/tests/README.md#L9)
- Setting: CHRONICLE_PROJECT_ID, CHRONICLE_CUSTOMER_ID, CHRONICLE_REGION and SECOPS_SA_PATH are passed through the env block of the MCP client configuration. (server/secops/README.md#L296-301)
- Installer: The repository README installs the google-secops-mcp package with uv tool install and no version pin. (README.md#L44-48)
- Installer: The pip client configuration runs /bin/bash -c to install the cloned repository in editable mode with pip install -e . every time the client starts the server. (server/secops/README.md#L321-324)
- Installer: The uv client configuration runs server.py with uv run from a local clone of the repository and loads variables from an env file given with --env-file. (server/secops/README.md#L288-294)
- Installer: The package declares its dependencies with minimum versions only, for example secops>=0.35.1 and mcp[cli]>=1.26.0,<2.0, so an install picks the newest matching versions. (server/secops/pyproject.toml#L16-23)

## Limits and risks

- If CHRONICLE_PROJECT_ID or CHRONICLE_CUSTOMER_ID is unset, the server falls back to a hard-coded project number and customer ID instead of stopping with an error. (server/secops/secops_mcp/server.py#L38-41)
- Every tool accepts project_id, customer_id and region arguments that override the configured Chronicle instance for that call. (server/secops/secops_mcp/server.py#L60-63)
- Without SECOPS_SA_PATH the server creates SecOpsClient() with no explicit credentials, so tools act with whatever default Google credentials the environment provides. (server/secops/secops_mcp/server.py#L74-75)
- delete_feed permanently removes a feed and stops its data ingestion; the author states this cannot be undone. (server/secops/secops_mcp/tools/feed_management.py#L457-460)
- When the API returns it, generate_feed_secret adds the newly generated feed secret to the tool result, so the value reaches the MCP client and its model. (server/secops/secops_mcp/tools/feed_management.py#L567-569)
- The server README's pip configuration lists get_ioc_matches, search_security_events and get_security_alerts under autoApprove and get_ioc_matches under alwaysAllow. (server/secops/README.md#L333-339)
- Tool descriptions suggest follow-up write actions to the model, such as updating alert status with do_update_security_alert after an investigation. (server/secops/secops_mcp/tools/investigation_management.py#L217-218)
- The repository README lists Google's fully managed Remote MCP Server for SecOps as the recommended option ahead of this local server. (README.md#L5)
- do_update_security_alert changes an alert's status, priority, severity and verdict, and an empty string clears existing comments or root cause. (server/secops/secops_mcp/tools/security_alerts.py#L234-239)
- The search_security_events description tells the model to use findings for response actions such as blocking an IP or isolating a host through SOAR or endpoint MCP tools. (server/secops/secops_mcp/tools/security_events.py#L91)
- ingest_udm_events writes caller-supplied UDM events into Chronicle, and its description names creating synthetic events for testing detection rules or filling data gaps. (server/secops/secops_mcp/tools/log_ingestion.py#L163)
- generate_feed_secret replaces any existing authentication secret of the feed. (server/secops/secops_mcp/tools/feed_management.py#L520-521)
- delete_feed passes the feed ID straight to the Chronicle delete call after building the client; the tool has no confirmation parameter or step in code. (server/secops/secops_mcp/tools/feed_management.py#L495-500)
- generate_feed_secret creates a new secret for an HTTPS push feed, and its description states that this replaces any existing secret. (server/secops/secops_mcp/tools/feed_management.py#L520-521)

## Rights in plain language

- Declared: files 1 (reads outside the project), network 1 (talks only to declared hosts), secrets 3 (reads credential stores), persistence 2 (changes config or installs globally), approval 1 (has narrow pre-approvals).
- Code: reach 3 (privileged): secrets 3 (reads credential stores), persistence 2 (changes config or installs globally); unknown: approval.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 3 (privileged).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 1 reads outside the project | 1 reads outside the project | not run yet |
| Network: whom does it talk to? | 1 talks only to declared hosts | 1 talks only to declared hosts | not run yet |
| Execution: what does it run? | not declared | 0 runs no programs | not run yet |
| Secrets: which credentials does it touch? | 3 reads credential stores | 3 reads credential stores | not run yet |
| Persistence: what survives the run? | 2 changes config or installs globally | 2 changes config or installs globally | not run yet |
| Approval: does it ask before acting? | 1 has narrow pre-approvals | ? unknown | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L69` at the pinned commit (not a command to copy): `uvx --from google-secops-mcp secops_mcp`


### Run it with least privilege

- note: `derived from the code, not tested in the lab; use a dedicated service account with read-only SecOps roles through SECOPS_SA_PATH instead of personal Application Default Credentials, set project, customer and region explicitly because built-in fallback IDs apply otherwise, keep the service account limited to one instance because any call can name another project, and pin google-secops-mcp==0.7.1`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Google Security Operations MCP Server declare?**

files 1 (reads outside the project), network 1 (talks only to declared hosts), secrets 3 (reads credential stores), persistence 2 (changes config or installs globally), approval 1 (has narrow pre-approvals).

**What does its code suggest?**

reach 3 (privileged): secrets 3 (reads credential stores), persistence 2 (changes config or installs globally); unknown: approval.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-16; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code, not tested in the lab; use a dedicated service account with read-only SecOps roles through SECOPS_SA_PATH instead of personal Application Default Credentials, set project, customer and region explicitly because built-in fallback IDs apply otherwise, keep the service account limited to one instance because any call can name another project, and pin google-secops-mcp==0.7.1

Method: https://readbeforerun.ai/method/