ReadBeforeRunAgentic Security Field Guide

Catalog / MCP server

Google Security Operations MCP Server

Draft · awaiting review

MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration.

For Alert triage, Detection engineeringWorks with Any MCP client, Claude Code, Gemini CLI, CursorMaintained google, last push 2026-10-16

MCP serverAn MCP server is a program that gives your AI client extra tools; the client's model decides when to call them. by google · read from the code at ceb703a (secops-v0.7.1) on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Secrets. Without SECOPS_SA_PATH the client is created without explicit credentials and falls back to Application Default Credentials, the user's Google Cloud credential profile.

    server.py L74-75

  2. Persistence. One of 27 tools that change SecOps configuration or data with a direct SDK call and no confirmation step.

    curated_rules_management.py L701

  3. Approval. Unknown: no approval settings were found in the code, but the search patterns for approvals match several lines, so a zero cannot be written. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Use a dedicated service account with read-only SecOps roles through SECOPS_SA_PATH instead of personal Application Default Credentials, set project, customer and region explicitly because built-in fallback IDs apply otherwise, keep the service account limited to one instance because any call can name another project, and pin google-secops-mcp==0.7.1.

What we checked, and what we foundDisagree?

MCP server · code showsreach 3 · privileged
11032?FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Gives MCP clients access to Google Security Operations (Chronicle) for threat detection, investigation and hunting.
  • Performs security operations tasks in Chronicle, including natural-language event search.
  • Gets data into Chronicle through raw log and UDM event ingestion, custom parsers and feed configuration.
Use it when
Not for

Nothing excluded by the author in the files read

You need
  • A Google Security Operations (Chronicle) instance, identified by Google Cloud project ID, Chronicle customer ID and region
  • Google Cloud Application Default Credentials by default, set up with gcloud auth application-default login
  • Optionally a service account JSON key file, whose path is read from SECOPS_SA_PATH

+5 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

uvx --from google-secops-mcp secops_mcp
Quoted from README.md#L69 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code, not tested in the lab; use a dedicated service account with read-only SecOps roles through SECOPS_SA_PATH instead of personal Application Default Credentials, set project, customer and region explicitly because built-in fallback IDs apply otherwise, keep the service account limited to one instance because any call can name another project, and pin google-secops-mcp==0.7.1

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit ceb703a on 2026-10-25: 57 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, deletes, according to the capabilities read.

GroupWhat it coversEffectOn by default
Data Table Management ToolsCreates data tables for use in detection rules, adds and lists rows, and deletes rows by ID. data_table_management.py L459reads, changes, deletesyes
Feed Management ToolsLists, reads, creates, updates, enables, disables and deletes ingestion feeds and generates new feed authentication secrets. feed_management.py L500reads, changes, deletesyes
Watchlist Management ToolsCreates, updates, reads, lists and deletes watchlists that apply risk score multipliers to entities. watchlist_management.py L302reads, changes, deletesyes
Security ToolsSearches events (natural language or UDM), alerts, entities, IoC matches and rules; asks Gemini; runs retrohunts; creates rules and updates alert status and verdict. security_alerts.py L285reads, changesyes
Log Ingestion ToolsIngests raw logs (single or batch) and pre-formatted UDM events into Chronicle and lists the log types available for ingestion. log_ingestion.py L127reads, changesyes
Parser Management ToolsCreates, lists, reads, activates and deactivates log parsers and tests parser code against sample logs. parser_management.py L121reads, changesyes
Reference List Management ToolsCreates, reads and updates reference lists (STRING, CIDR or REGEX) used in detection rules; supplied entries replace the existing ones. reference_list_management.py L324-333reads, changesyes
Curated Rules Management ToolsLists and reads Google-curated rules, rule sets and detections, and changes rule-set deployment (enabled, precision, alerting). curated_rules_management.py L701reads, changesyes
Rule Exclusions Management ToolsCreates, reads, lists and patches rule exclusions, changes their deployment and computes how many events they excluded. rule_exclusions.py L113reads, changesyes
Investigation Management ToolsLists and reads investigations, triggers a new investigation for an alert and fetches investigations linked to alerts or cases. investigation_management.py L231reads, changesyes

Where it sends data and who can connect to it

3 outside connections found in the files read: Google SecOps Chronicle API, Gemini in Chronicle, Chronicle natural-language translation.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

A Python FastMCP server that the MCP client starts and talks to over stdio; each tool call builds a SecOpsClient from the secops SDK, which calls the Chronicle API in Google Cloud. server.py L94

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 1README.md L392-393 the author lets the server read a service-account key file from a path the user sets
  • Network · 1README.md L3-4 the author names Google Security Operations as the only service the server talks to
  • Secrets · 3README.md L383-387 the author makes Google Cloud Application Default Credentials the default, which is the user's cloud credential profile outside the working directory
  • Persistence · 2README.md L222-228 the author lists tools that create, update, enable, disable and delete feeds, parsers, data tables, reference lists, rule exclusions and watchlists
  • Approval · 1README.md L333-340 the documented pip client configuration pre-approves three read tools

Code shows: the evidence

  • Files · 1server.py L71-73 the server passes a key-file path from SECOPS_SA_PATH to the SDK, which reads it from any location, and writes no local files
  • Network · 1server.py L77-79 all tools reach the network only through the SecOps SDK client for the configured or per-call project, customer and region, and the server runs over stdio only
  • Execution · 0none found: patterns exec-v0.1 in 24 files at ceb703a
  • Secrets · 3server.py L74-75 without SECOPS_SA_PATH the client is created without explicit credentials and falls back to Application Default Credentials, the user's Google Cloud credential profile
  • Persistence · 2curated_rules_management.py L701 one of 27 tools that change SecOps configuration or data with a direct SDK call and no confirmation step
  • Approval · ?no evidence: no approval settings were found in the code, but the search patterns for approvals match several lines, so a zero cannot be written

Valid for commit ceb703a (secops-v0.7.1) · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientAny MCP client, Claude Code, Gemini CLI, Cursor; sign-in: OAuth 2
AccountA Google Security Operations (Chronicle) instance, identified by Google Cloud project ID, Chronicle customer ID and region. README.md L360-362
CredentialsGoogle Cloud Application Default Credentials by default, set up with gcloud auth application-default login. README.md L381-387
CredentialsOptionally a service account JSON key file, whose path is read from SECOPS_SA_PATH. server.py L71-73
RuntimePython 3.11 or later. pyproject.toml L6
Other toolsuv (recommended by the author) or pip to install and run the package. README.md L282
Other toolsThe gcloud CLI to create Application Default Credentials. README.md L387
AuthorisationChronicle API access for the identity in use, listed as a requirement for the integration tests. README.md L9
SettingCHRONICLE_PROJECT_ID, CHRONICLE_CUSTOMER_ID, CHRONICLE_REGION and SECOPS_SA_PATH are passed through the env block of the MCP client configuration. README.md L296-301

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Source
github.com/google/mcp-security · server/secops · Apache-2.0 · manifest pyproject.toml
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
ceb703a · secops-v0.7.1 · last upstream push 2026-10-16 · no release since the pinned commit (current secops-v0.7.1)
In the catalog
listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit ceb703a, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit ceb703a on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (57 of 57), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Google Security Operations MCP Server". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/google-secops-mcp/

The method · the rules

For maintainers

Badge for your README (reach 3 · not run yet):

[![reach 3 · not run yet](https://readbeforerun.ai/badge/google-secops-mcp.svg)](https://readbeforerun.ai/catalog/google-secops-mcp/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Alert triage, Detection engineering. The task pages compare every tool side by side.
  1. 23112?
    CrowdStrike Falcon MCP ServerMCP server · by CrowdStrike · reach 3, privilegedDraft · awaiting review

    MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

    Can tunnel or exfiltrate · write outside the project · change config or install globally · Approval: no evidence · ran once, 2026-11-07: did more than it said · checked 2026-11-07

    Code shows
  2. 23122?
    GitGuardian MCP ServerMCP server · by GitGuardian · reach 3, privilegedDraft · awaiting review

    MCP server that brings GitGuardian secret detection, incident triage and honeytokens into an AI agent.

    Can tunnel or exfiltrate · write outside the project · read broad tokens or the environment · +1 more · Approval: no evidence · ran once, 2026-11-07: did no more than it said · checked 2026-11-07

    Code shows
  3. 13023?
    Purple AI MCP ServerMCP server · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory.

    Can tunnel or exfiltrate · add autostart, users or keys · read broad tokens or the environment · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  4. 21122?
    SentinelOne MCP Server (s1-secops-mcp)MCP server · by Sentinel-One · reach ≥2, openDraft · awaiting review

    Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default.

    Can write outside the project · read broad tokens or the environment · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  5. 23223?
    SentinelOne AI Analyst: Claude SkillsPlugin · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.

    Can tunnel or exfiltrate · add autostart, users or keys · write outside the project · +2 more · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  6. 102?00
    Malware AnalystSkill · by tomabai · reach ≥2, openDraft · awaiting review

    Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.

    Can run shell commands or eval · Secrets: no evidence · not run yet · checked 2026-10-21

    Code shows