# Google Security Operations MCP server

> Lets AI clients investigate threats, run SOAR actions, query Google Threat Intelligence, and audit cloud security findings in Google SecOps.

- Repository: https://github.com/google/mcp-security
- Page: https://hostedmcp.org/servers/google/mcp-security
- Official: yes
- Transport: —
- Stars: 544
- License: Apache-2.0

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `CHRONICLE_CUSTOMER_ID` | no | no |  |
| `CHRONICLE_PROJECT_ID` | no | no |  |
| `CHRONICLE_REGION` | no | no |  |
| `SOAR_APP_KEY` | no | no |  |
| `SOAR_URL` | no | no |  |
| `VT_APIKEY` | no | no |  |

## FAQ

### How do I authenticate the Google SecOps MCP server?

It uses Google authentication via Application Default Credentials, a GOOGLE_APPLICATION_CREDENTIALS variable, or gcloud auth application-default login. Some servers also need their own keys like VT_APIKEY or SOAR_APP_KEY.

### How do I install the Google SecOps MCP servers?

Install the standalone packages with uv tool install or pip, for example google-secops-mcp, gti-mcp, scc-mcp, and secops-soar-mcp. Then run them with uvx.

### Which clients work with these security MCP servers?

They work with Cline, Claude Desktop, Claude Code, Cursor, Gemini CLI, and other MCP-supported clients, plus Google ADK agents.

### What does the Google Threat Intelligence server require?

The GTI server needs a VirusTotal API key set in the VT_APIKEY environment variable. You configure it in the MCP client config's env block.

### Can I run a prebuilt autonomous SOC agent with these servers?

Yes, the repo includes an Autonomous SOC Agent built on Google ADK and MCP. Run it as an interactive CLI REPL or as a FastAPI service for Cloud Run.