Google Security MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

The official Google security MCP collection can change as hosted SecOps, threat-intelligence, and local-server integrations evolve; a follow-up can verify product coverage and authentication boundaries.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

SOC and security agents using Google SecOps, GTI, SCC and SOAR.

What we know

Google-maintained suite of standalone/hosted security MCPs covering Chronicle/SecOps, Threat Intelligence, Security Command Center and SOAR.

Maintenance / activity evidence

Observed Sep 8, 2026 (UTC)Merge pull request 303 from google/refactor/run-with-adk-v2

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Google product entitlements/scopes. Reported action classes: SOAR response actions; Case/incident mutations depending on component. Complete write authority is not verified.
Product-specific IAM/API credentials.
Sensitive access: Security telemetry, Incident/case data, Threat intel, Response credentials

Some components are read-heavy, but SOAR can execute real response actions; treat per-component permissions separately.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

529 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

Which Google security products and authentication paths are supported by the current MCP server collection?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Some components are read-heavy, but SOAR can execute real response actions; treat per-component permissions separately.
Google product entitlements/scopes.
Product-specific IAM/API credentials.
Security telemetry, cases, findings and response data pass through connected products.
Reviewed write actions: SOAR response actions; Case/incident mutations depending on component
Sensitive access: Security telemetry, Incident/case data, Threat intel, Response credentials
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Complete per-server mutation inventory
It is a multi-server suite with different credentials/tool sets.
Exact write surface varies by component.
Hosted and local modes have different IAM/auth requirements.

Original activity observations

2026-09-08T06:15:48Z: Merge pull request 303 from google/refactor/run-with-adk-v2

Technical identity

github.com/google/mcp-security

Exact implementation source: https://github.com/google/mcp-security ↗
Reviewed resource type: MCP Server
Repository identity: google/mcp-security
Service endpoint: Google hosted SecOps MCP where enabled

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
google/mcp-security
Recorded repository material and project history.
Evidence source ↗
google.github.io/mcp-security/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Warning

Credential scopes depend on server; cannot use one generic config across all four.
Configuration taken from one publisher-documented server variant, with example credentials replaced by placeholders. Replace the supplied illustrative path/credential placeholders with your own settings.
The displayed configuration is ONLY the Google SecOps variant from the publisher's four-server example.
Do not copy sample keys or configure all four products automatically.
no production security actions during setup.
Do not interfere with operational security monitoring.
Exact vendor-specific credential revoke procedure not established from checked official Setup documentation; may be external or not applicable. Do not invent.
Configuration taken from one publisher-documented server variant, with example credentials replaced by placeholders. Replace the supplied credential/path placeholders privately; use only the named configuration schema.
MCP100 client-scope note: this Claude Code CLI example applies only to that client and the exact registered name in the command. Desktop, Cursor and other clients use their own configuration; do not run it for a differently named entry.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
publisher documented install or connect · Publisher instructions · Review before use
```
git clone https://github.com/google/mcp-security.git
cd mcp-security
```
Configure / authenticate
Publisher instructions
Google MCP Security is a collection of SEPARATE security MCP servers. Choose a specific server from Google usage guide, configure Google Application Default Credentials or GOOGLE_APPLICATION_CREDENTIALS, and use uv.
Advanced configuration · claude desktop json · Publisher instructions
claude desktop json · Publisher instructions
{ "mcpServers": { "secops": { "args": [ "--from", "google-secops-mcp", "secops_mcp" ], "command": "uvx", "env": { "CHRONICLE_CUSTOMER_ID": "YOUR_CUSTOMER_ID", "CHRONICLE_PROJECT_ID": "YOUR_PROJECT_ID", "CHRONICLE_REGION": "YOUR_REGION" } } } }
Check connection
Suggested check
Check Google authentication (`gcloud auth application-default login` only when login is needed) and read-only tools for the selected service; no one universal test covers all servers.
Remove / uninstall / revoke
MCP100 setup guide
Remove the exact selected Google Security MCP entry from your MCP client. Do not revoke shared Google ADC used by other apps without intent.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove secops

Official Documentation & Sources

What it does

Google-maintained suite of standalone/hosted security MCPs covering Chronicle/SecOps, Threat Intelligence, Security Command Center and SOAR.

Capability: Security & Testing
Resource type: MCP Server
Industry: Cybersecurity
Best fit: SOC and security agents using Google SecOps, GTI, SCC and SOAR.

Representative uses

Investigate detections/cases
Query threat intelligence
Inspect SCC findings
Run SOAR security-response integrations

Limitations

It is a multi-server suite with different credentials/tool sets.
Exact write surface varies by component.
Hosted and local modes have different IAM/auth requirements.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Product-specific IAM/API credentials.
Permissions: Google product entitlements/scopes.
Data handling: Security telemetry, cases, findings and response data pass through connected products.
Cost: unknown
Risk and cautions: Some components are read-heavy, but SOAR can execute real response actions; treat per-component permissions separately.

Access scope and cautions

Write actions: Not verified SOAR response actions Case/incident mutations depending on component
Sensitive access: Security telemetry Incident/case data Threat intel Response credentials
Risk level: high

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Investigate detections/cases; Query threat intelligence; Inspect SCC findings; Run SOAR security-response integrations.

What authentication is documented?

Google ADC/IAM, service credentials, VT/SOAR keys by component.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: SOAR response actions; Case/incident mutations depending on component. Recorded permission context: Google product entitlements/scopes.

What data-handling boundary should I consider?

Security telemetry, cases, findings and response data pass through connected products. Recorded sensitive-access context: Security telemetry; Incident/case data; Threat intel; Response credentials.

What limitations and risks should I check before use?

Some components are read-heavy, but SOAR can execute real response actions; treat per-component permissions separately. It is a multi-server suite with different credentials/tool sets. Exact write surface varies by component. Hosted and local modes have different IAM/auth requirements. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

Google is listed as First-party MCP in MCP100’s current evidence.