Google's security stack gets an MCP chat interface

What it does This repository is a set of Model Context Protocol servers that plug Google’s security products into AI assistants. Each server is a separate Python package covering Chronicle threat detection, SOAR automation, Google Threat Intelligence, and Security Command Center, plus a fully managed remote option for enterprises. Any MCP-compatible client—Claude Desktop, Cline, Cursor, Gemini CLI, or Google’s own ADK—can query them.

The interesting bit Google is treating the SOC console as a chat interface. Instead of clicking through dashboards or hand-writing YARA-L, analysts can ask an LLM to triage incidents, hunt threats, and pull intelligence. The Gemini CLI extension even ships with purpose-built skills named Triage, Investigate, and Hunt, suggesting conversational security ops is a first-class citizen, not an afterthought.

Key highlights

• Four standalone installable packages (google-secops-mcp, gti-mcp, scc-mcp, secops-soar-mcp) and a managed remote server for enterprises
• Plugs into Claude Desktop, Cline, Cursor, VS Code, Gemini CLI, and Google ADK agents
• Gemini CLI extension adds specialized skills: Triage, Investigate, and Hunt
• Authenticates through standard Google Cloud mechanisms (ADC or gcloud)
• Includes a prebuilt Google ADK agent and Cloud Run deployment path

Caveats

• Requires active Google SecOps, Chronicle, SCC, or GTI accounts with correct project and region configuration; this is integration plumbing, not a standalone security product
• The README dedicates most of its length to JSON config locations across five OS/client combinations, which hints at real setup friction
• Windows path tables and symlink tips suggest keeping multiple MCP clients in sync is currently a manual affair

Verdict A fit for SOC teams already paying for Google’s security suite who want LLM-assisted hunting and triage. Skip it if you lack Chronicle or SCC licenses—there is nothing here to secure on its own.