Google Security MCP

Google's official collection of Model Context Protocol servers that expose Google's security products to MCP clients. Provides access to Google SecOps (Chronicle) for SIEM search and case management, Google Threat Intelligence for indicator and malware lookups, and Security Command Center for cloud posture and findings. Lets security agents investigate alerts, enrich indicators of compromise, and triage vulnerabilities directly from natural language.

{
  "mcpServers": {
    "google-mcp-security": {
      "command": "npx",
      "args": [],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "<YOUR_GOOGLE_APPLICATION_CREDENTIALS>"
      }
    }
  }
}

{
  "type": "object",
  "required": [
    "query"
  ],
  "properties": {
    "query": {
      "type": "string",
      "description": "UDM or natural-language search query for security events"
    },
    "time_range": {
      "type": "string",
      "description": "Time window to search over (e.g. last 24h)"
    }
  }
}

{
  "type": "object",
  "required": [
    "indicator"
  ],
  "properties": {
    "indicator": {
      "type": "string",
      "description": "The IOC to enrich (IP, domain, file hash, or URL)"
    }
  }
}

{
  "type": "object",
  "required": [
    "parent"
  ],
  "properties": {
    "parent": {
      "type": "string",
      "description": "Organization, folder, or project resource to query"
    },
    "severity": {
      "type": "string",
      "description": "Optional severity filter (e.g. HIGH, CRITICAL)"
    }
  }
}