This is a personal project.
Chronicle SecOps MCP Server
This is an MCP (Model Context Protocol) server for interacting with Google’s Chronicle Security Operations suite. MCP Info
Installing in Claude Desktop
To use this MCP server with Claude Desktop:
Install Claude Desktop
Open Claude Desktop and select “Settings” from the Claude menu
Click on “Developer” in the lefthand bar, then click “Edit Config”
Update your
claude_desktop_config.json
with the following configuration (replace paths with your actual paths):
{
"mcpServers": {
"secops-mcp": {
"command": "/path/to/your/uv",
"args": [
"--directory",
"/path/to/your/mcp-secops-v3",
"run",
"secops_mcp.py"
],
"env": {
"CHRONICLE_PROJECT_ID": "your-google-cloud-project-id",
"CHRONICLE_CUSTOMER_ID": "your-chronicle-customer-id",
"CHRONICLE_REGION": "us"
}
}
}
}
Make sure to update:
- The path to
uv
(usewhich uv
to find it) - The directory path to where this repository is cloned
- Your Chronicle credentials (project ID, customer ID, and region)
- The path to
Save the file and restart Claude Desktop
You should now see the hammer icon in the Claude Desktop interface, indicating the MCP server is active
Features
Security Tools
search_security_events
: Search for security events in Chronicle with customizable queriesget_security_alerts
: Get security alerts from Chroniclelookup_entity
: Look up information about an entity (IP, domain, hash)list_security_rules
: List security detection rules from Chronicleget_ioc_matches
: Get Indicators of Compromise (IoCs) matches from Chronicle
Installation
Installing via Smithery
To install mcp-secops-v3 for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install @emeryray2002/mcp-secops-v3 --client claude
Manual Installation
- Install the package:
pip install -e .
- Set up your environment variables:
export CHRONICLE_PROJECT_ID="your-google-cloud-project-id"
export CHRONICLE_CUSTOMER_ID="your-chronicle-customer-id"
export CHRONICLE_REGION="us" # or your region
Requirements
- Python 3.11+
- A Google Cloud account with Chronicle Security Operations enabled
- Proper authentication configured
Usage
Running the MCP Server
python main.py
API Capabilities
The MCP server provides the following capabilities:
- Search Security Events: Search for security events in Chronicle
- Get Security Alerts: Retrieve security alerts
- Lookup Entity: Look up entity information (IP, domain, hash, etc.)
- List Security Rules: List detection rules
- Get IoC Matches: Get Indicators of Compromise matches
Example
See example.py
for a complete example of using the MCP server.
Authentication
The server uses Google’s authentication. Make sure you have either:
- Set up Application Default Credentials (ADC)
- Set a GOOGLE_APPLICATION_CREDENTIALS environment variable
- Used
gcloud auth application-default login
License
Apache 2.0
Development
The project is structured as follows:
secops_mcp.py
: Main MCP server implementationexample.py
: Example usage of the MCP server
Chronicle SecOps
Project Details
- emeryray2002/mcp-secops-v3
- Apache License 2.0
- Last Updated: 4/19/2025
Categories
Recomended MCP Servers
Contentful MCP Server for Delivery API
An MCP server for Astra DB workloads
A Model Context Protocol server for retrieving and analyzing issues from Sentry.io
AniList MCP server for accessing anime and manga data
BloodHound-MCP-AI is integration that connects BloodHound with AI through Model Context Protocol, allowing security professionals to analyze Active...
MCP Server to make line-based edits to a file.
An implementation of Giphy integration with Model Context Protocol

High-performance CCXT MCP server for cryptocurrency exchange integration
Cloudflare MCP server for IDE ( Cline, Windsurf, Cursor, etc )