🛡️ MCP Boss — Autonomous Security Operations Server

91 tools. One endpoint. Talk to your entire Google security stack in plain English.

MCP Boss gives any AI model (Gemini, Claude, GPT) full access to SecOps, SCC, GTI, Cloud Logging, SOAR, BigQuery, IAM, and cross-platform containment — through the Model Context Protocol.

Quick Start

One-line install:

curl -sL https://raw.githubusercontent.com/dadohen/MCP-Boss/main/setup.sh | bash -s -- \
  --project your-project-id \
  --customer your-secops-customer-id \
  --gti-key your-vt-api-key

Or deploy from Google Cloud Shell:

After Cloud Shell opens, run in the terminal:

chmod +x setup.sh && ./setup.sh

The wizard will walk you through project ID, customer ID, and deploy everything.

Or step by step:

git clone https://github.com/dadohen/MCP-Boss.git
cd MCP-Boss && ./setup.sh

The setup wizard handles everything: APIs, service account, IAM roles, container build, Cloud Run deploy, and verification.

What It Does

You ask a question → Gemini picks the right tools → executes them → chains results across multiple sources → gives you a report. No clicking through UIs, no writing API calls, no switching consoles.

Example: "Hunt for APT28 across all sources" →

Looks up APT28 threat intel via GTI/VirusTotal
Searches your SIEM for matching IOCs
Checks SCC for exploitable vulnerabilities matching their TTPs
Correlates findings across all sources
Produces an executive summary with recommended actions

All automatic, up to 20 chained tool calls in a single request.

Benchmark

First benchmark run on a live Cloud Run deployment (2026-04-22, gemini-2.5-flash, 6 scenarios):

Metric	Value
correct_verdict_pct	83.3% (5/6 scenarios)
correct_containment_pct	13.9%
destructive_fp_rate_pct	0.0%
median_alert_to_containment_s	60.87

Full scorecard, scenarios, and raw tool traces live under eval_harness/ (scorecard-2026-04-22.md, results.json). Rerun any time with ./eval_harness/run.sh. Nobody else in this category publishes these numbers credibly; that is the point.

Architecture

┌──────────────────────────────────────────────────────────────┐
│                     USER INTERFACES                          │
│   Web UI  ·  Gemini CLI  ·  Claude Desktop  ·  Mobile App   │
└──────────────────────┬───────────────────────────────────────┘
                       │
          ┌────────────┴────────────┐
          │ /api/chat (Web UI)      │  ← Multi-turn orchestration
          │ /mcp     (Gemini CLI)   │  ← Streamable HTTP
          │ /sse     (Claude/MCP)   │  ← SSE transport
          └────────────┬────────────┘
                       │
┌──────────────────────▼───────────────────────────────────────┐
│              MCP Boss Server (Cloud Run)                      │
│              89 Tools · Python · FastMCP · Serverless         │
│                                                              │
│  🔍 Discovery    🧠 Intel       🛡️ Detection    📂 SOAR     │
│  ├─ SCC          ├─ GTI/VT      ├─ YARA-L       ├─ Cases    │
│  ├─ Cloud Log    ├─ Malware     ├─ Rules         ├─ Playbooks│
│  ├─ UDM Search   ├─ Actors      ├─ Alerts        ├─ Actions  │
│  ├─ Ingestion    └─ Vertex AI   └─ Data Tables   └─ Metrics  │
│                                                              │
│  📧 Containment  ☁️ Cloud        📊 Analytics                │
│  ├─ O365 Purge   ├─ AWS Keys    ├─ BigQuery                 │
│  ├─ Okta         ├─ GCP SA      ├─ MTTx Metrics             │
│  ├─ Azure AD     ├─ STS Revoke  ├─ Audit Logs               │
│  └─ CrowdStrike  └─ IAM Review  └─ Cloud Monitoring         │
└──────────────────────────────────────────────────────────────┘
                       │
          ┌────────────┴────────────┐
          │  Google Cloud APIs       │
          │  Chronicle · SCC · GTI   │
          │  Vertex AI · BigQuery    │
          │  Cloud Logging · IAM     │
          │  Cloud Monitoring        │
          └─────────────────────────┘

Zero embedded secrets. All Google API authentication uses Workload Identity Federation (Application Default Credentials). The Cloud Run service account authenticates automatically. Third-party containment APIs (Okta, AWS, Azure AD, CrowdStrike, O365) use environment variables backed by Secret Manager.

Security

MCP Boss handles sensitive security data. Here's how to lock it down.

Auth-off equals policy-off. When OAUTH_CLIENT_ID is unset, the built-in auth middleware no-ops and the approval role check in /api/approvals/*/decide falls back to an allow-all path so dev workflows keep working. This means a deployment without OAUTH_CLIENT_ID has no enforcement: anyone with network reach can approve any destructive tool call. Any non-dev deploy MUST set OAUTH_CLIENT_ID (and populate a ROLE_MAP_JSON or ROLE_MAP_PATH). See auth_middleware.py and deploy/multi_tenant/README.md.

Boot will refuse to start if LOCAL_DEV_ALL_ROLES=1 is set without OAUTH_CLIENT_ID unless you also set MCP_BOSS_ENV=dev. That combo grants every caller every approver role.

MCP transport (stdio/SSE) session tools (create_session, get_session, update_session, add_note) still run under a single tenant because those transports carry no HTTP identity. Restrict MCP transport access at the infra layer (Cloud Run IAM invoker on /mcp and /sse).

Option 1: IAM Authentication (Recommended)

Remove public access and require Google Cloud IAM authentication:

# Remove unauthenticated access
gcloud run services remove-iam-policy-binding mcp-boss \
  --member="allUsers" \
  --role="roles/run.invoker" \
  --project=$PROJECT_ID \
  --region=us-central1

# Grant access to specific users only
gcloud run services add-iam-policy-binding mcp-boss \
  --member="user:analyst@yourcompany.com" \
  --role="roles/run.invoker" \
  --project=$PROJECT_ID \
  --region=us-central1

# Grant access to a Google Group (for SOC team)
gcloud run services add-iam-policy-binding mcp-boss \
  --member="group:soc-team@yourcompany.com" \
  --role="roles/run.invoker" \
  --project=$PROJECT_ID \
  --region=us-central1

How to access after locking down:

# From browser — use Cloud Run Proxy:
gcloud run services proxy mcp-boss --project=$PROJECT_ID --region=us-central1
# Opens http://localhost:8080 → authenticated tunnel to your service

# From curl/API:
TOKEN=$(gcloud auth print-identity-token)
curl -H "Authorization: Bearer $TOKEN" https://YOUR-SERVICE-URL/health

# From Gemini CLI:
TOKEN=$(gcloud auth print-identity-token)
gemini --tool-endpoint https://YOUR-SERVICE-URL/mcp --headers "Authorization=Bearer $TOKEN"

Option 2: VPC-Only (Internal Network)

Restrict to your VPC — no public internet access at all:

gcloud run services update mcp-boss \
  --ingress=internal \
  --project=$PROJECT_ID \
  --region=us-central1

Only accessible from within your VPC, VPN, or Cloud Interconnect.

How to access:

# From your local machine via Cloud Run Proxy (tunnels through IAM):
gcloud run services proxy mcp-boss --project=$PROJECT_ID --region=us-central1
# Opens http://localhost:8080 locally

# Or from a GCE VM / GKE pod inside the VPC:
curl https://YOUR-SERVICE-URL/health

Option 3: IAP (Identity-Aware Proxy)

Put Cloud IAP in front for browser-based SSO with your corporate identity provider:

# Enable IAP on the Cloud Run service
gcloud iap web enable \
  --resource-type=cloud-run \
  --service=mcp-boss \
  --project=$PROJECT_ID

# Grant access to your SOC team
gcloud iap web add-iam-policy-binding \
  --resource-type=cloud-run \
  --service=mcp-boss \
  --member="group:soc-team@yourcompany.com" \
  --role="roles/iap.httpsResourceAccessor" \
  --project=$PROJECT_ID

Users get a Google login prompt in the browser before reaching the Web UI. No code changes needed — IAP handles everything.

How to access: Just open the URL in a browser. IAP shows a Google login page. After sign-in, you're through to the Web UI.

Option 4: API Key Header

For quick protection, set an API key environment variable and validate in requests:

gcloud run services update mcp-boss \
  --set-env-vars="MCP_BOSS_API_KEY=your-secret-key-here" \
  --project=$PROJECT_ID \
  --region=us-central1

How to access:

# curl:
curl -H "X-API-Key: your-secret-key-here" https://YOUR-SERVICE-URL/health

# Gemini CLI:
gemini --tool-endpoint https://YOUR-SERVICE-URL/mcp --headers "X-API-Key=your-secret-key-here"

# Web UI: Add ?key=your-secret-key-here to the URL
# Or the Web UI will prompt for it on first load

The server validates this automatically when MCP_BOSS_API_KEY is set.

Security Best Practices

Practice	How
No public access	Remove `allUsers` invoker binding
Least privilege SA	Use dedicated `mcp-boss` service account, not default compute SA
Secret Manager	Store API keys (GTI, Okta, AWS, etc.) in Secret Manager, not env vars
Audit logging	Cloud Run request logs are automatic; enable Data Access audit logs
VPC SC	Place the project in a VPC Service Controls perimeter
Containment approval	Built in: see "Authentication & Approvals" below
Network	Use `--ingress=internal` + Cloud VPN/Interconnect for production

Authentication & Approvals

Application-level controls that sit on top of Cloud Run IAM. All of them are off by default; opt in with env vars.

Authentication (Google ID tokens)

Set OAUTH_CLIENT_ID and the server rejects any request without a valid Google OIDC ID token whose aud matches.

Variable	Purpose
`OAUTH_CLIENT_ID`	Primary audience. Usually your browser-flow OAuth 2.0 client ID.
`OAUTH_ADDITIONAL_AUDIENCES`	Comma-separated extra accepted audiences. Add the service URL or `32555940559.apps.googleusercontent.com` (gcloud default client) for server-to-server CI calls.
`ALLOWED_EMAILS`	Optional comma-separated allowlist. If set, an authenticated email not on the list is rejected.
`AUTH_EXEMPT_PATHS`	Comma-separated path prefixes that bypass auth (default `/health,/static`).

When OAUTH_CLIENT_ID is unset the middleware is a no-op: auth is disabled, principal is local, every role check passes. Do not ship this configuration outside local dev. The server refuses to start if LOCAL_DEV_ALL_ROLES=1 is set without either OAUTH_CLIENT_ID or MCP_BOSS_ENV=dev.

Role mapping and approver groups

policy_and_approvals/policies.yaml maps each destructive tool (host isolation, key revocation, email purge, etc.) to one or more approver role names. To authorise a caller, map their email to a role set.

Variable	Format
`ROLE_MAP_JSON`	Inline JSON: `{"alice@co.com":["security-oncall"], "@co.com":["soc-manager"]}`
`ROLE_MAP_PATH`	Path to a YAML file: `roles: {alice@co.com: [security-oncall]}`

Approver role names recognised by the default policies.yaml: security-oncall, soc-manager, identity-team, cloud-platform, detection-engineering, legal, security-leadership.

Approval workflow

Orchestrator wants to invoke a gated tool (e.g. isolate_crowdstrike_host).
Policy gate checks policies.yaml. If require_approval, it freezes the tool call as an ApprovalRequest.
The approval is broadcast via any configured channel: /api/approvals (web UI), Google Chat card (GOOGLE_CHAT_WEBHOOK_URL), generic webhook (APPROVAL_WEBHOOK_URL).
An approver hits POST /api/approvals/{id}/decide with approve / deny. The server 403s unless the authenticated caller's roles intersect the rule's approver_groups. decided_by is rebound to the authenticated email so the audit trail cannot be spoofed.
On approve, the tool executes. Every state transition lands in the hash-chained audit log.

Verify the chain any time with GET /api/audit/verify:

{"chain_intact": true, "broken_at_seq": null, "audit_path": "/var/log/mcp-boss/audit.jsonl"}

Tenant isolation

SessionMemory is keyed by (authenticated principal, session_id). Two users on the same Cloud Run instance cannot read each other's investigation history even if they guess session IDs. MCP transport session tools (stdio / SSE) use a distinct mcp-transport namespace; gate that transport at the infra layer (Cloud Run IAM invoker on /mcp and /sse).

Output redaction (DLP)

Set ENABLE_OUTPUT_REDACTION=1 and every tool result is scanned before it flows back to the LLM or the API response. Luhn-checked CC numbers, SSN-looking strings (with IP/date guards), PEM private keys, AWS access keys, JWTs, and labelled API keys (GTI, Okta, CrowdStrike, Azure AD, O365, api_key, bearer_token, client_secret, access_token) are replaced with [REDACTED:<type>]. The audit log records the un-redacted content; only what crosses the tool-to-LLM boundary is sanitised.

Operations

Daily use

Web UI — browse to the Cloud Run URL, sign in with Google. Paste an alert or ask a question.
Gemini CLI — gemini --tool-endpoint https://YOUR-URL/mcp --headers "Authorization=Bearer $(gcloud auth print-identity-token)".
Claude Desktop — add the /sse URL to claude_desktop_config.json (see the Connect section).

Every request produces a chat transcript (in the web UI), a full tool trace (in Cloud Logging), and an audit record for any gated tool call.

Benchmark / regression

export MCP_URL=https://YOUR-SERVICE-URL
export MCP_ID_TOKEN=$(gcloud auth print-identity-token)
./eval_harness/run.sh

Produces scorecard.md (headline numbers) and results.json (raw tool traces per scenario). Wire this into CI and fail the build if destructive_fp_rate_pct > 0 or verdict accuracy drops.

Audit log export

Records are JSONL at $MCP_BOSS_AUDIT_PATH (default /var/log/mcp-boss/audit.jsonl, falls back to ~/.mcp-boss/audit.jsonl) and mirrored to Cloud Logging under log name mcp-boss-audit. Point a BigQuery sink at the Cloud Logging stream for long-term retention and SIEM ingest.

Multi-tenant install

deploy/multi_tenant/install.sh runs terraform apply with Artifact Registry, Secret Manager stubs, Cloud Run v2, and IAM bindings in one command. Pass --oauth-client-id, --allowed-emails, --role-map-json, and --enable-redaction to set the full auth config at deploy time.

Manual Setup Guide

If you prefer to set things up manually instead of using setup.sh:

Prerequisites

Google Cloud project with billing enabled
gcloud CLI installed and authenticated
Chronicle / SecOps instance with a customer ID

Step 1: Enable APIs

PROJECT_ID=your-project-id

gcloud services enable \
    run.googleapis.com \
    cloudbuild.googleapis.com \
    chronicle.googleapis.com \
    securitycenter.googleapis.com \
    aiplatform.googleapis.com \
    logging.googleapis.com \
    bigquery.googleapis.com \
    monitoring.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com \
    --project=$PROJECT_ID

Step 2: Create Service Account & Grant IAM Roles

SA_NAME=mcp-boss
SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

# Create the service account
gcloud iam service-accounts create $SA_NAME \
  --display-name="MCP Boss Service Account" \
  --project=$PROJECT_ID

# Grant required roles
ROLES=(
  roles/chronicle.admin
  roles/securitycenter.findingsViewer
  roles/aiplatform.user
  roles/logging.viewer
  roles/bigquery.dataViewer
  roles/bigquery.jobUser
  roles/monitoring.viewer
  roles/iam.securityReviewer
)

for ROLE in "${ROLES[@]}"; do
  gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:${SA_EMAIL}" \
    --role="$ROLE" --quiet
done

IAM Roles Reference

Role	What it enables	Required?
`roles/chronicle.admin`	UDM search, rules, cases, detections, data tables, feeds, parsers, alerts	✅ Yes
`roles/securitycenter.findingsViewer`	SCC vulnerability findings, misconfigurations	✅ Yes
`roles/aiplatform.user`	Vertex AI Gemini — threat analysis, investigation reports	✅ Yes
`roles/logging.viewer`	Cloud Audit Log queries	✅ Yes
`roles/bigquery.dataViewer`	BigQuery security data lake reads	✅ Yes
`roles/bigquery.jobUser`	BigQuery SQL execution	✅ Yes
`roles/monitoring.viewer`	Cloud Monitoring — ingestion bandwidth stats	✅ Yes
`roles/iam.securityReviewer`	IAM policy and service account auditing	✅ Yes
`roles/iam.serviceAccountKeyAdmin`	GCP containment: revoke SA keys	⚙️ Optional
`roles/storage.admin`	Cloud Build deployment access	⚙️ Deploy only

Step 3: Build & Deploy

# Build
gcloud builds submit \
  --project=$PROJECT_ID \
  --tag gcr.io/$PROJECT_ID/mcp-boss:latest

# Deploy
gcloud run deploy mcp-boss \
  --image gcr.io/$PROJECT_ID/mcp-boss:latest \
  --project=$PROJECT_ID \
  --region=us-central1 \
  --platform=managed \
  --service-account=$SA_EMAIL \
  --allow-unauthenticated \
  --memory=512Mi \
  --timeout=300 \
  --set-env-vars="SECOPS_PROJECT_ID=$PROJECT_ID,SECOPS_CUSTOMER_ID=YOUR_CUSTOMER_ID,SECOPS_REGION=us,GTI_API_KEY=YOUR_VT_KEY"

Step 4: Verify

curl https://YOUR-SERVICE-URL/health
# {"status":"healthy","tools":89,...}

Step 5: Connect

Web UI: Open your Cloud Run URL in a browser.

Gemini CLI:

gemini --tool-endpoint https://YOUR-SERVICE-URL/mcp

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "mcp-boss": {
      "url": "https://YOUR-SERVICE-URL/sse"
    }
  }
}

Environment Variables

Required

Variable	Description
`SECOPS_PROJECT_ID`	Your GCP project ID
`SECOPS_CUSTOMER_ID`	Chronicle/SecOps customer ID (from Chronicle settings)
`SECOPS_REGION`	`us`, `eu`, or `asia`

Authentication

Variable	Description
`OAUTH_CLIENT_ID`	Google OAuth 2.0 client ID. When set, every request must present a valid ID token whose `aud` matches. Unset = auth disabled (dev only).
`OAUTH_ADDITIONAL_AUDIENCES`	Comma-separated extra accepted audiences. Add the service URL or `32555940559.apps.googleusercontent.com` for server-to-server / CI.
`ALLOWED_EMAILS`	Comma-separated allowlist of authenticated emails. If set, other emails are rejected.
`ROLE_MAP_JSON`	Inline JSON mapping email or `@domain` to approver role lists.
`ROLE_MAP_PATH`	YAML file with `roles:` block. Same shape as `ROLE_MAP_JSON`.
`AUTH_EXEMPT_PATHS`	Path prefixes that bypass auth (default `/health,/static`).
`LOCAL_DEV_ALL_ROLES`	`1` grants every caller every approver role. Requires `MCP_BOSS_ENV=dev`; otherwise server refuses to start.
`MCP_BOSS_ENV`	Operator declaration. Set to `dev` on a dev machine to allow `LOCAL_DEV_ALL_ROLES=1`.

Operations

Variable	Description
`ENABLE_OUTPUT_REDACTION`	`1` enables DLP pass on tool results before they flow to the LLM. Off by default.
`MCP_BOSS_AUDIT_PATH`	JSONL audit log path (default `/var/log/mcp-boss/audit.jsonl`, falls back to `~/.mcp-boss/audit.jsonl`).
`GOOGLE_CHAT_WEBHOOK_URL`	Google Chat webhook for approval cards.
`APPROVAL_WEBHOOK_URL`	Generic webhook for approval notifications.
`PUBLIC_BASE_URL`	Public URL used when building links in approval notifications.
`GEMINI_MODEL`	Gemini model for orchestration (default `gemini-2.5-flash`).

Optional — Third-Party Containment

Variable	Description
`O365_TENANT_ID`, `O365_CLIENT_ID`, `O365_CLIENT_SECRET`	Microsoft Graph — email purge
`OKTA_DOMAIN`, `OKTA_API_TOKEN`	Okta — user suspension
`AZURE_AD_TENANT_ID`, `AZURE_AD_CLIENT_ID`, `AZURE_AD_CLIENT_SECRET`	Azure AD — session revocation
`SOAR_AWS_KEY`, `SOAR_AWS_SECRET`	AWS — IAM key revocation
`CROWDSTRIKE_CLIENT_ID`, `CROWDSTRIKE_CLIENT_SECRET`	CrowdStrike — host isolation

Any sensitive env var accepts sm://PROJECT/SECRET_NAME in place of a plaintext value. The secrets_resolver module transparently fetches the latest version from Google Secret Manager at startup.

All 91 Tools

🔍 Discovery & Hunting (12 tools)

Tool	Description
`get_scc_findings`	Fetch active SCC vulnerabilities by severity
`top_vulnerability_findings`	Top SCC findings sorted by severity
`get_finding_remediation`	Remediation guidance for SCC findings
`query_cloud_logging`	Query Cloud Audit Logs
`search_secops_udm`	Chronicle UDM search (YARA-L or field queries)
`search_security_events`	Search security events by type and time range
`list_secops_detections`	All detections — custom rules + curated rules + cases
`get_security_alerts`	Recent security alerts
`check_ingestion_health`	Unparsed log detection / parser failures
`lookup_entity`	Entity context lookup in Chronicle
`get_last_logins`	Recent login events
`get_last_detections`	Recent detection alerts

🧠 Threat Intelligence (6 tools)

Tool	Description
`enrich_indicator`	Enrich IP/domain/hash/URL via GTI/VirusTotal
`get_ip_report`	Detailed IP report
`get_domain_report`	Detailed domain report
`get_file_report`	Detailed file hash report
`search_threat_actors`	Threat actor profiles (APT groups)
`search_malware_families`	Malware family profiles

🛡️ Detection Engineering (8 tools)

Tool	Description
`list_rules`	List all YARA-L rules
`create_rule`	Create a YARA-L 2.0 rule
`get_rule`	Get rule details by ID
`toggle_rule`	Enable/disable a rule
`list_rule_errors`	Rule compilation/execution errors
`create_detection_rule_for_scc_finding`	Auto-generate YARA-L from SCC finding
`extract_iocs_from_detections`	Bulk IOC extraction from detections
`vertex_ai_investigate`	Gemini-powered threat analysis

📋 Data Tables (3 tools)

Tool	Description
`list_data_tables`	List all Data Tables
`get_data_table`	Read table contents
`update_data_table`	Write/update rows

📂 SOAR Cases (17 tools)

Tool	Description
`list_cases` / `secops_list_cases`	List cases
`get_last_cases`	Recent cases summary
`secops_get_case`	Full case report — entities, MITRE, hashes, processes, detections
`secops_update_case`	Update priority, status, description
`get_case_alerts` / `secops_list_case_alerts`	Alerts for a case
`secops_get_case_alert`	Alert details
`secops_update_case_alert`	Update alert
`add_case_comment` / `secops_create_case_comment`	Add comments
`secops_list_case_comments`	List comments
`get_case_overview`	Stats and priority breakdown
`update_case_priority`	Change priority
`close_case`	Close with reason
`secops_execute_bulk_close_case`	Bulk close
`secops_execute_manual_action`	Execute SOAR action

🎭 SOAR Playbooks (6 tools)

Tool	Description
`list_playbooks`	List playbooks
`get_playbook`	Playbook details
`create_playbook`	Create playbook
`create_containment_playbook`	Auto-generate containment playbook
`export_playbook_template`	Export as template
`clone_playbook`	Clone existing playbook

🔒 Containment (7 tools)

Tool	Description
`purge_email_o365`	Delete email from O365 mailbox
`suspend_okta_user`	Suspend + clear Okta sessions
`revoke_azure_ad_sessions`	Revoke Azure AD / Entra ID sessions
`revoke_aws_access_keys`	Disable AWS IAM keys
`revoke_aws_sts_sessions`	Deny STS assumed-role sessions
`revoke_gcp_sa_keys`	Delete GCP service account keys
`isolate_crowdstrike_host`	Network-isolate via CrowdStrike

📊 Logging & Monitoring (6 tools)

Tool	Description
`list_log_names`	Available log names
`list_log_entries`	Log entries with filters
`list_log_buckets`	Logging buckets
`get_log_bucket`	Bucket details
`list_log_views`	Log views
`query_ingestion_stats`	Daily ingestion bandwidth (GB) from Cloud Monitoring

🔧 SecOps Admin (7 tools)

Tool	Description
`list_parsers`	Parsers / log types
`validate_parser`	Test parser against raw log
`list_feeds`	Ingestion feeds
`get_feed`	Feed details
`list_data_access_labels`	Data access labels
`list_data_access_scopes`	Data access scopes
`query_secops_audit_logs`	Platform audit logs

📊 Analytics (5 tools)

Tool	Description
`get_mttx_metrics`	MTTR / MTTC response metrics
`bigquery_list_dataset_ids`	BigQuery datasets
`bigquery_list_table_ids`	Tables in a dataset
`bigquery_get_dataset_info` / `bigquery_get_table_info`	Metadata
`bigquery_execute_sql`	Execute SQL

🔑 IAM (3 tools)

Tool	Description
`get_iam_policy`	Full project IAM policy
`get_service_accounts`	List SAs with key counts
`check_iam_permissions`	Check roles for a specific user/SA

🧠 Session & Investigation (5 tools)

Tool	Description
`create_session`	Create investigation session
`get_session`	Retrieve session state
`set_session_context`	Update session context
`add_investigation_note`	Timestamped investigation notes
`autonomous_investigate`	Flagship: End-to-end pipeline — enrich → hunt → assess → detect → respond → report

API Endpoints

Endpoint	Transport	Client
`GET /`	HTTP	Web UI (built-in chat)
`GET /health`	HTTP	Health check (exempt from auth)
`GET /api/tools`	HTTP	Tool listing
`POST /api/chat`	HTTP	Multi-turn orchestration (Web UI)
`GET /sse`	SSE	Claude Desktop / MCP clients
`POST /messages/`	HTTP	SSE message handler
`POST /mcp`	Streamable HTTP	Gemini CLI
`GET /api/approvals`	HTTP	List approval requests (filter with `?state=pending`)
`GET /api/approvals/{id}`	HTTP	Fetch a specific approval
`POST /api/approvals/{id}/decide`	HTTP	Approve or deny (caller roles must intersect rule's approver_groups)
`GET /api/audit/verify`	HTTP	Verify the hash-chained audit log is intact

Author

David Adohen — Google SecOps / Google Threat Intelligence

Name		Name	Last commit message	Last commit date
Latest commit History 157 Commits
arsenal		arsenal
deploy/multi_tenant		deploy/multi_tenant
docs		docs
eval_harness		eval_harness
modular		modular
policy_and_approvals		policy_and_approvals
static		static

.env.example		.env.example
.gitignore		.gitignore
Dockerfile		Dockerfile
README.md		README.md
add_keys.sh		add_keys.sh
auth_middleware.py		auth_middleware.py
client.py		client.py
deploy.sh		deploy.sh
deploy_and_push.sh		deploy_and_push.sh
main.py		main.py
main.py.backup		main.py.backup
redaction.py		redaction.py
requirements.txt		requirements.txt
secrets_resolver.py		secrets_resolver.py
setup.sh		setup.sh
test_local.sh		test_local.sh

Folders and files

Latest commit

History

Repository files navigation

🛡️ MCP Boss — Autonomous Security Operations Server

Quick Start

One-line install:

Or deploy from Google Cloud Shell:

Or step by step:

What It Does

Benchmark

Architecture

Security

Option 1: IAM Authentication (Recommended)

Option 2: VPC-Only (Internal Network)

Option 3: IAP (Identity-Aware Proxy)

Option 4: API Key Header

Security Best Practices

Authentication & Approvals

Authentication (Google ID tokens)

Role mapping and approver groups

Approval workflow

Tenant isolation

Output redaction (DLP)

Operations

Daily use

Benchmark / regression

Audit log export

Multi-tenant install

Manual Setup Guide

Prerequisites

Step 1: Enable APIs

Step 2: Create Service Account & Grant IAM Roles

IAM Roles Reference

Step 3: Build & Deploy

Step 4: Verify

Step 5: Connect

Environment Variables

Required

Recommended

Authentication

Operations

Optional — Third-Party Containment

All 91 Tools

🔍 Discovery & Hunting (12 tools)

🧠 Threat Intelligence (6 tools)

🛡️ Detection Engineering (8 tools)

📋 Data Tables (3 tools)

📂 SOAR Cases (17 tools)

🎭 SOAR Playbooks (6 tools)

🔒 Containment (7 tools)

📊 Logging & Monitoring (6 tools)

🔧 SecOps Admin (7 tools)

📊 Analytics (5 tools)

🔑 IAM (3 tools)

🧠 Session & Investigation (5 tools)

API Endpoints

Author

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages