The google/mcp-security repository provides Model Context Protocol servers that integrate Google's security products with MCP clients such as Claude Desktop and the Cline VS Code extension. Written in Python, the repository enables users to access five distinct Google security services: a Remote MCP Server for Google SecOps, Google Security Operations (Chronicle) for threat detection and investigation, Google Security Operations SOAR for security orchestration and automation, Google Threat Intelligence for accessing Google's threat data, and Security Command Center for cloud security management. Each server operates independently, allowing organizations to deploy only the capabilities they require.

The repository emphasizes a Remote MCP Server as the recommended deployment option, described as fully managed and enterprise-ready. This approach is highlighted through a launch announcement and dedicated setup guide within the documentation. The flexibility to enable and run servers separately accommodates diverse organizational needs and existing infrastructure constraints.

Documentation is comprehensive and accessible through multiple channels. Users can read markdown files directly in the repository, access a documentation website at https://google.github.io/mcp-security/, or generate HTML documentation locally using Sphinx. The documentation covers detailed information about each MCP server, configuration options, requirements, usage examples, and best practices, with an entry point at docs/index.md.

Authentication relies on Google's standard credential mechanisms. Users must configure Application Default Credentials, set the GOOGLE_APPLICATION_CREDENTIALS environment variable, or use gcloud auth application-default login to establish access.

The repository supports multiple installation and deployment patterns. Packages can be installed using uv tool install or pip, with standalone execution available through uvx commands. MCP clients can be configured to use the installed packages, supporting both environment variable injection and environment file loading. The repository explicitly recommends uv for most users due to faster package installation, better dependency resolution, and isolated environments, though pip remains available as an alternative.

The MCP servers integrate with multiple client applications including Cline, Claude Desktop, Google ADK Agents, and a Google SecOps Extension for Gemini CLI. Configuration follows a standardized JSON format across clients, though file locations vary by application and platform. The repository provides specific paths for macOS, Linux, and Windows across different clients including Gemini CLI, Claude Desktop, Claude Code, Cursor IDE, VS Code, and Cline. A notable feature allows users to maintain a single configuration file and symlink it across multiple client locations to prevent configuration drift.

The repository includes a prebuilt Google ADK agent available for both local execution and Cloud Run deployment, with setup instructions in a dedicated README file. Configuration guidance addresses platform-specific considerations, including Windows path conventions using environment variables like USERPROFILE and APPDATA.

The repository provides troubleshooting guidance recommending users run MCP servers from the command line outside of MCP clients to identify configuration issues, with specific attention to PATH verification. The documentation distinguishes between uv and pip usage scenarios, with uv supporting .env file loading through the UV_ENV_FILE environment variable and the --env-file configuration option.