Merge branch 'main' into bug-fix-tool-test-rule

Author: mihirvala08

.github/workflows/publish-packages.yml

@@ -32,6 +32,136 @@ The server uses Google's authentication. Make sure you have either:
 2. Set a GOOGLE_APPLICATION_CREDENTIALS environment variable
 3. Used `gcloud auth application-default login`
 
+## Standalone Usage
+
+Each MCP server can be installed and used as a standalone package.
+
+### Installation
+
+You can install the packages using `uv tool install` (recommended):
+
+```bash
+# Install packages
+uv tool install google-secops-mcp
+uv tool install gti-mcp
+uv tool install scc-mcp
+uv tool install secops-soar-mcp
+```
+
+Alternatively, you can use pip:
+
+```bash
+pip install google-secops-mcp
+pip install gti-mcp
+pip install scc-mcp
+pip install secops-soar-mcp
+```
+
+### Running Standalone
+
+After installation, you can run the servers directly using uvx:
+
+```bash
+# Run SecOps MCP server
+uvx --from google-secops-mcp secops_mcp
+
+# Run GTI MCP server
+uvx gti_mcp
+
+# Run SCC MCP server
+uvx scc_mcp
+
+# Run SecOps SOAR MCP server (with optional integrations)
+uvx secops_soar_mcp --integrations CSV,OKTA
+```
+
+With environment variables:
+
+```bash
+CHRONICLE_PROJECT_ID="your-project-id" \
+CHRONICLE_CUSTOMER_ID="01234567-abcd-4321-1234-0123456789ab" \
+CHRONICLE_REGION="us" \
+uvx secops_mcp
+```
+
+### Using with MCP Clients (Recommended)
+
+You can configure MCP clients to use the installed packages with uvx. Here's an example configuration:
+
+```json
+{
+  "mcpServers": {
+    "secops": {
+      "command": "uvx",
+      "args": [
+        "--from",
+        "google-secops-mcp",
+        "secops_mcp"
+      ],
+      "env": {
+        "CHRONICLE_PROJECT_ID": "your-project-id",
+        "CHRONICLE_CUSTOMER_ID": "01234567-abcd-4321-1234-0123456789ab",
+        "CHRONICLE_REGION": "us"
+      },
+      "disabled": false,
+      "autoApprove": []
+    },
+    "gti": {
+      "command": "uvx",
+      "args": [
+        "gti_mcp"
+      ],
+      "env": {
+        "VT_APIKEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+      },
+      "disabled": false,
+      "autoApprove": []
+    },
+    "scc-mcp": {
+      "command": "uvx",
+      "args": [
+        "scc_mcp"
+      ],
+      "env": {},
+      "disabled": false,
+      "autoApprove": []
+    },
+    "secops-soar": {
+      "command": "uvx",
+      "args": [
+        "secops_soar_mcp",
+        "--integrations",
+        "CSV,OKTA"
+      ],
+      "env": {
+        "SOAR_URL": "https://yours-here.siemplify-soar.com:443",
+        "SOAR_APP_KEY": "01234567-abcd-4321-1234-0123456789ab"
+      },
+      "disabled": false,
+      "autoApprove": []
+    }
+  }
+}
+```
+
+You can also use environment files with uvx:
+
+```json
+{
+  "mcpServers": {
+    "secops": {
+      "command": "uvx",
+      "args": [
+        "--env-file",
+        "/path/to/.env",
+        "secops_mcp"
+      ],
+      "disabled": false
+    }
+  }
+}
+```
+
 ## Client Configurations
 The MCP servers from this repo can be used with the following clients
 1. Cline, Claude Desktop, and other MCP supported clients
@@ -43,6 +173,31 @@ The configuration for Claude Desktop and Cline is the same (provided below for [
 
 Please refer to the [README file](./run-with-google-adk/README.md) for both - locally running the prebuilt agent and [Cloud Run](https://cloud.google.com/run) deployment.
 
+## MCP Client Config Locations
+
+MCP clients all use the same JSON configuration format (see the [MCP Server Configuration Reference](https://google.github.io/mcp-security/usage_guide.html#mcp-server-configuration-reference)), but they expect the file in different locations.
+
+| Client Application       | Scope     | macOS / Linux Location                | Windows Location                                                                    | Notes                                                                                                                                                                                                |
+| ------------------------ | --------- | ------------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Gemini CLI**           | Global    | `~/.gemini/settings.json`             | `%USERPROFILE%\.gemini\settings.json`                                               | File must include `mcpServers`. Confirmed in [Google Security Ops post](https://security.googlecloudcommunity.com/google-security-operations-2/google-cloud-security-mcp-servers-in-gemini-cli-922). |
+| **Claude Desktop**       | Global    | `~/Claude/claude_desktop_config.json` | `%USERPROFILE%\Claude\claude_desktop_config.json`                                   | Config accessible via *Claude > Settings > Developer > Edit Config*.                                                                                                                                 |
+| **Claude Code**          | Global    | `~/.claude.json`                      | `%USERPROFILE%\.claude.json`                                                             | Primary config file for Claude Code CLI and extensions.                                                                                                                                              |
+| **Cursor IDE (Global)**  | Global    | `~/.cursor/mcp.json`                  | `%USERPROFILE%\.cursor\mcp.json`                                                    | Enables MCP servers globally across all projects.                                                                                                                                                    |
+| **Cursor IDE (Project)** | Project   | `<project-root>/.cursor/mcp.json`     | `<project-root>/.cursor/mcp.json`                                                   | Workspace/project-specific config file.                                                                                                                                                              |
+| **VS Code (Workspace)**  | Workspace | `<project-root>/.vscode/mcp.json`     | `<project-root>/.vscode/mcp.json`                                                   | Workspace-level config used when an MCP extension (like **Cline**) is installed. Overrides global config if present.                                                                                 |
+| **Cline (VS Code Ext.)** | Global    | Inside VS Code extension data         | `%APPDATA%\Code\User\globalStorage\<extension-id>\settings\cline_mcp_settings.json` | Exact path varies by VS Code variant and platform. `<extension-id>` corresponds to the installed extension folder (e.g., `saoudrizwan.claude-dev`).                                                  |
+
+### Additional Notes for Windows
+
+- `%USERPROFILE%` → `C:\Users\<username>`
+- `%APPDATA%` → `C:\Users\<username>\AppData\Roaming`
+- `<project-root>` → folder opened in VS Code or IDE for the project
+- `<extension-id>` → name of the installed extension folder (e.g., `saoudrizwan.claude-dev` for Claude/Cline)
+
+### Tip: Single Config with Symlinks
+
+If you use multiple MCP clients, you can maintain a **single config file** and symlink it into each expected location. This avoids drift and keeps your server definitions consistent.
+
 
 ### Using uv (Recommended)
 

README.md

@@ -13,7 +13,7 @@ Get the members list of the provided group name in Active Directory
 *   `case_id` (str, required): The ID of the case.
 *   `alert_group_identifiers` (List[str], required): Identifiers for the alert groups.
 *   `group_name` (str, required): Specify whether the name of the group of which you would like to list down the group members.
-*   `members_type` (List[Any], required): Specify the member type of the group.
+*   `members_type` (List[str], required): Specify the member type of the group.
 *   `perform_nested_search` (bool, required): Specify whether the action should fetch additional details regarding groups found in the main group.
 *   `limit` (str, required): Specify the maximum number of listings to fetch from Active Directory
 *   `target_entities` (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.

docs/soar_integrations/active_directory.md

@@ -12,7 +12,7 @@ List available templates in AlgoSec.
 
 *   `case_id` (str, required): The ID of the case.
 *   `alert_group_identifiers` (List[str], required): Identifiers for the alert groups.
-*   `filter_logic` (Optional[List[Any]], optional, default=None): Specify what filter logic should be applied.
+*   `filter_logic` (Optional[List[str]], optional, default=None): Specify what filter logic should be applied.
 *   `filter_value` (Optional[str], optional, default=None): Specify what value should be used in the filter. If "Equal" is selected, action will try to find the exact match among record types and if "Contains" is selected, action will try to find items that contain that substring. If nothing is provided in this parameter, the filter will not be applied.
 *   `max_templates_to_return` (Optional[str], optional, default=None): Specify how many templates to return. Default: 50.
 *   `target_entities` (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.

docs/soar_integrations/algo_sec.md

@@ -30,7 +30,7 @@ List Amazon Macie findings based on the specified action input parameters.  Note
 *   `include_archived_findings` (Optional[bool], optional, default=None): Specify whether to include archived findings in results or not.
 *   `record_limit` (Optional[str], optional, default=None): Specify how many records can be returned by the action.
 *   `sort_by` (Optional[str], optional, default=None): Specify a parameter for sorting the data, eg updatedAt
-*   `sort_order` (Optional[List[Any]], optional, default=None): Sort order.
+*   `sort_order` (Optional[List[str]], optional, default=None): Sort order.
 *   `target_entities` (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
 *   `scope` (str, optional, default="All entities"): Defines the scope for the action.
 

docs/soar_integrations/amazon_macie.md

@@ -13,7 +13,7 @@ Enrich entities using information from Anomali ThreatStream. Supported entities:
 *   `case_id` (str, required): The ID of the case.
 *   `alert_group_identifiers` (List[str], required): Identifiers for the alert groups.
 *   `limit` (str, required): Specify how many records to return per entity.
-*   `severity_threshold` (Optional[List[Any]], optional, default=None): Specify what should be the severity threshold for the entity, in order to mark it as suspicious. If multiple records are found for the same entity, action will take the highest severity out of all available records.
+*   `severity_threshold` (Optional[List[str]], optional, default=None): Specify what should be the severity threshold for the entity, in order to mark it as suspicious. If multiple records are found for the same entity, action will take the highest severity out of all available records.
 *   `confidence_threshold` (Optional[str], optional, default=None): Specify what should be the confidence threshold for the entity, in order to mark it as suspicious. Note: Maximum is 100. If multiple records are found for the entity, action will take the average. Active records have priority. Default: 50.
 *   `ignore_false_positive_status` (Optional[bool], optional, default=None): If enabled, action will ignore the false positive status and mark the entity as suspicious based on the "Severity Threshold" and "Confidence Threshold". If disabled, action will never label false positive entities as suspicious, regardless, if they pass the "Severity Threshold" and "Confidence Threshold" conditions or not.
 *   `target_entities` (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.

docs/soar_integrations/anomali.md

@@ -75,12 +75,12 @@ Submit an observable to Anomali ThreatStream based on IP, URL, Hash, Email entit
 
 *   `case_id` (str, required): The ID of the case.
 *   `alert_group_identifiers` (List[str], required): Identifiers for the alert groups.
-*   `classification` (List[Any], required): Specify the classification of the observable.
-*   `threat_type` (List[Any], required): Specify the threat type of the observables.
+*   `classification` (List[str], required): Specify the classification of the observable.
+*   `threat_type` (List[str], required): Specify the threat type of the observables.
 *   `source` (Optional[str], optional, default=None): Specify the intelligence source for the observable.
 *   `expiration_date` (Optional[str], optional, default=None): Specify the expiration date in days for the observable. If nothing is specified here, action will create an observable that will never expire.
 *   `trusted_circle_i_ds` (Optional[str], optional, default=None): Specify the comma-separated list of trusted circle ids. Observables will be shared with those trusted circles.
-*   `tlp` (Optional[List[Any]], optional, default=None): Specify the TLP for your observables.
+*   `tlp` (Optional[List[str]], optional, default=None): Specify the TLP for your observables.
 *   `confidence` (Optional[str], optional, default=None): Specify what should be the confidence for the observable. Note: this parameter will only work, if you create observables in your organization and requires 'Override System Confidence' to be enabled.
 *   `override_system_confidence` (Optional[bool], optional, default=None): If enabled, created observables will have the confidence specified in the 'Confidence' parameter. Note: you can't share observables in trusted circles and publicly, when this parameter is enabled.
 *   `anonymous_submission` (Optional[bool], optional, default=None): If enabled, action will make an anonymous submission.
@@ -141,7 +141,7 @@ Retrieve information about entities from Anomali ThreatStream. Supported entitie
 
 *   `case_id` (str, required): The ID of the case.
 *   `alert_group_identifiers` (List[str], required): Identifiers for the alert groups.
-*   `severity_threshold` (List[Any], required): Specify what should be the severity threshold for the entity, in order to mark it as suspicious. If multiple records are found for the same entity, action will take the highest severity out of all available records.
+*   `severity_threshold` (List[str], required): Specify what should be the severity threshold for the entity, in order to mark it as suspicious. If multiple records are found for the same entity, action will take the highest severity out of all available records.
 *   `confidence_threshold` (str, required): Specify what should be the confidence threshold for the entity, in order to mark it as suspicious. Note: Maximum is 100. If multiple records are found for the entity, action will take the average. Active records have priority.
 *   `create_insight` (bool, required): If enabled, action will add an insight per processed entity.
 *   `only_suspicious_entity_insight` (bool, required): If enabled, action will create insight only for entities that exceeded the "Severity Threshold" and "Confidence Threshold".