Connectors · Identity & security
Google Security Operations MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Google Security Operations and the rest of your systems. It gives your agent 565 Google Security Operations actions (275 reads, 220 writes and 70 that wait for a confirmation) and holds the Google Security Operations credential itself, so the agent never does. It paces Google Security Operations's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "google_secops.cases.list", intent: "check which Google Security Operations account is connected"}# Cases: list · read · 1 upstream call- 565actionsin one signed file
- 275readlook, never change
- 220writecreate and update
- 70wait for a yesdestructive, confirmed first
Set up
Connect Google Security Operations in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Google Security Operations.
Signed token (JWT). You paste the signing key once; actionlake signs a short-lived token for each call. actionlake stores what you paste write-only, sealed under your tenant's key.
client_emailService account client email (`client_email` in the JSON key file)private_keyService account private key, PKCS#8 PEM (`private_key` in the JSON key file)hostWhere your Google Security Operations lives: your hostinstance_idWhere your Google Security Operations lives: your instance idlocationYour Google Security Operations locationproject_idYour Google Security Operations project id
account { op: "connections.requirements", service: "google_secops" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "google_secops.cases.list" }# cases: list · read · 1 upstream callcheck { action: "google_secops.case_comments.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Google Security Operations at a glance
- Sign-in
- Signed token (JWT). You paste the signing key once; actionlake signs a short-lived token for each call.
- You provide
client_emailprivate_key- Setup fields
hostinstance_idlocationproject_id- Limits we pace to
- 5 calls a second, per connection
- API covered
- Chronicle API v1 (REST reference scraped 2026-10-23), at your Google Security Operations instance's API base URL, which you enter when connecting
- Built from
- Google Security Operations's documentation, read 23 October 2026docs.cloud.google.comGitHub
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 275 of 275 reads, for up to 2 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line Google Security Operations up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Google Security Operations.
565 actions in 110 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 275readlook, never change
- 220writecreate and update
- 70destructivewait for a confirmation
Instance
2220 read · 2 write · 0 destructive
Instance: find entity · Instance: find entity alerts · Instance: find related entities · Instance: find udm field values
Cases
185 read · 13 write · 0 destructive
Cases: list · Cases: get · Cases: patch · Cases: create insight
Remote agents
169 read · 6 write · 1 destructive
Remote agents: create · Remote agents: list · Remote agents: send remote agent installer · Remote agents: connector valid remote agents
Integrations
159 read · 5 write · 1 destructive
Integrations: create · Integrations: list · Integrations: download dependency · Integrations: fetch affected items
Data table rows
123 read · 8 write · 1 destructive
Data table rows: bulk create · Data table rows: bulk create async · Data table rows: create · Data table rows: list
Native dashboards
123 read · 7 write · 2 destructive
Native dashboards: list · Native dashboards: create · Native dashboards: get · Native dashboards: patch
Case alerts
115 read · 6 write · 0 destructive
Case alerts: list · Case alerts: get · Case alerts: patch · Case alerts: create recommendation long running
Content packs
102 read · 7 write · 1 destructive
Content packs: add · Content packs: deploy connector instances · Content packs: deploy playbooks · Content packs: deploy test cases
102 more areas · 449 actions
- Parsers 10
- Feeds 9
- Custom lists 8
- Email templates 8
- Integrations actions 8
- Integrations connectors connector instances 8
- Integrations integration instances 8
- Rules 8
- Soar networks 8
- Case alert involved entities 7
- Case queue filters 7
- Dynamic parameters 7
- Findings refinements 7
- Integrations connectors 7
- Integrations jobs 7
- Log types 7
- Ontology records visual families 7
- Sla definitions 7
- Soar domains 7
- Case alert context properties 6
- Case chat messages 6
- Case context properties 6
- Case tag definitions 6
- Context properties 6
- Environments 6
- Integrations connectors context properties 6
- Integrations jobs context properties 6
- Integrations jobs job instances 6
- Integrations managers 6
- Alert grouping rules 5
- Announcements 5
- Case close definitions 5
- Case comments 5
- Case stage definitions 5
- Data access labels 5
- Data access scopes 5
- Data exports 5
- Data tables 5
- Entities blocklists 5
- Environment groups 5
- Integrations managers revisions 5
- Legacy soar users workdesk contacts 5
- Legacy soar users workdesk links 5
- Legacy soar users workdesk notes 5
- Marketplace integrations 5
- Module settings properties 5
- Parser extensions 5
- Property schema definitions 5
- Request templates 5
- Saved column sets 5
- Soc roles 5
- Tasks 5
- Threat collections 5
- Unique entities 5
- Users saved column sets 5
- Users search queries 5
- Watchlists 5
- Case wall records 4
- Enrichment controls 4
- Events 4
- Integrations actions revisions 4
- Integrations connectors revisions 4
- Integrations jobs revisions 4
- Iocs 4
- Legacy soar users 4
- Legacy soar users user notifications 4
- Operations 4
- Reference lists 4
- System notifications 4
- Views 4
- Featured content native dashboards 3
- Form dynamic parameters 3
- Ioc associations 3
- Legacy soar users attachments 3
- Module settings 3
- Retrohunts 3
- Connector instance logs 2
- Dashboard charts 2
- Dashboard queries 2
- Entities 2
- Feed packs 2
- Job instance logs 2
- Log types logs 2
- Parser extension extension validation reports 2
- Big query export 1
- Coverage details 1
- Data table operation errors 1
- Featured content rules 1
- Feed service accounts 1
- Feed source type schemas 1
- Feed source type schemas log type schemas 1
- Forwarders 1
- Ingestion log labels 1
- Ingestion log namespaces 1
- Log types log type settings 1
- Parser extension validation errors 1
- Parser extension validation parsing errors 1
- Parser extension validation reports 1
- Parser validation parsing errors 1
- Parser validation reports 1
- Rule deployments 1
- Rule execution errors 1
Top actions
The Google Security Operations API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 30 of Google Security Operations's 30 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
google_secops.case_alerts.listCase alerts: list | Lists CaseAlerts within a specific Case. | read | monitoring.alert.list51 connectors |
google_secops.cases.listCases: list | Lists Cases in an instance. | read | monitoring.incident.list19 connectors |
google_secops.case_alerts.getCase alerts: get | Gets a single CaseAlert. | read | monitoring.alert.get33 connectors |
google_secops.cases.getCases: get | Gets a single Case by its resource name. | read | monitoring.incident.get20 connectors |
google_secops.case_comments.createCase comments: create | Creates a new CaseComment. | write | monitoring.incident_note.create12 connectors |
google_secops.case_comments.listCase comments: list | Lists CaseComments associated with a specific Case. | read | monitoring.incident_note.list11 connectors |
google_secops.rules.listRules: list | Lists Rules. | read | security.detection_rule.list13 connectors |
google_secops.rules.createRules: create | Creates a new Rule. | write | security.detection_rule.create11 connectors |
google_secops.case_comments.deleteCase comments: delete | Performs a soft delete of a CaseComment. | destructive | monitoring.incident_note.delete10 connectors |
google_secops.native_dashboards.listNative dashboards: list | List all dashboards. | read | analytics.dashboard.list22 connectors |
google_secops.native_dashboards.createNative dashboards: create | Create a dashboard. | write | analytics.dashboard.create18 connectors |
google_secops.entities_blocklists.createEntities blocklists: create | Creates a new EntitiesBlocklist. | write | security.block_list.create6 connectors |
Try it
Prompts to paste into Claude.
Each one names the Google Security Operations actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which Google Security Operations incidents are open, and how long has each been open?
calls
google_secops.cases.list - Writewrite
Case comments: create in Google Security Operations. Show me exactly what you will send before you save it.
calls
google_secops.case_comments.create
Governance for Google Security Operations
Destructive actions wait for a yes.
70 Google Security Operations actions are destructive. The first 10:
- Case comments: delete
google_secops.case_comments.delete - Rules: delete
google_secops.rules.delete - Native dashboards: delete
google_secops.native_dashboards.delete - Entities blocklists: delete
google_secops.entities_blocklists.delete - Feeds: delete
google_secops.feeds.delete - Parsers: delete
google_secops.parsers.delete - Watchlists: delete
google_secops.watchlists.delete - Data tables: delete
google_secops.data_tables.delete - Data table rows: delete
google_secops.data_table_rows.delete - Native dashboards: remove chart
google_secops.native_dashboards.remove_chart
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Case comments: delete?
intent: the user asked me to case comments: delete
account { op: "keys.create", name: "google-secops-agent", allowed_actions: ["google_secops.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "google_secops.case_comments.delete", approver: "[email protected]" }, { match: "google_secops.rules.delete", approver: "[email protected]" }, { match: "google_secops.native_dashboards.delete", approver: "[email protected]" } ]}Cost
What Google Security Operations costs on actionlake.
Every Google Security Operations action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Google Security Operations refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 565 Google Security Operations actions
- 102actions pageeach page of a long list is one call
- 275reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Google Security Operations action.
565 actions by area: the id your agent calls, what it does, and its effect.
Instance22
google_secops.instance.find_entityInstance: find entityreadgoogle_secops.instance.find_entity_alertsInstance: find entity alertsreadgoogle_secops.instance.find_related_entitiesInstance: find related entitiesreadgoogle_secops.instance.find_udm_field_valuesInstance: find udm field valuesreadgoogle_secops.instance.compute_all_findings_refinement_activitiesInstance: compute all findings refinement activitiesreadgoogle_secops.instance.extract_syslogInstance: extract syslogread- and 16 more in this area
Cases18
google_secops.cases.create_insightCases: create insightwritegoogle_secops.cases.getCases: getreadgoogle_secops.cases.listCases: listreadgoogle_secops.cases.patchCases: patchwritegoogle_secops.cases.add_tagCases: add tagwritegoogle_secops.cases.execute_bulk_add_tagCases: execute bulk add tagwrite- and 12 more in this area
Remote agents16
google_secops.remote_agents.connector_valid_remote_agentsRemote agents: connector valid remote agentsreadgoogle_secops.remote_agents.createRemote agents: createwritegoogle_secops.remote_agents.listRemote agents: listreadgoogle_secops.remote_agents.send_remote_agent_installerRemote agents: send remote agent installerwritegoogle_secops.remote_agents.deleteRemote agents: deletedestructivegoogle_secops.remote_agents.fetch_editable_remote_agentsRemote agents: fetch editable remote agentsread- and 10 more in this area
Integrations15
google_secops.integrations.createIntegrations: createwritegoogle_secops.integrations.download_dependencyIntegrations: download dependencywritegoogle_secops.integrations.fetch_affected_itemsIntegrations: fetch affected itemsreadgoogle_secops.integrations.listIntegrations: listreadgoogle_secops.integrations.deleteIntegrations: deletedestructivegoogle_secops.integrations.fetch_agent_integrationsIntegrations: fetch agent integrationsread- and 9 more in this area
Data table rows12
google_secops.data_table_rows.bulk_createData table rows: bulk createwritegoogle_secops.data_table_rows.bulk_create_asyncData table rows: bulk create asyncwritegoogle_secops.data_table_rows.createData table rows: createwritegoogle_secops.data_table_rows.listData table rows: listreadgoogle_secops.data_table_rows.bulk_getData table rows: bulk getreadgoogle_secops.data_table_rows.bulk_replaceData table rows: bulk replacewrite- and 6 more in this area
Native dashboards12
google_secops.native_dashboards.createNative dashboards: createwritegoogle_secops.native_dashboards.getNative dashboards: getreadgoogle_secops.native_dashboards.listNative dashboards: listreadgoogle_secops.native_dashboards.patchNative dashboards: patchwritegoogle_secops.native_dashboards.add_chartNative dashboards: add chartwritegoogle_secops.native_dashboards.deleteNative dashboards: deletedestructive- and 6 more in this area
Case alerts11
google_secops.case_alerts.create_recommendation_long_runningCase alerts: create recommendation long runningwritegoogle_secops.case_alerts.getCase alerts: getreadgoogle_secops.case_alerts.listCase alerts: listreadgoogle_secops.case_alerts.patchCase alerts: patchwritegoogle_secops.case_alerts.fetch_recommendationCase alerts: fetch recommendationreadgoogle_secops.case_alerts.get_alert_overview_dataCase alerts: get alert overview dataread- and 5 more in this area
Content packs10
google_secops.content_packs.addContent packs: addwritegoogle_secops.content_packs.deploy_connector_instancesContent packs: deploy connector instanceswritegoogle_secops.content_packs.deploy_playbooksContent packs: deploy playbookswritegoogle_secops.content_packs.deploy_test_casesContent packs: deploy test caseswritegoogle_secops.content_packs.align_playbooksContent packs: align playbookswritegoogle_secops.content_packs.deleteContent packs: deletedestructive- and 4 more in this area
Parsers10
google_secops.parsers.activateParsers: activatewritegoogle_secops.parsers.copyParsers: copywritegoogle_secops.parsers.createParsers: createwritegoogle_secops.parsers.listParsers: listreadgoogle_secops.parsers.activate_release_candidate_parserParsers: activate release candidate parserwritegoogle_secops.parsers.deactivateParsers: deactivatewrite- and 4 more in this area
Feeds9
google_secops.feeds.createFeeds: createwritegoogle_secops.feeds.generate_secretFeeds: generate secretwritegoogle_secops.feeds.import_push_logsFeeds: import push logswritegoogle_secops.feeds.listFeeds: listreadgoogle_secops.feeds.deleteFeeds: deletedestructivegoogle_secops.feeds.disableFeeds: disablewrite- and 3 more in this area
Custom lists8
google_secops.custom_lists.createCustom lists: createwritegoogle_secops.custom_lists.exportCustom lists: exportreadgoogle_secops.custom_lists.importCustom lists: importwritegoogle_secops.custom_lists.listCustom lists: listreadgoogle_secops.custom_lists.batch_deleteCustom lists: batch deletedestructivegoogle_secops.custom_lists.deleteCustom lists: deletedestructive- and 2 more in this area
Email templates8
google_secops.email_templates.createEmail templates: createwritegoogle_secops.email_templates.exportEmail templates: exportreadgoogle_secops.email_templates.importEmail templates: importwritegoogle_secops.email_templates.listEmail templates: listreadgoogle_secops.email_templates.batch_deleteEmail templates: batch deletedestructivegoogle_secops.email_templates.deleteEmail templates: deletedestructive- and 2 more in this area
Integrations actions8
google_secops.integrations_actions.createIntegrations actions: createwritegoogle_secops.integrations_actions.execute_testIntegrations actions: execute testwritegoogle_secops.integrations_actions.fetch_actions_by_environmentIntegrations actions: fetch actions by environmentreadgoogle_secops.integrations_actions.listIntegrations actions: listreadgoogle_secops.integrations_actions.deleteIntegrations actions: deletedestructivegoogle_secops.integrations_actions.fetch_templateIntegrations actions: fetch templateread- and 2 more in this area
Integrations connectors connector instances8
google_secops.integrations_connectors_connector_instances.createIntegrations connectors connector instances: createwritegoogle_secops.integrations_connectors_connector_instances.fetch_latest_definitionIntegrations connectors connector instances: fetch latest definitionreadgoogle_secops.integrations_connectors_connector_instances.getIntegrations connectors connector instances: getreadgoogle_secops.integrations_connectors_connector_instances.listIntegrations connectors connector instances: listreadgoogle_secops.integrations_connectors_connector_instances.deleteIntegrations connectors connector instances: deletedestructivegoogle_secops.integrations_connectors_connector_instances.patchIntegrations connectors connector instances: patchwrite- and 2 more in this area
Integrations integration instances8
google_secops.integrations_integration_instances.createIntegrations integration instances: createwritegoogle_secops.integrations_integration_instances.execute_testIntegrations integration instances: execute testwritegoogle_secops.integrations_integration_instances.fetch_affected_itemsIntegrations integration instances: fetch affected itemsreadgoogle_secops.integrations_integration_instances.listIntegrations integration instances: listreadgoogle_secops.integrations_integration_instances.deleteIntegrations integration instances: deletedestructivegoogle_secops.integrations_integration_instances.fetch_default_instanceIntegrations integration instances: fetch default instanceread- and 2 more in this area
Rules8
google_secops.rules.createRules: createwritegoogle_secops.rules.getRules: getreadgoogle_secops.rules.listRules: listreadgoogle_secops.rules.patchRules: patchwritegoogle_secops.rules.deleteRules: deletedestructivegoogle_secops.rules.get_deploymentRules: get deploymentread- and 2 more in this area
Soar networks8
google_secops.soar_networks.createSoar networks: createwritegoogle_secops.soar_networks.exportSoar networks: exportreadgoogle_secops.soar_networks.importSoar networks: importwritegoogle_secops.soar_networks.listSoar networks: listreadgoogle_secops.soar_networks.deleteSoar networks: deletedestructivegoogle_secops.soar_networks.delete_allSoar networks: delete alldestructive- and 2 more in this area
Case alert involved entities7
google_secops.case_alert_involved_entities.add_propertyCase alert involved entities: add propertywritegoogle_secops.case_alert_involved_entities.createCase alert involved entities: createwritegoogle_secops.case_alert_involved_entities.fetch_cardsCase alert involved entities: fetch cardsreadgoogle_secops.case_alert_involved_entities.listCase alert involved entities: listreadgoogle_secops.case_alert_involved_entities.getCase alert involved entities: getreadgoogle_secops.case_alert_involved_entities.patchCase alert involved entities: patchwrite- and 1 more in this area
Case queue filters7
google_secops.case_queue_filters.createCase queue filters: createwritegoogle_secops.case_queue_filters.getCase queue filters: getreadgoogle_secops.case_queue_filters.get_share_configCase queue filters: get share configreadgoogle_secops.case_queue_filters.listCase queue filters: listreadgoogle_secops.case_queue_filters.deleteCase queue filters: deletedestructivegoogle_secops.case_queue_filters.patchCase queue filters: patchwrite- and 1 more in this area
Dynamic parameters7
google_secops.dynamic_parameters.createDynamic parameters: createwritegoogle_secops.dynamic_parameters.exportDynamic parameters: exportreadgoogle_secops.dynamic_parameters.importDynamic parameters: importwritegoogle_secops.dynamic_parameters.listDynamic parameters: listreadgoogle_secops.dynamic_parameters.deleteDynamic parameters: deletedestructivegoogle_secops.dynamic_parameters.getDynamic parameters: getread- and 1 more in this area
Findings refinements7
google_secops.findings_refinements.compute_findings_refinement_activityFindings refinements: compute findings refinement activityreadgoogle_secops.findings_refinements.createFindings refinements: createwritegoogle_secops.findings_refinements.getFindings refinements: getreadgoogle_secops.findings_refinements.listFindings refinements: listreadgoogle_secops.findings_refinements.get_deploymentFindings refinements: get deploymentreadgoogle_secops.findings_refinements.patchFindings refinements: patchwrite- and 1 more in this area
Integrations connectors7
google_secops.integrations_connectors.createIntegrations connectors: createwritegoogle_secops.integrations_connectors.execute_testIntegrations connectors: execute testwritegoogle_secops.integrations_connectors.fetch_templateIntegrations connectors: fetch templatereadgoogle_secops.integrations_connectors.listIntegrations connectors: listreadgoogle_secops.integrations_connectors.deleteIntegrations connectors: deletedestructivegoogle_secops.integrations_connectors.getIntegrations connectors: getread- and 1 more in this area
Integrations jobs7
google_secops.integrations_jobs.createIntegrations jobs: createwritegoogle_secops.integrations_jobs.execute_testIntegrations jobs: execute testwritegoogle_secops.integrations_jobs.fetch_templateIntegrations jobs: fetch templatereadgoogle_secops.integrations_jobs.listIntegrations jobs: listreadgoogle_secops.integrations_jobs.deleteIntegrations jobs: deletedestructivegoogle_secops.integrations_jobs.getIntegrations jobs: getread- and 1 more in this area
Log types7
google_secops.log_types.createLog types: createwritegoogle_secops.log_types.generate_event_types_suggestionsLog types: generate event types suggestionsreadgoogle_secops.log_types.legacy_submit_parser_extensionLog types: legacy submit parser extensionwritegoogle_secops.log_types.listLog types: listreadgoogle_secops.log_types.get_log_type_settingLog types: get log type settingreadgoogle_secops.log_types.run_parserLog types: run parserread- and 1 more in this area
Ontology records visual families7
google_secops.ontology_records_visual_families.createOntology records visual families: createwritegoogle_secops.ontology_records_visual_families.exportOntology records visual families: exportreadgoogle_secops.ontology_records_visual_families.importOntology records visual families: importwritegoogle_secops.ontology_records_visual_families.listOntology records visual families: listreadgoogle_secops.ontology_records_visual_families.deleteOntology records visual families: deletedestructivegoogle_secops.ontology_records_visual_families.getOntology records visual families: getread- and 1 more in this area
Sla definitions7
google_secops.sla_definitions.createSla definitions: createwritegoogle_secops.sla_definitions.exportSla definitions: exportreadgoogle_secops.sla_definitions.importSla definitions: importwritegoogle_secops.sla_definitions.listSla definitions: listreadgoogle_secops.sla_definitions.deleteSla definitions: deletedestructivegoogle_secops.sla_definitions.getSla definitions: getread- and 1 more in this area
Soar domains7
google_secops.soar_domains.createSoar domains: createwritegoogle_secops.soar_domains.exportSoar domains: exportreadgoogle_secops.soar_domains.importSoar domains: importwritegoogle_secops.soar_domains.listSoar domains: listreadgoogle_secops.soar_domains.deleteSoar domains: deletedestructivegoogle_secops.soar_domains.getSoar domains: getread- and 1 more in this area
Case alert context properties6
google_secops.case_alert_context_properties.clear_allCase alert context properties: clear alldestructivegoogle_secops.case_alert_context_properties.createCase alert context properties: createwritegoogle_secops.case_alert_context_properties.getCase alert context properties: getreadgoogle_secops.case_alert_context_properties.listCase alert context properties: listreadgoogle_secops.case_alert_context_properties.deleteCase alert context properties: deletedestructivegoogle_secops.case_alert_context_properties.patchCase alert context properties: patchwrite
Case chat messages6
google_secops.case_chat_messages.createCase chat messages: createwritegoogle_secops.case_chat_messages.getCase chat messages: getreadgoogle_secops.case_chat_messages.listCase chat messages: listreadgoogle_secops.case_chat_messages.pin_messageCase chat messages: pin messagewritegoogle_secops.case_chat_messages.unpin_messageCase chat messages: unpin messagewritegoogle_secops.case_chat_messages.unread_messages_countCase chat messages: unread messages countread
Case context properties6
google_secops.case_context_properties.clear_allCase context properties: clear alldestructivegoogle_secops.case_context_properties.createCase context properties: createwritegoogle_secops.case_context_properties.getCase context properties: getreadgoogle_secops.case_context_properties.listCase context properties: listreadgoogle_secops.case_context_properties.deleteCase context properties: deletedestructivegoogle_secops.case_context_properties.patchCase context properties: patchwrite
Case tag definitions 6Context properties 6Environments 6Integrations connectors context properties 6Integrations jobs context properties 6Integrations jobs job instances 6Integrations managers 6Alert grouping rules 5Announcements 5Case close definitions 5Case comments 5Case stage definitions 5Data access labels 5Data access scopes 5Data exports 5Data tables 5Entities blocklists 5Environment groups 5Integrations managers revisions 5Legacy soar users workdesk contacts 5Legacy soar users workdesk links 5Legacy soar users workdesk notes 5Marketplace integrations 5Module settings properties 5Parser extensions 5Property schema definitions 5Request templates 5Saved column sets 5Soc roles 5Tasks 5Threat collections 5Unique entities 5Users saved column sets 5Users search queries 5Watchlists 5Case wall records 4Enrichment controls 4Events 4Integrations actions revisions 4Integrations connectors revisions 4Integrations jobs revisions 4Iocs 4Legacy soar users 4Legacy soar users user notifications 4Operations 4Reference lists 4System notifications 4Views 4Featured content native dashboards 3Form dynamic parameters 3Ioc associations 3Legacy soar users attachments 3Module settings 3Retrohunts 3Connector instance logs 2Dashboard charts 2Dashboard queries 2Entities 2Feed packs 2Job instance logs 2Log types logs 2Parser extension extension validation reports 2Big query export 1Coverage details 1Data table operation errors 1Featured content rules 1Feed service accounts 1Feed source type schemas 1Feed source type schemas log type schemas 1Forwarders 1Ingestion log labels 1Ingestion log namespaces 1Log types log type settings 1Parser extension validation errors 1Parser extension validation parsing errors 1Parser extension validation reports 1Parser validation parsing errors 1Parser validation reports 1Rule deployments 1Rule execution errors 1
This index shows a sample of each area. All 565 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Google Security Operations MCP server, answered.
Is there a Google Security Operations MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 565 Google Security Operations actions across instance, cases, remote agents and integrations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Google Security Operations.
What do I need to connect Google Security Operations?
Service account client email (`client_email` in the JSON key file) and Service account private key, PKCS#8 PEM (`private_key` in the JSON key file). Plus your host, your instance id, your location and your project id. The free call account { op: "connections.requirements", service: "google_secops" } lists exactly what to paste.
Can an AI agent delete or change things in Google Security Operations?
Only if its key allows it, and only with an explicit confirmation. 70 Google Security Operations actions are destructive, including case comments: delete, rules: delete and native dashboards: delete. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Google Security Operations API limit?
actionlake paces every call to the limits in the Google Security Operations service file: 5 calls a second per connection. Repeated reads are answered from cache (275 Google Security Operations actions can be), which never reaches Google Security Operations.
What does a Google Security Operations action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (102 Google Security Operations actions page). Cache hits, searches, dry runs and calls Google Security Operations refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Google Security Operations API does it cover?
The Chronicle API v1 (REST reference scraped 2026-10-23) at your Google Security Operations instance's API base URL, which you enter when connecting. It is built from Google Security Operations's documentation as read on 23 October 2026. 565 actions in 110 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Google Security Operations data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 2 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Google Security Operations credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Google Security Operations today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
