mcpField
S
Symantec Cloud DLP AIops

Symantec Cloud DLP AIops

Local
github.com/AIops-toolsSecurity0Updated 5d ago
Repository

About Symantec Cloud DLP AIops

Symantec Cloud DLP AIops is a community-maintained MCP server, CLI, and skill for CloudSOC DLP data. It provides read-only operations with TLS verification and a local audit record for each call.

Key features

  1. 01Query DLP incidents and profiles
  2. 02Inspect detection patterns and data identifiers
  3. 03Check index health
  4. 04Run queries through the CLI
  5. 05Record a local audit event per call

Use cases

  1. 01Search DLP incidents in a bounded time window
  2. 02Review profiles and detection patterns
  3. 03Check index health and call records

MCP support

The MCP server exposes 14 read-only tools for CloudSOC DLP incidents, profiles, detection patterns, data identifiers, and index health. MCP and CLI use the same governed functions.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "aiops-tools-symantec-clouddlp-aiops": {
      "command": "uvx",
      "args": [
        "symantec-clouddlp-aiops"
      ]
    }
  }
}
Run commanduvx symantec-clouddlp-aiops

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypisymantec-clouddlp-aiops0.1.0

Tools

14

Saved tool list · updated 5d ago

ParameterTypeRequiredDescription
querystringNo

Details

From the project README

Symantec Cloud DLP AIops

Independent audited MCP server, CLI and skill for CloudSOC DLP incidents, profiles, detection patterns, data identifiers and index health. This initial release exposes 14 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

export SYMANTEC_CLOUDDLP_URL="..."
export SYMANTEC_CLOUDDLP_KEY_ID="..."
export SYMANTEC_CLOUDDLP_KEY_SECRET="..."
export SYMANTEC_CLOUDDLP_TENANT="..."

SYMANTEC_CLOUDDLP_URL must be the CloudSOC HTTPS origin (https://app.elastica.net or https://app.eu.elastica.net), without a path. Optional SYMANTEC_CLOUDDLP_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_CLOUDDLP_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-clouddlp-aiops/ and can be relocated with SYMANTEC_CLOUDDLP_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Use

uvx --from symantec-clouddlp-aiops==0.1.0 symantec-clouddlp-aiops profiles
uvx --from symantec-clouddlp-aiops==0.1.0 symantec-clouddlp-aiops-mcp

Search incidents in a bounded time window and follow the search-after cursor. Profile API response schemas are weakly specified, so raw response shape is surfaced explicitly. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.