mcpField
S
Symantec Endpoint Detection and Response (on-premises) AIops

Symantec Endpoint Detection and Response (on-premises) AIops

Local
github.com/AIops-toolsSecurity0Updated 5d ago
Repository

About Symantec Endpoint Detection and Response (on-premises) AIops

Symantec Endpoint Detection and Response (on-premises) AIops is an audited MCP server, CLI, and skill for on-premises EDR investigations. Its 20 read-only tools cover investigations, entities, threat feeds, policy lists, and sandbox results, and record local audit events for calls.

Key features

  1. 0120 read-only MCP tools
  2. 02On-premises EDR investigation queries
  3. 03Entity and threat-feed access
  4. 04Policy-list and sandbox-result queries
  5. 05Local audit event for every call

Use cases

  1. 01Investigate incidents and events
  2. 02Review entities and threat feeds
  3. 03Check policy lists and sandbox results

MCP support

Exposes 20 read-only on-premises EDR operations to MCP clients. MCP and CLI use the same governed functions, and each call records a local audit event.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "aiops-tools-symantec-edr-aiops": {
      "command": "uvx",
      "args": [
        "symantec-edr-aiops"
      ]
    }
  }
}
Run commanduvx symantec-edr-aiops

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypisymantec-edr-aiops0.1.0

Tools

20

Saved tool list · updated 5d ago

This tool takes no parameters.

Details

From the project README

Symantec Endpoint Detection and Response (on-premises) AIops

Independent audited MCP server, CLI and skill for on-premises EDR investigations, entities, threat feeds, policy lists and sandbox results. This initial release exposes 20 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

export SYMANTEC_EDR_URL="..."
export SYMANTEC_EDR_CLIENT_ID="..."
export SYMANTEC_EDR_CLIENT_SECRET="..."

SYMANTEC_EDR_URL must be the on-premises appliance HTTPS origin (including port if needed, without a path). Optional SYMANTEC_EDR_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_EDR_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-edr-aiops/ and can be relocated with SYMANTEC_EDR_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Use

uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops appliances
uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops-mcp

Search incidents and events over at most 30 days, audit events over at most seven days; use the returned opaque next cursor for pagination. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.