Symantec Data Center Security AIops
<!-- mcp-name: io.github.AIops-tools/symantec-dcs-aiops -->
# Symantec Data Center Security AIops
Independent audited MCP server, CLI and skill for management status, assets, alerts, events, policies, reports, roles, users and syslog. This initial release exposes 35 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.
> Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.
## Configure
```sh
export SYMANTEC_DCS_URL="..."
export SYMANTEC_DCS_USERNAME="..."
export SYMANTEC_DCS_PASSWORD="..."
```
`SYMANTEC_DCS_URL` must be the management console HTTPS origin (normally `https://host:4443`), without a path. Optional `SYMANTEC_DCS_CA_BUNDLE` points to a trusted CA bundle; `SYMANTEC_DCS_TIMEOUT` defaults to 30 seconds. Audit state defaults to `~/.symantec-dcs-aiops/` and can be relocated with `SYMANTEC_DCS_AIOPS_HOME`.
See the [operations catalog](docs/OPERATIONS.md) for the complete tool list, scope and deferred operations.
## Use
```sh
uvx --from symantec-dcs-aiops==0.1.0 symantec-dcs-aiops status server
uvx --from symantec-dcs-aiops==0.1.0 symantec-dcs-aiops-mcp
```
Use assets with a sort key to page through inventory; inspect asset-errors, alert-rules, events and policy-violations before making conclusions. See [verification](docs/VERIFICATION.md) for the exact evidence and unverified live behavior. No state-changing operations are exposed.
TDQS
Scored across 35 tools
Bare nouns force the agent to infer a singular=read-one / plural=list convention (dcs_policy vs dcs_policies, dcs_role vs dcs_roles), which the terse descriptions only partially clarify. Clusters like dcs_alerts / dcs_alert_rules / dcs_alert_stats / dcs_alert_details / dcs_alert_notifications, and dcs_tags vs dcs_asset_tags, have fuzzy boundaries that invite misselection.
Every tool uses the same dcs_ prefix and snake_case, and the singular/plural convention for get-vs-list is applied consistently across policies, roles, report jobs, and security groups. Minor deviations (dcs_status, dcs_syslogs) and the absence of explicit verbs keep it from a 5.
35 tools is heavy for a single server, and several are marginal variants of the same resource (dcs_policy_settings, dcs_policy_library, dcs_alert_details, dcs_alert_notifications, dcs_report_stats). The domain is broad, but the surface feels padded rather than curated.
Read coverage is genuinely broad — assets, alerts, events, policies, reports, RBAC, security groups, tags, syslog, licenses, users. However, the surface is entirely read-only, with no create/update/delete or policy-assignment operations for any managed resource, which is a notable gap if this is meant to drive an ops workflow rather than pure observability.