Skip to main content
Glama
Sign In
io.github.AIops-tools/symantec-edr-aiops

io.github.AIops-tools/symantec-edr-aiops

by AIops-tools
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Symantec Endpoint Detection and Response (on-premises) AIops

Independent audited MCP server, CLI and skill for on-premises EDR investigations, entities, threat feeds, policy lists and sandbox results. This initial release exposes 20 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

export SYMANTEC_EDR_URL="..."
export SYMANTEC_EDR_CLIENT_ID="..."
export SYMANTEC_EDR_CLIENT_SECRET="..."

SYMANTEC_EDR_URL must be the on-premises appliance HTTPS origin (including port if needed, without a path). Optional SYMANTEC_EDR_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_EDR_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-edr-aiops/ and can be relocated with SYMANTEC_EDR_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Related MCP server: LimaCharlie MCP

Use

uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops appliances
uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops-mcp

Search incidents and events over at most 30 days, audit events over at most seven days; use the returned opaque next cursor for pagination. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Related MCP Servers

  • Purple AI MCP Server

    wojtekkura
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables read-only access to SentinelOne's platform through MCP, allowing security investigations, threat hunting, and asset inventory queries via natural language.
    MIT

  • LimaCharlie MCP

    geoffbelknap
    A
    license
    C
    quality
    D
    maintenance
    A local MCP server for the LimaCharlie security platform that provides investigation, administration, and content-review workflows via a broad read-only tool surface with explicit organization scoping and audit logging.
    100
    MIT

  • openstack-incidents

    jiang369-lucky
    A
    license
    B
    quality
    C
    maintenance
    Enables MCP-compatible agents to perform read-only incident investigations by querying logs, building timelines, searching runbooks, validating evidence, and creating ticket drafts only with explicit approval.
    7
    MIT

  • Darktrace MCP

    nuoframework
    A
    license
    Not graded
    quality
    A
    maintenance
    Enables investigation of devices, model breaches and analyst incidents from an MCP host through a bounded set of read-only tools, with operator-controlled profiles and a fixed operation inventory. Writes, PCAP export, email and HTTP transport are excluded, and responses are minimized and escaped before entering model context.
    17 npm
    2
    Apache 2.0