Symantec Cloud DLP AIops

io.github.AIops-toolsPublished by GitHub account AIops-toolsv0.1.0Updated Nov 6, 2026

Governed Symantec Cloud DLP — 14 MCP tools, read-only with audit.

VerifiedSTDIODesktop onlySecurity & MonitoringData & Analytics

Overview

AI-generated overview

Read-only MCP server and CLI exposing 14 governed tools for Symantec CloudSOC DLP incidents, profiles, detection patterns and index health.

What you can do
  • Search and page through DLP incidents within a bounded time window using a search-after cursor
  • Inspect DLP profiles, detection patterns and data identifiers
  • Check index health and surface raw API response shapes
  • Record a local audit event for every MCP and CLI call
When to use it
Useful when an assistant needs to investigate Symantec CloudSOC DLP incidents, review profiles and detection patterns, or check index health without changing anything in the tenant.
Requirements
Runs locally as a Python package (uvx or pip). Needs environment variables SYMANTEC_CLOUDDLP_URL (CloudSOC HTTPS origin, no path), SYMANTEC_CLOUDDLP_KEY_ID, SYMANTEC_CLOUDDLP_KEY_SECRET and SYMANTEC_CLOUDDLP_TENANT; optional SYMANTEC_CLOUDDLP_CA_BUNDLE, SYMANTEC_CLOUDDLP_TIMEOUT and SYMANTEC_CLOUDDLP_AIOPS_HOME. Network access to the CloudSOC tenant is required.
Before you install
Requires API key ID and secret for the DLP tenant, which are read from environment variables. Every call writes a local audit event under ~/.symantec-clouddlp-aiops/ by default. Only read-only tools are exposed, but profile response schemas are weakly specified and live behavior is described as unverified. It is a community project, not affiliated with or endorsed by Broadcom or Symantec.

Installation

In SourceWeft

  1. Open Symantec Cloud DLP AIops in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Symantec Cloud DLP AIops

Independent audited MCP server, CLI and skill for CloudSOC DLP incidents, profiles, detection patterns, data identifiers and index health. This initial release exposes 14 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

sh
export SYMANTEC_CLOUDDLP_URL="..."export SYMANTEC_CLOUDDLP_KEY_ID="..."export SYMANTEC_CLOUDDLP_KEY_SECRET="..."export SYMANTEC_CLOUDDLP_TENANT="..."

SYMANTEC_CLOUDDLP_URL must be the CloudSOC HTTPS origin (https://app.elastica.net or https://app.eu.elastica.net), without a path. Optional SYMANTEC_CLOUDDLP_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_CLOUDDLP_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-clouddlp-aiops/ and can be relocated with SYMANTEC_CLOUDDLP_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Use

sh
uvx --from symantec-clouddlp-aiops==0.1.0 symantec-clouddlp-aiops profilesuvx --from symantec-clouddlp-aiops==0.1.0 symantec-clouddlp-aiops-mcp

Search incidents in a bounded time window and follow the search-after cursor. Profile API response schemas are weakly specified, so raw response shape is surfaced explicitly. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.

Source: README.md at commit a29e1e0

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

1
  1. v0.1.0LatestNov 6, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts