Symantec Endpoint Detection and Response (on-premises) AIops

io.github.AIops-toolsPublished by GitHub account AIops-toolsv0.1.0Updated Nov 6, 2026

Governed Symantec on-prem EDR — 20 MCP tools, read-only with audit.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Read-only MCP server for investigating on-premises Symantec EDR: incidents, events, entities, threat feeds, policy lists and sandbox results, with local audit…

What you can do
  • Search and review incidents and events, with time windows and cursor pagination
  • Look up entities, threat feeds, policy lists and sandbox results
  • Run the same governed functions from the MCP server or the bundled CLI
  • Record a local audit event for every call
When to use it
Useful when an assistant needs to help with security investigations against an on-premises Symantec EDR appliance and you want read-only access with an audit trail, rather than a console session.
Requirements
Runs locally as a Python package (uvx or pip). Needs network access to the on-premises appliance HTTPS origin, plus SYMANTEC_EDR_URL, SYMANTEC_EDR_CLIENT_ID and SYMANTEC_EDR_CLIENT_SECRET. Optional SYMANTEC_EDR_CA_BUNDLE, SYMANTEC_EDR_TIMEOUT and SYMANTEC_EDR_AIOPS_HOME. Desktop only.
Before you install
Requires API client credentials (SYMANTEC_EDR_CLIENT_ID and SYMANTEC_EDR_CLIENT_SECRET) for your EDR tenant; keep them in environment variables and out of shared configs. Calls write audit records to a local directory (~/.symantec-edr-aiops/ by default). Only 20 read-only tools are exposed and no state-changing operations are available; the project is community-maintained and not affiliated with Broadcom or Symantec.

Installation

In SourceWeft

  1. Open Symantec Endpoint Detection and Response (on-premises) AIops in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Symantec Endpoint Detection and Response (on-premises) AIops

Independent audited MCP server, CLI and skill for on-premises EDR investigations, entities, threat feeds, policy lists and sandbox results. This initial release exposes 20 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

sh
export SYMANTEC_EDR_URL="..."export SYMANTEC_EDR_CLIENT_ID="..."export SYMANTEC_EDR_CLIENT_SECRET="..."

SYMANTEC_EDR_URL must be the on-premises appliance HTTPS origin (including port if needed, without a path). Optional SYMANTEC_EDR_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_EDR_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-edr-aiops/ and can be relocated with SYMANTEC_EDR_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Use

sh
uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops appliancesuvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops-mcp

Search incidents and events over at most 30 days, audit events over at most seven days; use the returned opaque next cursor for pagination. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.

Source: README.md at commit 06f3a75

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

1
  1. v0.1.0LatestNov 6, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts