google · dandye · Jun 25, 2025 · Jun 25, 2025
diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # Google Security Operations and Threat Intelligence MCP Server
 
-This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop or the cline.bot VS Code extension) to access Google's security products and services:
+This repository contains Model Context Protocol (MCP) servers that enable MCP clients (like Claude Desktop, Gemini CLI, or the cline.bot VS Code extension) to access Google's security products and services:
 
 1. **Google Security Operations (Chronicle)** - For threat detection, investigation, and hunting
 2. **Google Security Operations SOAR** - For security orchestration, automation, and response
@@ -34,10 +34,10 @@ The server uses Google's authentication. Make sure you have either:
 
 ## Client Configurations
 The MCP servers from this repo can be used with the following clients
-1. Cline, Claude Desktop, and other MCP supported clients
+1. Cline, Claude Desktop, Gemini CLI, and other MCP supported clients
 2. [Google ADK(Agent Development Kit)](https://google.github.io/adk-docs/) Agents (a prebuilt agent is provided, details [below](#using-the-prebuilt-google-adk-agent-as-client))
 
-The configuration for Claude Desktop and Cline is the same (provided below for [uv](#using-uv-recommended) and [pip](#using-pip)).  We use the stdio transport.
+The configuration for Claude Desktop, Gemini CLI, and Cline is similar (provided below for [uv](#using-uv-recommended) and [pip](#using-pip)).  We use the stdio transport.
 
 ### Using the prebuilt Google ADK agent as client
 
@@ -46,6 +46,8 @@ Please refer to the [README file](./run-with-google-adk/README.md) for both - lo
 
 ### Using uv (Recommended)
 
+#### Claude Desktop / Cline Configuration / Gemini CLI
+
 ```json
 {
   "mcpServers": {
@@ -136,6 +138,8 @@ You can also use pip instead of uv to install and run the MCP servers. This appr
 2. Install the package in development mode
 3. Run the server binary
 
+#### Claude Desktop / Cline Configuration
+
 ```json
 {
   "mcpServers": {
@@ -203,6 +207,7 @@ You can also use pip instead of uv to install and run the MCP servers. This appr
 }
 ```
 
+
 ### When to use uv vs pip
 
 - **uv**: Recommended for most users because it offers faster package installation, better dependency resolution, and isolated environments. It also supports loading environment variables from a file.
@@ -255,6 +260,16 @@ To use the MCP servers with Claude Desktop:
 2. Update your `cline_mcp_settings.json` with the configuration (replace paths with your actual paths)
 3. Save the file and restart VS Code
 
+### Installing in Gemini CLI
+
+To use the MCP servers with Gemini CLI:
+
+1. Install Gemini CLI following [the official documentation](https://github.com/google-gemini/gemini-cli)
+2. Configure your MCP servers in the Gemini configuration file (typically `~/.gemini/settings.json` or as specified in your Gemini setup)
+3. Use the configuration examples provided above for uv
+4. Ensure all required environment variables are set or included in the configuration
+5. Start Gemini CLI - it will automatically connect to the configured MCP servers
+
 ## License
 
 Apache 2.0
diff --git a/docs/index.md b/docs/index.md
@@ -1,6 +1,6 @@
 # Google MCP Security Documentation
 
-Welcome to the documentation for the Google MCP Security project. This project provides Model Context Protocol (MCP) servers that enable MCP-compatible AI assistants like Claude to access Google's security products and services.
+Welcome to the documentation for the Google MCP Security project. This project provides Model Context Protocol (MCP) servers that enable MCP-compatible AI assistants like Gemini CLI and Claude Desktop|Code to access Google's security products and services.
 
 ## Project Overview
 

diff --git a/docs/servers/gti_mcp.md b/docs/servers/gti_mcp.md
@@ -2,6 +2,8 @@
 
 This server provides tools for interacting with the Google Threat Intelligence (VirusTotal) API.
 
+**Supported Clients:** Gemini CLI, Claude Desktop|Code, Cline, etc.
+
 ## Configuration
 
 To use this server, you need a VirusTotal API key:
@@ -12,7 +14,7 @@ To use this server, you need a VirusTotal API key:
 
 ### MCP Server Configuration
 
-Add the following configuration to your MCP client's settings file:
+Add the following configuration to your client's MCP settings file:
 
 ```json
 "gti": {
@@ -31,6 +33,7 @@ Add the following configuration to your MCP client's settings file:
     }
 ```
 
+
 #### `--env-file`
 
 Recommended: use the `--env-file` option in `uv` to move your secrets to an `.env` file for environment variables. You can create this file or use system environment variables as described below.

diff --git a/docs/servers/scc_mcp.md b/docs/servers/scc_mcp.md
@@ -2,6 +2,8 @@
 
 This server provides tools for interacting with Google Cloud Security Command Center (SCC) and Cloud Asset Inventory (CAI).
 
+**Supported Clients:** Gemini CLI, Claude Desktop|Code, Cline, etc.
+
 ## Configuration
 
 This server requires Google Cloud authentication to access SCC and CAI APIs:
@@ -35,8 +37,6 @@ Add the following configuration to your MCP client's settings file:
       "env": {},
       "disabled": false,
       "autoApprove": []
-      "disabled": false,
-      "autoApprove": []
     }
 ```
 

diff --git a/docs/servers/secops_mcp.md b/docs/servers/secops_mcp.md
@@ -2,6 +2,8 @@
 
 This server provides tools for interacting with Chronicle Security Operations using the `secops-py` library.
 
+**Supported Clients:** Gemini CLI, Claude Desktop|Code, Cline, etc.
+
 > This MCP server is built on top of the official [Google SecOps SDK for Python](https://github.com/google/secops-wrapper), which provides a comprehensive wrapper for Google Security Operations APIs.
 
 ## Configuration
@@ -14,6 +16,7 @@ This server provides tools for interacting with Chronicle Security Operations us
 
 ### MCP Server Configuration
 
+
 Add the following configuration to your MCP client's settings file:
 
 ```json
@@ -32,8 +35,6 @@ Add the following configuration to your MCP client's settings file:
       },
       "disabled": false,
       "autoApprove": []
-      "disabled": false,
-      "autoApprove": []
     }
 ```
 

diff --git a/docs/servers/secops_soar_mcp.md b/docs/servers/secops_soar_mcp.md
@@ -2,6 +2,8 @@
 
 This server provides tools for interacting with a Security Orchestration, Automation, and Response (SOAR) platform, specifically Google SecOps SOAR (formerly Siemplify). It includes core case management functionalities and dynamically loads integration-specific tools.
 
+**Supported Clients:** Gemini CLI, Claude Desktop|Code, Cline, etc.
+
 ## Configuration
 
 ### Prerequisites
@@ -18,7 +20,6 @@ Add the following configuration to your MCP client's settings file:
 "secops-soar": {
       "command": "uv",
       "args": [
-
         "--directory",
         "/path/to/the/repo/server/secops-soar",
         "run",
@@ -31,9 +32,6 @@ Add the following configuration to your MCP client's settings file:
         "SOAR_APP_KEY": "your-soar-api-key"
       },
       "disabled": false,
-      "autoApprove": []
-          },
-      "disabled": false,
       "autoApprove": []
     }
 ```

diff --git a/docs/usage_guide.md b/docs/usage_guide.md
@@ -1,6 +1,6 @@
 # Using the Google Security MCP Servers
 
-This guide will help you get started with using the MCP servers to access Google's security products and services from Claude Desktop or other MCP-compatible clients.
+This guide will help you get started with using the MCP servers to access Google's security products and services from Gemini CLI, Claude Desktop|Code, Cline, or other MCP-compatible clients.
 
 ## Prerequisites
 
@@ -20,7 +20,9 @@ Before you begin, make sure you have:
      - `CHRONICLE_REGION` is also needed if not=`us`.
 
 3. **An MCP client** such as:
+   - [Gemini CLI](https://github.com/google-gemini/gemini-cli)
    - [Claude Desktop](https://claude.ai/download)
+   - [Claude Code](https://www.anthropic.com/claude-code)
    - [cline.bot](https://cline.bot/) [VS Code extension](https://marketplace.visualstudio.com/items?itemName=saoudrizwan.claude-dev)
    - [Google ADK(Agent Development Kit)](https://google.github.io/adk-docs/) based agent (a prebuilt one is provided)
 
@@ -63,6 +65,14 @@ Detailed instructions are provided [here](https://github.com/google/mcp-security
 2. Update your `cline_mcp_settings.json` with the appropriate configuration. See [sample on GitHub](https://github.com/google/mcp-security/blob/main/cline_mcp_settings.json.example)
 3. Restart VS Code
 
+#### For Gemini CLI:
+
+1. Install Gemini CLI following the [official documentation](https://github.com/google-gemini/gemini-cli)
+2. Configure your MCP servers in the Gemini configuration file (typically `~/.gemini/settings.json` or as specified in your Gemini setup)
+3. Use the same configuration format as shown below for Claude Desktop/cline
+4. Ensure all required environment variables are set before starting Gemini CLI
+5. Gemini CLI will automatically connect to the configured MCP servers when started
+
 ### Step 3: Using the Tools
 
 Once configured, you can interact with the MCP servers by asking Claude to perform specific security tasks:
@@ -74,7 +84,7 @@ Once configured, you can interact with the MCP servers by asking Claude to perfo
 
 ## MCP Server Configuration Reference
 
-Here's a complete reference configuration for all available MCP servers. However, we strongly recommend using environment variables instead of hardcoding sensitive information like API keys:
+Here's a complete reference configuration for all available MCP servers. This configuration format works with Gemini CLI, Claude Desktop|Code, and cline. However, we strongly recommend using environment variables instead of hardcoding sensitive information like API keys:
 
 **NOTE:** For OSX users, if you used [this one-liner](https://docs.astral.sh/uv/getting-started/installation/#standalone-installer) to install uv, use the full path to the uv binary for the "command" value below, as uv will not be placed in the system path for Claude to use! For example: `/Users/yourusername/.local/bin/uv` instead of just `uv`.