Step 2: Project and Repository Setup

With the workspace configured, let's set up the project and clone the repository.

Open a terminal in Firebase Studio’s VSCode by clicking on the hamburger menu > View > Terminal (you can also use the terminal shortcut by holding Ctrl and pressing the backtick button `).

2. We’ll create a project directory for your use case and navigate into it. For this example, we'll use tier1-demo.

# Replace `tier1-demo` with your desired project directory name
install -d -m 755 tier1-demo
cd tier1-demo

3. Now, clone the mcp-security repository from GitHub into this directory and navigate to it.

git clone https://github.com/google/mcp-security.git
cd mcp-security

Step 3: Environment Configuration

Next, we'll configure the environment variables for the MCP servers and install the required tools.

1. Create a .env file in the root of the mcp-security directory you just cloned with the following command:.

# Make sure you are in the 'mcp-security' directory
# This command creates an empty file .env with correct permissions
install -m 644 /dev/null .env

2. Open the newly created .env file with your favorite code editor in Firebase Studio. I prefer to use the VSCode editor in Firebase Studio  by running the code .env command.

3. Paste in the content from the .env.example below into your new .env file:

# Google SecOps SIEM Configuration using IAM permissions of the
# Firebase Studio user logged in

CHRONICLE_PROJECT_ID="your-gcp-project-id"
CHRONICLE_CUSTOMER_ID="your-chronicle-customer-uuid"
CHRONICLE_REGION="us"

# Google SecOps SOAR Configuration
SOAR_URL="https://your-soar-instance.siemplify-soar.com:443"
SOAR_APP_KEY="your-soar-application-key-uuid"

# Google Threat Intelligence/VirusTotal API Configuration
# Get your API key from https://www.virustotal.com/gui/my-apikey
VT_APIKEY="your-virustotal-api-key-64-characters"

# SSL Certificate Configuration
# Path to SSL certificate bundle for secure connections
SSL_CERT_FILE="/path/to/your/ssl/ca-bundle.crt"

Now, let’s review where we can find these configuration values, and please ensure to preserve the quotation marks when pasting in the values.

1. The CHRONICLE_PROJECT_ID and the CHRONICLE_CUSTOMER_ID can be found in your Google SecOps SIEM console by navigating to the SIEM Settings > Profile

2. While not immediately obvious in the UI, using your browser’s developer tools is a reliable way to uncover your unique SOAR_URL for your environment. 
   • With the Google SecOps console in the current browser window, the SOAR_URL can be found by opening the web browser developer tools (in Chrome that is View > Developer > Developer Tools > Network Tab) and typing siemplify-soar into the search filter to filter requests that include this string.  You may need to click the refresh button in the Developer Tools page (or refresh the page altogether) to see requests be generated. 
   • Click on any request to open the “Headers” preview tab, and you will see a field named “Request URL” that contains a prefix with your unique siemplify-soar.com domain. 
   • Copy the unique code prefix in front of .siemplify-soar.com, and replace the your-soar-instance part of the SOAR_URL in the .env file.

3. The SOAR_APP_KEY can be created by going to the Google SecOps SOAR console > SOAR Settings > Advanced > API Keys and clicking the + button in the top right corner.  Be sure to copy the key before saving and closing the window in Google SecOps, and ensuring this key is associated with the correct Permission Group to invoke SOAR APIs.
4. The VT_APIKEY API key can be found by copying the key found at https://www.virustotal.com/gui/my-apikey
5. Lastly, we need to run the echo $SSL_CERT_FILE command in the terminal and copy the full output path. We’ll update the placeholder values in the .env file with the copied path and paste it for the value of SSL_CERT_FILE. This is the path that we dynamically set at runtime in our dev.nix file

Next, we need to install uv, a fast Python package manager, and then use it to install a version of Python in your workspace.  We could alternatively use pip here (note that this guide uses uv), but there are many advantages to using uv, including the ability for it to handle virtual environments automatically for us. If you’re new to using uv, this repo is a fantastic resource.

# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh
# Add uv to the current session PATH
source $HOME/.local/bin/env
# Install latest version of Python (can optionally specify version)
uv python install

Quick Note: We install uv this way to ensure we're getting the latest version. The "correct" NixOS way to do this would be to add pkgs.uv and pkgs.python3 to the dev.nix file and have them installed declaratively. The problem is the default NixOS release channel often has an older version of uv that doesn't support the --directory flag, which is necessary for the Google Security MCP servers to launch. While you could change the release channel to get a newer version, this curl method is the most reliable way to get the latest version of uv.

 

Step 4: Cline and MCP Server Configuration

 

Finally, let's install and configure the Cline VSCode extension to bring our MCP servers to life.

1. In the VSCode Activity Bar (left pane), go to Extensions, search for "Cline", and click Install.

2. Open Cline from the Activity Bar, click "Use your own API Key", and configure it with your preferred LLM provider. You can get a Google Gemini API key from AI Studio if needed.  This step gives Cline the ability to work with LLMs.
3. In Cline's settings, we recommend disabling "Anonymous usage collection" and setting the “MCP Display Mode” to “plain text” for security use cases to prevent any potentially malicious domains from being automatically resolved (your IT/SOC teams will thank you).

4. Navigate to the MCP server configuration section in Cline (it looks like a server icon) and click Configure MCP Servers. This will open a cline_mcp_settings.json file.

5. Replace the entire contents of this file with the configuration below and fill out the correct values for the placeholders (find and replace all is useful here). .

Caution: Double-check that the file paths in the args arrays match your Firebase Studio workspace and project directory names. If you used different names, you will need to replace the YOUR-WORKSPACE-NAME (e.g. security-mcp-demo in this guide) and YOUR-PROJECT-DIR (e.g. tier1-demo in this guide) placeholders in the paths with your actual workspace and project directory names. For example, if you named your workspace security-mcp-demo and your project directory tier1-demo, as in this guide’s example, the path for the 'secops' MCP server would be "/home/user/security-mcp-demo/tier1-demo/mcp-security/server/secops/secops_mcp”

 

{
  "mcpServers": {
    "secops": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 60,
      "type": "stdio",
      "command": "/home/user/.local/bin/uv",
      "args": [
        "--directory",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/server/secops/secops_mcp",
        "run",
        "--env-file",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/.env",
        "server.py"
      ]
    },
    "secops-soar": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 60,
      "type": "stdio",
      "command": "/home/user/.local/bin/uv",
      "args": [
        "--directory",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/server/secops-soar/secops_soar_mcp",
        "run",
        "--env-file",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/.env",
        "server.py"
      ]
    },
    "gti": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 60,
      "type": "stdio",
      "command": "/home/user/.local/bin/uv",
      "args": [
        "--directory",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/server/gti/gti_mcp",
        "run",
        "--env-file",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/.env",
        "server.py"
      ]
    },
    "scc-mcp": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 60,
      "type": "stdio",
      "command": "/home/user/.local/bin/uv",
      "args": [
        "--directory",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/server/scc",
        "run",
        "--env-file",
        "/home/user/YOUR-WORKSPACE-NAME/YOUR-PROJECT-DIR/mcp-security/.env",
        "scc_mcp.py"
      ]
    }
  }
}

6. Save the cline_mcp_settings.json file. The MCP servers will now begin to initialize in Cline. This might take a few minutes the first time as their dependencies are installed.
7. Once complete, the servers will show a green status light. You can expand each one to see the available tools.

 

Conclusion: You're Ready to Build!

 

That's it! You are now fully set up to use the Google Security MCP servers in Firebase Studio. You've bypassed the common setup hurdles and now have a powerful, extensible environment for building and testing your own agentic security use cases.

The Google Threat Intelligence and Google SecOps SOAR MCP servers currently use API keys, which grant the entire permission scope defined by a single role.  It is important to understand that anyone who has access to these MCP servers, can run these respective tools, and ultimately, the underlying APIs based on the associated scope.  The typical API key security considerations are still at play, as well as proper guard rails (e.g. including a human-in-the-loop for high fidelity or high risk actions).

We encourage you to explore and contribute to the google/mcp-security repository, experiment with the examples, and start thinking about how you can use natural language to truly ‘supercharge’ your security workflows.

Have questions or want to share what you've built? Join the conversation in the Google Cloud Security Community!