Use of MCP in Playbooks

Technically this might be possible, however I question the workflow.  The three ways are here:

1. agentic workflow is being built natively into the solution for the same interactive user experience. However this will be an experience designed for Google portolio workflows
2. SecOps offers MCP for users in other platforms to involve SecOps in their MCP workflow
3. Playboks have Vertex (as you say) for building AI into a playbook

MCP is /typically/ an interactive conversation with a LLM, but playbooks wouldn’t necessarily do this.  If you want the playbook to ask MCP to do a list of things… the playbook can already do that. 

So there is no OOTB drag and drop for this today, you could build one, but I wonder if that is the most effective way to accomplish what you are hoping :)

MCP is SOAR is in effect two actions: 1) an out of box or custom SOAR action + 2) Vertex AI prompt that runs on that actions results.  If a MCP has (1) for something in SOAR that doesn’t exist today may be of use, but running the action and using your own prompt may be more effective.  In either case, for the MCP you would be entering your API credentials to call a LLM, so as Andy says, not sure it immediately offers more value than just building it into the playbook, other than if the MCP has Actions that aren’t in SOAR currently.