自主安全运营服务器

curl -sL https://raw.githubusercontent.com/dadohen/MCP-Boss/main/setup.sh | bash -s -- \
  --project your-project-id \
  --customer your-secops-customer-id \
  --gti-key your-vt-api-key

chmod +x setup.sh && ./setup.sh

git clone https://github.com/dadohen/MCP-Boss.git
cd MCP-Boss && ./setup.sh

┌──────────────────────────────────────────────────────────────┐
│                     USER INTERFACES                          │
│   Web UI  ·  Gemini CLI  ·  Claude Desktop  ·  Mobile App   │
└──────────────────────┬───────────────────────────────────────┘
                       │
          ┌────────────┴────────────┐
          │ /api/chat (Web UI)      │  ← Multi-turn orchestration
          │ /mcp     (Gemini CLI)   │  ← Streamable HTTP
          │ /sse     (Claude/MCP)   │  ← SSE transport
          └────────────┬────────────┘
                       │
┌──────────────────────▼───────────────────────────────────────┐
│              MCP Boss Server (Cloud Run)                      │
│              89 Tools · Python · FastMCP · Serverless         │
│                                                              │
│  🔍 Discovery    🧠 Intel       🛡️ Detection    📂 SOAR     │
│  ├─ SCC          ├─ GTI/VT      ├─ YARA-L       ├─ Cases    │
│  ├─ Cloud Log    ├─ Malware     ├─ Rules         ├─ Playbooks│
│  ├─ UDM Search   ├─ Actors      ├─ Alerts        ├─ Actions  │
│  ├─ Ingestion    └─ Vertex AI   └─ Data Tables   └─ Metrics  │
│                                                              │
│  📧 Containment  ☁️ Cloud        📊 Analytics                │
│  ├─ O365 Purge   ├─ AWS Keys    ├─ BigQuery                 │
│  ├─ Okta         ├─ GCP SA      ├─ MTTx Metrics             │
│  ├─ Azure AD     ├─ STS Revoke  ├─ Audit Logs               │
│  └─ CrowdStrike  └─ IAM Review  └─ Cloud Monitoring         │
└──────────────────────────────────────────────────────────────┘
                       │
          ┌────────────┴────────────┐
          │  Google Cloud APIs       │
          │  Chronicle · SCC · GTI   │
          │  Vertex AI · BigQuery    │
          │  Cloud Logging · IAM     │
          │  Cloud Monitoring        │
          └─────────────────────────┘

# Remove unauthenticated access
gcloud run services remove-iam-policy-binding mcp-boss \
  --member="allUsers" \
  --role="roles/run.invoker" \
  --project=$PROJECT_ID \
  --region=us-central1

# Grant access to specific users only
gcloud run services add-iam-policy-binding mcp-boss \
  --member="user:analyst@yourcompany.com" \
  --role="roles/run.invoker" \
  --project=$PROJECT_ID \
  --region=us-central1

# Grant access to a Google Group (for SOC team)
gcloud run services add-iam-policy-binding mcp-boss \
  --member="group:soc-team@yourcompany.com" \
  --role="roles/run.invoker" \
  --project=$PROJECT_ID \
  --region=us-central1

# From browser — use Cloud Run Proxy:
gcloud run services proxy mcp-boss --project=$PROJECT_ID --region=us-central1
# Opens http://localhost:8080 → authenticated tunnel to your service

# From curl/API:
TOKEN=$(gcloud auth print-identity-token)
curl -H "Authorization: Bearer $TOKEN" https://YOUR-SERVICE-URL/health

# From Gemini CLI:
TOKEN=$(gcloud auth print-identity-token)
gemini --tool-endpoint https://YOUR-SERVICE-URL/mcp --headers "Authorization=Bearer $TOKEN"

gcloud run services update mcp-boss \
  --ingress=internal \
  --project=$PROJECT_ID \
  --region=us-central1

# From your local machine via Cloud Run Proxy (tunnels through IAM):
gcloud run services proxy mcp-boss --project=$PROJECT_ID --region=us-central1
# Opens http://localhost:8080 locally

# Or from a GCE VM / GKE pod inside the VPC:
curl https://YOUR-SERVICE-URL/health

# Enable IAP on the Cloud Run service
gcloud iap web enable \
  --resource-type=cloud-run \
  --service=mcp-boss \
  --project=$PROJECT_ID

# Grant access to your SOC team
gcloud iap web add-iam-policy-binding \
  --resource-type=cloud-run \
  --service=mcp-boss \
  --member="group:soc-team@yourcompany.com" \
  --role="roles/iap.httpsResourceAccessor" \
  --project=$PROJECT_ID

gcloud run services update mcp-boss \
  --set-env-vars="MCP_BOSS_API_KEY=your-secret-key-here" \
  --project=$PROJECT_ID \
  --region=us-central1

# curl:
curl -H "X-API-Key: your-secret-key-here" https://YOUR-SERVICE-URL/health

# Gemini CLI:
gemini --tool-endpoint https://YOUR-SERVICE-URL/mcp --headers "X-API-Key=your-secret-key-here"

# Web UI: Add ?key=your-secret-key-here to the URL
# Or the Web UI will prompt for it on first load

{"chain_intact": true, "broken_at_seq": null, "audit_path": "/var/log/mcp-boss/audit.jsonl"}

export MCP_URL=https://YOUR-SERVICE-URL
export MCP_ID_TOKEN=$(gcloud auth print-identity-token)
./eval_harness/run.sh

PROJECT_ID=your-project-id

gcloud services enable \
    run.googleapis.com \
    cloudbuild.googleapis.com \
    chronicle.googleapis.com \
    securitycenter.googleapis.com \
    aiplatform.googleapis.com \
    logging.googleapis.com \
    bigquery.googleapis.com \
    monitoring.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com \
    --project=$PROJECT_ID

SA_NAME=mcp-boss
SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

# Create the service account
gcloud iam service-accounts create $SA_NAME \
  --display-name="MCP Boss Service Account" \
  --project=$PROJECT_ID

# Grant required roles
ROLES=(
  roles/chronicle.admin
  roles/securitycenter.findingsViewer
  roles/aiplatform.user
  roles/logging.viewer
  roles/bigquery.dataViewer
  roles/bigquery.jobUser
  roles/monitoring.viewer
  roles/iam.securityReviewer
)

for ROLE in "${ROLES[@]}"; do
  gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:${SA_EMAIL}" \
    --role="$ROLE" --quiet
done

# Build
gcloud builds submit \
  --project=$PROJECT_ID \
  --tag gcr.io/$PROJECT_ID/mcp-boss:latest

# Deploy
gcloud run deploy mcp-boss \
  --image gcr.io/$PROJECT_ID/mcp-boss:latest \
  --project=$PROJECT_ID \
  --region=us-central1 \
  --platform=managed \
  --service-account=$SA_EMAIL \
  --allow-unauthenticated \
  --memory=512Mi \
  --timeout=300 \
  --set-env-vars="SECOPS_PROJECT_ID=$PROJECT_ID,SECOPS_CUSTOMER_ID=YOUR_CUSTOMER_ID,SECOPS_REGION=us,GTI_API_KEY=YOUR_VT_KEY"

curl https://YOUR-SERVICE-URL/health
# {"status":"healthy","tools":89,...}

gemini --tool-endpoint https://YOUR-SERVICE-URL/mcp

{
  "mcpServers": {
    "mcp-boss": {
      "url": "https://YOUR-SERVICE-URL/sse"
    }
  }
}