Symantec Cloud DLP AIops

Independent audited MCP server, CLI and skill for CloudSOC DLP incidents, profiles, detection patterns, data identifiers and index health. This initial release exposes 14 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

export SYMANTEC_CLOUDDLP_URL="..."
export SYMANTEC_CLOUDDLP_KEY_ID="..."
export SYMANTEC_CLOUDDLP_KEY_SECRET="..."
export SYMANTEC_CLOUDDLP_TENANT="..."

SYMANTEC_CLOUDDLP_URL must be the CloudSOC HTTPS origin (https://app.elastica.net or https://app.eu.elastica.net), without a path. Optional SYMANTEC_CLOUDDLP_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_CLOUDDLP_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-clouddlp-aiops/ and can be relocated with SYMANTEC_CLOUDDLP_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Use

uvx --from symantec-clouddlp-aiops==0.1.0 symantec-clouddlp-aiops profiles
uvx --from symantec-clouddlp-aiops==0.1.0 symantec-clouddlp-aiops-mcp

Search incidents in a bounded time window and follow the search-after cursor. Profile API response schemas are weakly specified, so raw response shape is surfaced explicitly. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.