Symantec Endpoint Detection and Response (on-premises) AIops

Independent audited MCP server, CLI and skill for on-premises EDR investigations, entities, threat feeds, policy lists and sandbox results. This initial release exposes 20 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.

Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.

Configure

export SYMANTEC_EDR_URL="..."
export SYMANTEC_EDR_CLIENT_ID="..."
export SYMANTEC_EDR_CLIENT_SECRET="..."

SYMANTEC_EDR_URL must be the on-premises appliance HTTPS origin (including port if needed, without a path). Optional SYMANTEC_EDR_CA_BUNDLE points to a trusted CA bundle; SYMANTEC_EDR_TIMEOUT defaults to 30 seconds. Audit state defaults to ~/.symantec-edr-aiops/ and can be relocated with SYMANTEC_EDR_AIOPS_HOME.

See the operations catalog for the complete tool list, scope and deferred operations.

Use

uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops appliances
uvx --from symantec-edr-aiops==0.1.0 symantec-edr-aiops-mcp

Search incidents and events over at most 30 days, audit events over at most seven days; use the returned opaque next cursor for pagination. See verification for the exact evidence and unverified live behavior. No state-changing operations are exposed.