[dandye]

Summary

Adds 49 MCP tools to google-secops-mcp for Google SecOps (Chronicle SIEM) dashboards: native dashboards, charts and dashboard queries, scheduled reports, Content Hub featured dashboards, legacy (Looker) dashboards, and legacy SOAR dashboards. All HTTP goes through a new shared chronicle_api_request helper in secops_mcp/utils.py. Every tool in this PR was exercised against a live tenant (see Verification); endpoints that could not be are deferred and documented as future work.

Module	Tools	Chronicle service(s)
tools/dashboard_management.py	17	NativeDashboardService (list, get, create, update, duplicate, delete, add/edit/remove/duplicate chart, export, import), DashboardQueryService (execute, get), DashboardChartService (get, list, batchGet)
tools/dashboard_reports.py	11	DashboardScheduledReportService (list, get, create, update, delete, fetchHistory, duplicate, trigger), FeaturedContentNativeDashboardService (list, get, install)
tools/legacy_dashboards.py	4	legacy Looker DashboardService (get, list, delete, copy)
tools/legacy_soar_dashboard.py	17	every LegacySoarDashboardService verb (dashboards, widgets, widget values and case IDs, playbook monitoring, case trends, time-to-respond, import, save as report template)

Tool count for the server goes from 68 to 118 (plus the 1 shared helper module). The secops>=0.35.1 dependency floor is unchanged.

Not included

• ListDashboardQueries is internal-only and ManageDashboardLease is not publicly visible (Method not visible to labels: {PUBLIC}).
• Future work (noted in the README and docs): the Looker-to-native migration endpoints (dashboards:fetchMigratable, :batchMigrate, :fetchMigrationMetrics, :fetchMigrationJobs) are gated by the under-development enable_looker_migration_wizard feature (403 Looker migration wizard is not enabled for the customer on both tenants tried), and legacy dashboard creation (POST /dashboards) fails server-side (something went wrong, please try again later) with or without LookML. Implementations and unit tests for these five tools exist at commit 9686f9c on this branch and can be restored once the APIs are generally available.

Design notes

• chronicle_api_request(chronicle, method, path, params=, json_body=) builds https://<region>-chronicle.googleapis.com/<version>/<instance>/... from the SDK client and works whether chronicle.base_url is the newer callable BaseUrl or the older plain string. Non-2xx responses raise with the status and body, which the tools surface as {"error": ...}.
• Structured arguments (filters, visualization, chart, widget definitions, export payloads) accept either JSON values or JSON-encoded strings via parse_json_arg, since MCP clients differ here.
• Optional params are Optional[T] = None; logging uses lazy %s formatting; every tool returns {"error": ...} on failure, matching the existing modules.
• IDs may be passed bare or as full resource names. Path segments use the bare ID; body-level resource references use whatever form the backend expects (full names for chart/dashboard references in NativeDashboardService, the bare ID for DashboardScheduledReport.dashboard.name).

API behaviour learned from live verification (encoded in the tools)

• create_dashboard / duplicate_dashboard must send type: CUSTOM and an access value (cannot create non custom dashboard, dashboard access is unspecified); access_type defaults to DASHBOARD_PRIVATE.
• add_dashboard_chart must send startX/startY explicitly (proto3 presence; omitting them yields chartLayout in request: invalid argument) and chartDatasource.dataSources (defaults to ["UDM"]). Charts reference their saved query under chartDatasource.dashboardQuery.
• edit_dashboard_chart enforces optimistic concurrency on both the chart and its saved query, so the tool fetches them first and sends their etags plus the query name; editMask paths are camelCase (dashboardChart.displayName, dashboardQuery.input).
• import_dashboards needs the export payload unmodified (dashboard.name and etag present); the API assigns a new ID and returns it in results[].dashboard.
• DashboardScheduledReport.dashboard.name must be the bare native dashboard ID; a full projects/.../nativeDashboards/{id} name fails with INTERNAL: failed to fetch native dashboard details.
• install_featured_content_dashboard creates a type: MARKETPLACE dashboard whose ID equals the featured content ID; installing it again returns 409.
• execute_dashboard_query returns 200 with an empty body (not an error) when the caller lacks UDM data access.
• The legacySoarDashboard:* verbs require a SOAR-mapped user identity; a service account gets 401 You are not recognized (domain SOAR), the same behaviour as the other SOAR-proxied endpoints.

Verification

• Unit tests: cd server/secops && uv run --python 3.11 --with pytest --with pytest-asyncio --with pytest-mock pytest tests/ -> 134 passed (one or more per tool, JSON-string argument parsing, error paths, and the shared helper).
• Tool registration: 118 tools, no duplicate names. ruff check --select I,F,E9 and git diff --check clean on the new files.
• Tenant A (us, service-account identity with UDM data access): all 17 dashboard_management tools, including a create -> update -> add chart -> edit chart (title, then query window) -> duplicate chart -> remove chart -> duplicate dashboard -> export -> delete -> import-restore -> delete round-trip, plus execute_dashboard_query (inline and saved query), list_dashboard_charts and batch_get_dashboard_charts. Also list_dashboard_scheduled_reports, the three Content Hub tools (install verified then removed), and the four legacy Looker tools (copy_legacy_dashboard predefined -> user copy, then delete_legacy_dashboard).
• Tenant A, user identity (gcloud auth login --update-adc): all 17 legacy SOAR tools, including a create -> add widget -> query widget -> rename widget -> rename dashboard -> delete widget -> delete dashboard round-trip, an import -> delete round-trip, and legacy_soar_save_dashboard_as_report_template (creates a report template; the service has no delete verb, so one test template remains).
• Tenant B (us, user identity, scheduled reports enabled with 8 pre-existing reports): the full scheduled-report lifecycle on a scratch dashboard (create with bare-ID and full-name inputs, get, update of dashboard + cron + recipients, fetchHistory, duplicate, trigger, delete), plus the native reads, execute_dashboard_query, Content Hub and legacy SOAR reads. Pre-existing reports were untouched.
• Tenant-dependent: list_dashboard_charts returns 403 chart library is not enabled for the customer on Tenant B (works on Tenant A).
• All scratch dashboards, charts, reports, and SOAR dashboards created during testing were deleted.

Docs

• server/secops/README.md: four new tool sections, feature list entry 18, a use-case bullet, and the future-work note.
• docs/servers/secops_mcp.md: parameter reference for all 49 tools, the future-work note, and Example 9 (build, query, schedule, export/import a dashboard).