symantec-dcs-aiops 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- symantec_dcs_aiops-0.1.0/.claude-plugin/plugin.json +22 -0
- symantec_dcs_aiops-0.1.0/.github/workflows/mcp-publish.yml +55 -0
- symantec_dcs_aiops-0.1.0/.github/workflows/publish.yml +26 -0
- symantec_dcs_aiops-0.1.0/.gitignore +23 -0
- symantec_dcs_aiops-0.1.0/.mcp.json +13 -0
- symantec_dcs_aiops-0.1.0/CHANGELOG.md +8 -0
- symantec_dcs_aiops-0.1.0/LICENSE +21 -0
- symantec_dcs_aiops-0.1.0/PKG-INFO +41 -0
- symantec_dcs_aiops-0.1.0/README.md +28 -0
- symantec_dcs_aiops-0.1.0/SECURITY.md +5 -0
- symantec_dcs_aiops-0.1.0/docs/OPERATIONS.md +79 -0
- symantec_dcs_aiops-0.1.0/docs/VERIFICATION.md +28 -0
- symantec_dcs_aiops-0.1.0/openclaw.plugin.json +24 -0
- symantec_dcs_aiops-0.1.0/package.json +20 -0
- symantec_dcs_aiops-0.1.0/pyproject.toml +34 -0
- symantec_dcs_aiops-0.1.0/server.json +21 -0
- symantec_dcs_aiops-0.1.0/skills/symantec-dcs-aiops/SKILL.md +24 -0
- symantec_dcs_aiops-0.1.0/skills/symantec-dcs-aiops/references/agent-guardrails.md +8 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/__init__.py +8 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/cli/__init__.py +209 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/cli/__main__.py +5 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/connection.py +189 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/__init__.py +50 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/audit.py +526 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/budget.py +222 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/decorators.py +599 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/outcome.py +102 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/paths.py +23 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/patterns.py +396 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/policy.py +67 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/sanitize.py +79 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/governance/undo.py +259 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/mcp_server/__init__.py +0 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/mcp_server/_annotations.py +66 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/mcp_server/_shared.py +45 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/mcp_server/server.py +11 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/mcp_server/tools/__init__.py +0 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/mcp_server/tools/dcs.py +286 -0
- symantec_dcs_aiops-0.1.0/symantec_dcs_aiops/ops.py +254 -0
- symantec_dcs_aiops-0.1.0/tests/test_agent_detection.py +8 -0
- symantec_dcs_aiops-0.1.0/tests/test_audit_guardrails.py +211 -0
- symantec_dcs_aiops-0.1.0/tests/test_cli_audited.py +26 -0
- symantec_dcs_aiops-0.1.0/tests/test_cli_governed_exit.py +18 -0
- symantec_dcs_aiops-0.1.0/tests/test_dcs_contract.py +135 -0
- symantec_dcs_aiops-0.1.0/tests/test_package_layout.py +62 -0
- symantec_dcs_aiops-0.1.0/tests/test_smoke.py +27 -0
- symantec_dcs_aiops-0.1.0/tests/test_tool_annotations.py +139 -0
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://anthropic.com/claude-code/plugin.schema.json",
|
|
3
|
+
"name": "symantec-dcs-aiops",
|
|
4
|
+
"displayName": "Symantec Data Center Security AIops",
|
|
5
|
+
"version": "0.1.0",
|
|
6
|
+
"description": "Governed Symantec DCS operations — 35 MCP tools, read-only with audit.",
|
|
7
|
+
"author": {
|
|
8
|
+
"name": "Wei Zhou",
|
|
9
|
+
"email": "zhouwei008@gmail.com",
|
|
10
|
+
"url": "https://github.com/AIops-tools"
|
|
11
|
+
},
|
|
12
|
+
"homepage": "https://github.com/AIops-tools/Symantec-DCS-AIops",
|
|
13
|
+
"repository": "https://github.com/AIops-tools/Symantec-DCS-AIops",
|
|
14
|
+
"license": "MIT",
|
|
15
|
+
"keywords": [
|
|
16
|
+
"symantec",
|
|
17
|
+
"dcs",
|
|
18
|
+
"data-center-security",
|
|
19
|
+
"mcp",
|
|
20
|
+
"aiops"
|
|
21
|
+
]
|
|
22
|
+
}
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
name: mcp-publish
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
workflow_dispatch:
|
|
5
|
+
release:
|
|
6
|
+
types: [published]
|
|
7
|
+
|
|
8
|
+
permissions:
|
|
9
|
+
id-token: write
|
|
10
|
+
contents: read
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
publish-mcp:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
steps:
|
|
16
|
+
- uses: actions/checkout@v4
|
|
17
|
+
- name: Wait for PyPI
|
|
18
|
+
# The release event also triggers the PyPI publish workflow; the MCP
|
|
19
|
+
# registry validates that the package version exists on PyPI, so poll
|
|
20
|
+
# until it has propagated (every 15s, up to 10 minutes).
|
|
21
|
+
run: |
|
|
22
|
+
python3 - <<'EOF'
|
|
23
|
+
import json
|
|
24
|
+
import sys
|
|
25
|
+
import time
|
|
26
|
+
import urllib.error
|
|
27
|
+
import urllib.request
|
|
28
|
+
|
|
29
|
+
with open("server.json", encoding="utf-8") as f:
|
|
30
|
+
package = json.load(f)["packages"][0]
|
|
31
|
+
name, version = package["identifier"], package["version"]
|
|
32
|
+
url = f"https://pypi.org/pypi/{name}/{version}/json"
|
|
33
|
+
deadline = time.monotonic() + 600
|
|
34
|
+
while True:
|
|
35
|
+
try:
|
|
36
|
+
with urllib.request.urlopen(url, timeout=10):
|
|
37
|
+
print(f"{name}=={version} is available on PyPI.")
|
|
38
|
+
sys.exit(0)
|
|
39
|
+
except (urllib.error.URLError, OSError) as exc:
|
|
40
|
+
print(f"{name}=={version} not on PyPI yet ({exc}); "
|
|
41
|
+
"retrying in 15s...")
|
|
42
|
+
if time.monotonic() >= deadline:
|
|
43
|
+
sys.exit(f"Timed out after 10 minutes waiting for "
|
|
44
|
+
f"{name}=={version} to appear on PyPI. "
|
|
45
|
+
"Check the PyPI publish workflow, then re-run "
|
|
46
|
+
"this workflow via workflow_dispatch.")
|
|
47
|
+
time.sleep(15)
|
|
48
|
+
EOF
|
|
49
|
+
- name: Install mcp-publisher
|
|
50
|
+
run: |
|
|
51
|
+
curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
|
|
52
|
+
- name: Login to MCP Registry (GitHub OIDC)
|
|
53
|
+
run: ./mcp-publisher login github-oidc
|
|
54
|
+
- name: Publish server.json
|
|
55
|
+
run: ./mcp-publisher publish
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
name: Publish to PyPI
|
|
2
|
+
|
|
3
|
+
# Trusted Publishing (OIDC) — publishes from GitHub's runners with no API token,
|
|
4
|
+
# sidestepping the local-IP / account new-project rate limit. Configure a matching
|
|
5
|
+
# "trusted publisher" for this package on PyPI (see the repo release notes).
|
|
6
|
+
on:
|
|
7
|
+
release:
|
|
8
|
+
types: [published]
|
|
9
|
+
workflow_dispatch:
|
|
10
|
+
|
|
11
|
+
permissions:
|
|
12
|
+
contents: read
|
|
13
|
+
|
|
14
|
+
jobs:
|
|
15
|
+
publish:
|
|
16
|
+
runs-on: ubuntu-latest
|
|
17
|
+
permissions:
|
|
18
|
+
id-token: write # required for PyPI Trusted Publishing (OIDC)
|
|
19
|
+
steps:
|
|
20
|
+
- uses: actions/checkout@v4
|
|
21
|
+
- name: Set up uv
|
|
22
|
+
uses: astral-sh/setup-uv@v5
|
|
23
|
+
- name: Build sdist + wheel
|
|
24
|
+
run: uv build
|
|
25
|
+
- name: Publish to PyPI (Trusted Publishing)
|
|
26
|
+
uses: pypa/gh-action-pypi-publish@release/v1
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
# Python
|
|
2
|
+
__pycache__/
|
|
3
|
+
*.py[cod]
|
|
4
|
+
*.egg-info/
|
|
5
|
+
.pytest_cache/
|
|
6
|
+
.ruff_cache/
|
|
7
|
+
|
|
8
|
+
# Virtual envs / build
|
|
9
|
+
.venv/
|
|
10
|
+
dist/
|
|
11
|
+
build/
|
|
12
|
+
|
|
13
|
+
# uv
|
|
14
|
+
uv.lock
|
|
15
|
+
|
|
16
|
+
# Local config / secrets (never commit)
|
|
17
|
+
*.env
|
|
18
|
+
.env
|
|
19
|
+
config.yaml
|
|
20
|
+
|
|
21
|
+
# OS
|
|
22
|
+
.DS_Store
|
|
23
|
+
.coverage
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## v0.1.0 — initial read-only preview
|
|
4
|
+
|
|
5
|
+
- Stream login and resource responses; abort and close the response at the 16 MiB decoded-body limit.
|
|
6
|
+
- 35 governed MCP/CLI read operations for Symantec Data Center Security.
|
|
7
|
+
- Bounded authentication retry, TLS validation, input and response checks, audit and budget harness.
|
|
8
|
+
- Official API contract review and local mock tests; live environment remains unverified.
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 wei <zhouwei008@gmail.com>
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
Metadata-Version: 2.5
|
|
2
|
+
Name: symantec-dcs-aiops
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Governed operations for Symantec Zero Trust Network Access
|
|
5
|
+
Author-email: Wei Zhou <zhouwei008@gmail.com>
|
|
6
|
+
License-Expression: MIT
|
|
7
|
+
License-File: LICENSE
|
|
8
|
+
Requires-Python: >=3.11
|
|
9
|
+
Requires-Dist: httpx<1.0,>=0.27
|
|
10
|
+
Requires-Dist: mcp[cli]<3.0,>=2.0
|
|
11
|
+
Requires-Dist: typer<1.0,>=0.12
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
|
|
14
|
+
<!-- mcp-name: io.github.AIops-tools/symantec-dcs-aiops -->
|
|
15
|
+
|
|
16
|
+
# Symantec Data Center Security AIops
|
|
17
|
+
|
|
18
|
+
Independent audited MCP server, CLI and skill for management status, assets, alerts, events, policies, reports, roles, users and syslog. This initial release exposes 35 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.
|
|
19
|
+
|
|
20
|
+
> Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.
|
|
21
|
+
|
|
22
|
+
## Configure
|
|
23
|
+
|
|
24
|
+
```sh
|
|
25
|
+
export SYMANTEC_DCS_URL="..."
|
|
26
|
+
export SYMANTEC_DCS_USERNAME="..."
|
|
27
|
+
export SYMANTEC_DCS_PASSWORD="..."
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
`SYMANTEC_DCS_URL` must be the management console HTTPS origin (normally `https://host:4443`), without a path. Optional `SYMANTEC_DCS_CA_BUNDLE` points to a trusted CA bundle; `SYMANTEC_DCS_TIMEOUT` defaults to 30 seconds. Audit state defaults to `~/.symantec-dcs-aiops/` and can be relocated with `SYMANTEC_DCS_AIOPS_HOME`.
|
|
31
|
+
|
|
32
|
+
See the [operations catalog](docs/OPERATIONS.md) for the complete tool list, scope and deferred operations.
|
|
33
|
+
|
|
34
|
+
## Use
|
|
35
|
+
|
|
36
|
+
```sh
|
|
37
|
+
uvx --from symantec-dcs-aiops==0.1.0 symantec-dcs-aiops status server
|
|
38
|
+
uvx --from symantec-dcs-aiops==0.1.0 symantec-dcs-aiops-mcp
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
Use assets with a sort key to page through inventory; inspect asset-errors, alert-rules, events and policy-violations before making conclusions. See [verification](docs/VERIFICATION.md) for the exact evidence and unverified live behavior. No state-changing operations are exposed.
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
<!-- mcp-name: io.github.AIops-tools/symantec-dcs-aiops -->
|
|
2
|
+
|
|
3
|
+
# Symantec Data Center Security AIops
|
|
4
|
+
|
|
5
|
+
Independent audited MCP server, CLI and skill for management status, assets, alerts, events, policies, reports, roles, users and syslog. This initial release exposes 35 read-only tools. MCP and CLI call the same governed functions; API credentials remain in environment variables, TLS verification is on, and every call records a local audit event.
|
|
6
|
+
|
|
7
|
+
> Community-maintained project. Not affiliated with or endorsed by Broadcom or Symantec; product names are their owners’ trademarks.
|
|
8
|
+
|
|
9
|
+
## Configure
|
|
10
|
+
|
|
11
|
+
```sh
|
|
12
|
+
export SYMANTEC_DCS_URL="..."
|
|
13
|
+
export SYMANTEC_DCS_USERNAME="..."
|
|
14
|
+
export SYMANTEC_DCS_PASSWORD="..."
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
`SYMANTEC_DCS_URL` must be the management console HTTPS origin (normally `https://host:4443`), without a path. Optional `SYMANTEC_DCS_CA_BUNDLE` points to a trusted CA bundle; `SYMANTEC_DCS_TIMEOUT` defaults to 30 seconds. Audit state defaults to `~/.symantec-dcs-aiops/` and can be relocated with `SYMANTEC_DCS_AIOPS_HOME`.
|
|
18
|
+
|
|
19
|
+
See the [operations catalog](docs/OPERATIONS.md) for the complete tool list, scope and deferred operations.
|
|
20
|
+
|
|
21
|
+
## Use
|
|
22
|
+
|
|
23
|
+
```sh
|
|
24
|
+
uvx --from symantec-dcs-aiops==0.1.0 symantec-dcs-aiops status server
|
|
25
|
+
uvx --from symantec-dcs-aiops==0.1.0 symantec-dcs-aiops-mcp
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
Use assets with a sort key to page through inventory; inspect asset-errors, alert-rules, events and policy-violations before making conclusions. See [verification](docs/VERIFICATION.md) for the exact evidence and unverified live behavior. No state-changing operations are exposed.
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
# Security
|
|
2
|
+
|
|
3
|
+
Report vulnerabilities privately to the repository maintainers. Do not paste API credentials, response bodies containing sensitive security data, or audit databases into public issues. TLS verification is enabled by default. Use an account with only the read privileges needed for these tools, and restrict local access to audit state. This preview contains no state-changing MCP or CLI operation.
|
|
4
|
+
|
|
5
|
+
The transport restricts query-only POST routes and stops reading successful login and API responses above 16 MiB and raises an explicit error. Read results may still contain operational or personal data; grant the connecting account only needed privileges.
|
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
# Operations catalog
|
|
2
|
+
|
|
3
|
+
All listed operations are read-only and route through the same audited MCP/CLI implementation. A tool count describes interface coverage, not live verification.
|
|
4
|
+
|
|
5
|
+
## Service and assets
|
|
6
|
+
|
|
7
|
+
| MCP tool | Purpose |
|
|
8
|
+
|---|---|
|
|
9
|
+
| `dcs_status` | Read a DCS service status component. |
|
|
10
|
+
| `dcs_assets` | List a bounded page of assets. |
|
|
11
|
+
| `dcs_asset` | Read one managed asset. |
|
|
12
|
+
| `dcs_asset_errors` | Read recent asset error events. |
|
|
13
|
+
| `dcs_asset_stats` | Read asset totals and offline counts. |
|
|
14
|
+
| `dcs_asset_tags` | Read asset tags. |
|
|
15
|
+
| `dcs_asset_policies` | List policies assigned to an asset. |
|
|
16
|
+
| `dcs_asset_history` | Read asset change history. |
|
|
17
|
+
| `dcs_licenses` | List license inventory. |
|
|
18
|
+
|
|
19
|
+
## Alerts and events
|
|
20
|
+
|
|
21
|
+
| MCP tool | Purpose |
|
|
22
|
+
|---|---|
|
|
23
|
+
| `dcs_alerts` | List a bounded page of alerts. |
|
|
24
|
+
| `dcs_alert_rules` | List a bounded page of alert rules. |
|
|
25
|
+
| `dcs_alert_stats` | Read alert rule totals. |
|
|
26
|
+
| `dcs_events` | List a bounded page of security events. |
|
|
27
|
+
| `dcs_event_stats` | Read event counts. |
|
|
28
|
+
| `dcs_alert_details` | Read alert rule details. |
|
|
29
|
+
| `dcs_alert_notifications` | List recent alert notifications. |
|
|
30
|
+
|
|
31
|
+
## Policies and security groups
|
|
32
|
+
|
|
33
|
+
| MCP tool | Purpose |
|
|
34
|
+
|---|---|
|
|
35
|
+
| `dcs_policies` | List DCS policies with an explicit output cap. |
|
|
36
|
+
| `dcs_policy` | Read one DCS policy. |
|
|
37
|
+
| `dcs_policy_violations` | Read policy violations. |
|
|
38
|
+
| `dcs_policy_settings` | Read policy settings. |
|
|
39
|
+
| `dcs_policy_library` | List library policies. |
|
|
40
|
+
| `dcs_security_groups` | List security groups. |
|
|
41
|
+
| `dcs_security_group` | Read one security group. |
|
|
42
|
+
| `dcs_security_group_stats` | Read security group counts. |
|
|
43
|
+
| `dcs_tags` | List policy and asset tags. |
|
|
44
|
+
|
|
45
|
+
## Reports, roles and configuration
|
|
46
|
+
|
|
47
|
+
| MCP tool | Purpose |
|
|
48
|
+
|---|---|
|
|
49
|
+
| `dcs_reports` | List report definitions. |
|
|
50
|
+
| `dcs_report_stats` | Read report counts. |
|
|
51
|
+
| `dcs_report_jobs` | List report job states. |
|
|
52
|
+
| `dcs_report_job` | Read one report job state. |
|
|
53
|
+
| `dcs_roles` | List RBAC roles. |
|
|
54
|
+
| `dcs_role` | Read one RBAC role. |
|
|
55
|
+
| `dcs_role_users` | List users assigned to a role. |
|
|
56
|
+
| `dcs_users` | List management users. |
|
|
57
|
+
| `dcs_syslogs` | List syslog destinations. |
|
|
58
|
+
| `dcs_server_registry` | List registered servers. |
|
|
59
|
+
|
|
60
|
+
## Limits and next work
|
|
61
|
+
|
|
62
|
+
The documented GET /v1/sa/securitygroups/reapply route can trigger a change, so it is excluded despite its HTTP method. Report downloads and certificate exports require content and credential handling. Configuration writes require live result and rollback proof.
|
|
63
|
+
|
|
64
|
+
API paths and response examples are from the official Broadcom documentation listed below. No tenant or appliance has been supplied for live verification; consult [VERIFICATION.md](VERIFICATION.md).
|
|
65
|
+
|
|
66
|
+
- [dcs_status_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_status_6110.md)
|
|
67
|
+
- [dcs_assets_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_assets_6110.md)
|
|
68
|
+
- [dcs_license_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_license_6110.md)
|
|
69
|
+
- [dcs_alerts_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_alerts_6110.md)
|
|
70
|
+
- [dcs_events_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_events_6110.md)
|
|
71
|
+
- [dcs_policy_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_policy_6110.md)
|
|
72
|
+
- [dcs_security_groups_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_security_groups_6110.md)
|
|
73
|
+
- [dcs_reports_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_reports_6110.md)
|
|
74
|
+
- [dcs_reports_job_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_reports_job_6110.md)
|
|
75
|
+
- [dcs_roles_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_roles_6110.md)
|
|
76
|
+
- [dcs_users_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_users_6110.md)
|
|
77
|
+
- [dcs_syslog_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_syslog_6110.md)
|
|
78
|
+
- [dcs_server_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_server_6110.md)
|
|
79
|
+
- [dcs_tags_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_tags_6110.md)
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Verification
|
|
2
|
+
|
|
3
|
+
## Official API contracts reviewed
|
|
4
|
+
|
|
5
|
+
- [dcs_auth](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_auth.md)
|
|
6
|
+
- [dcs_status_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_status_6110.md)
|
|
7
|
+
- [dcs_assets_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_assets_6110.md)
|
|
8
|
+
- [dcs_alerts_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_alerts_6110.md)
|
|
9
|
+
- [dcs_events_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_events_6110.md)
|
|
10
|
+
- [dcs_policy_6110](https://apidocs.securitycloud.symantec.com/resources/configs/_markdown/dcs_policy_6110.md)
|
|
11
|
+
|
|
12
|
+
The auth scheme, listed paths, query bounds and response examples informed the read-only implementation. An official schema example is not a substitute for a live response.
|
|
13
|
+
|
|
14
|
+
## Local validation
|
|
15
|
+
|
|
16
|
+
- Contract-shaped HTTP mock tests and inherited governance tests passed (42 pytest tests). Ruff passed; Bandit found 0 Medium+ issues. The 0.1.0 wheel installed in an external virtual environment and its MCP server imported from site-packages. All five handbook gates passed over 36 tools.
|
|
17
|
+
- The vendored governance harness uses the same path for MCP and CLI. Query-only POST routes are explicitly allowlisted.
|
|
18
|
+
|
|
19
|
+
## Not yet verified
|
|
20
|
+
|
|
21
|
+
- No live Symantec Data Center Security tenant/appliance or test credentials have been supplied. Authentication, privileges, response shape, pagination and real operational behavior remain unverified against a server.
|
|
22
|
+
- No write or undo workflow is exposed. Any write additions require live result, audit and rollback proof before release.
|
|
23
|
+
|
|
24
|
+
## Expanded coverage review
|
|
25
|
+
|
|
26
|
+
The [operations catalog](OPERATIONS.md) lists every implemented tool, source API topic and excluded operation. New read paths have contract-shaped HTTP tests. Public API examples may differ from a real tenant; all added paths remain live-unverified.
|
|
27
|
+
|
|
28
|
+
Successful login and resource responses are read as a stream with a 16 MiB decoded-body limit. The client closes the stream and raises an explicit error as soon as the limit is exceeded, before JSON parsing. Local mock-stream regression tests verify that unread chunks are not consumed, including during login. This does not replace server-side pagination; unpaged endpoints report measured output truncation.
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "symantec-dcs-aiops",
|
|
3
|
+
"name": "Symantec Data Center Security AIops",
|
|
4
|
+
"description": "Governed Symantec DCS operations — 35 MCP tools, read-only with audit.",
|
|
5
|
+
"skills": [
|
|
6
|
+
"./skills"
|
|
7
|
+
],
|
|
8
|
+
"mcpServers": {
|
|
9
|
+
"symantec-dcs-aiops": {
|
|
10
|
+
"transport": "stdio",
|
|
11
|
+
"command": "uvx",
|
|
12
|
+
"args": [
|
|
13
|
+
"--from",
|
|
14
|
+
"symantec-dcs-aiops==0.1.0",
|
|
15
|
+
"symantec-dcs-aiops-mcp"
|
|
16
|
+
]
|
|
17
|
+
}
|
|
18
|
+
},
|
|
19
|
+
"configSchema": {
|
|
20
|
+
"type": "object",
|
|
21
|
+
"additionalProperties": false,
|
|
22
|
+
"properties": {}
|
|
23
|
+
}
|
|
24
|
+
}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@zw008/symantec-dcs-aiops",
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"description": "Governed Symantec DCS operations — 35 MCP tools, read-only with audit.",
|
|
5
|
+
"private": true,
|
|
6
|
+
"license": "MIT",
|
|
7
|
+
"homepage": "https://github.com/AIops-tools/Symantec-DCS-AIops",
|
|
8
|
+
"repository": {
|
|
9
|
+
"type": "git",
|
|
10
|
+
"url": "https://github.com/AIops-tools/Symantec-DCS-AIops.git"
|
|
11
|
+
},
|
|
12
|
+
"openclaw": {
|
|
13
|
+
"compat": {
|
|
14
|
+
"pluginApi": ">=2026.3.24-beta.2"
|
|
15
|
+
},
|
|
16
|
+
"build": {
|
|
17
|
+
"openclawVersion": "2026.3.24-beta.2"
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
}
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["hatchling"]
|
|
3
|
+
build-backend = "hatchling.build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "symantec-dcs-aiops"
|
|
7
|
+
version = "0.1.0"
|
|
8
|
+
description = "Governed operations for Symantec Zero Trust Network Access"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
license = "MIT"
|
|
11
|
+
requires-python = ">=3.11"
|
|
12
|
+
authors = [{ name = "Wei Zhou", email = "zhouwei008@gmail.com" }]
|
|
13
|
+
dependencies = ["httpx>=0.27,<1.0", "typer>=0.12,<1.0", "mcp[cli]>=2.0,<3.0"]
|
|
14
|
+
|
|
15
|
+
[dependency-groups]
|
|
16
|
+
dev = ["pytest>=8,<10", "ruff>=0.5,<1.0"]
|
|
17
|
+
|
|
18
|
+
[project.scripts]
|
|
19
|
+
symantec-dcs-aiops = "symantec_dcs_aiops.cli:main"
|
|
20
|
+
symantec-dcs-aiops-mcp = "symantec_dcs_aiops.mcp_server.server:main"
|
|
21
|
+
|
|
22
|
+
[tool.hatch.build.targets.wheel]
|
|
23
|
+
packages = ["symantec_dcs_aiops"]
|
|
24
|
+
|
|
25
|
+
[tool.ruff]
|
|
26
|
+
line-length = 100
|
|
27
|
+
target-version = "py311"
|
|
28
|
+
|
|
29
|
+
[tool.ruff.lint]
|
|
30
|
+
select = ["E", "F", "I", "N", "W", "UP"]
|
|
31
|
+
|
|
32
|
+
[tool.ruff.lint.per-file-ignores]
|
|
33
|
+
"symantec_dcs_aiops/governance/*.py" = ["E501", "N818"]
|
|
34
|
+
"symantec_dcs_aiops/mcp_server/**/*.py" = ["UP007", "UP045"]
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
|
|
3
|
+
"name": "io.github.AIops-tools/symantec-dcs-aiops",
|
|
4
|
+
"title": "Symantec Data Center Security AIops",
|
|
5
|
+
"description": "Governed Symantec DCS operations — 35 MCP tools, read-only with audit.",
|
|
6
|
+
"repository": {
|
|
7
|
+
"url": "https://github.com/AIops-tools/Symantec-DCS-AIops",
|
|
8
|
+
"source": "github"
|
|
9
|
+
},
|
|
10
|
+
"version": "0.1.0",
|
|
11
|
+
"packages": [
|
|
12
|
+
{
|
|
13
|
+
"registryType": "pypi",
|
|
14
|
+
"identifier": "symantec-dcs-aiops",
|
|
15
|
+
"version": "0.1.0",
|
|
16
|
+
"transport": {
|
|
17
|
+
"type": "stdio"
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
]
|
|
21
|
+
}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: symantec-dcs-aiops
|
|
3
|
+
slug: symantec-dcs-aiops
|
|
4
|
+
displayName: "Symantec Data Center Security AIops"
|
|
5
|
+
summary: "Audited DCS server, asset, event, policy, report and role operations."
|
|
6
|
+
license: MIT
|
|
7
|
+
homepage: https://github.com/AIops-tools/Symantec-DCS-AIops
|
|
8
|
+
tags: [aiops, mcp, governance, symantec, dcs]
|
|
9
|
+
description: >
|
|
10
|
+
Use for read-only Symantec Data Center Security service status, assets, alerts, events, policies, reports, security groups, users and syslog.
|
|
11
|
+
installer:
|
|
12
|
+
kind: uv
|
|
13
|
+
package: symantec-dcs-aiops
|
|
14
|
+
argument-hint: "[resource ID or time range]"
|
|
15
|
+
allowed-tools:
|
|
16
|
+
- Bash
|
|
17
|
+
metadata: {"openclaw":{"requires":{"anyBins":["uvx"]},"optional":{"env":["SYMANTEC_DCS_URL", "SYMANTEC_DCS_USERNAME", "SYMANTEC_DCS_PASSWORD"]},"homepage":"https://github.com/AIops-tools/Symantec-DCS-AIops","emoji":"🔐","os":["macos","linux","windows"]}}
|
|
18
|
+
---
|
|
19
|
+
|
|
20
|
+
# Symantec Data Center Security AIops
|
|
21
|
+
|
|
22
|
+
Start with `symantec-dcs-aiops status server`. Use assets with a sort key to page through inventory; inspect asset-errors, alert-rules, events and policy-violations before making conclusions. No configuration writes are exposed. Read the [verification status](../../docs/VERIFICATION.md) before interpreting an empty or incomplete response.
|
|
23
|
+
|
|
24
|
+
See the [operations catalog](../../docs/OPERATIONS.md) for every tool and its verification limits.
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
# Agent guardrails
|
|
2
|
+
|
|
3
|
+
- MCP and CLI use the same governed functions and audit harness.
|
|
4
|
+
- API credentials stay in environment variables; TLS verification is on by default.
|
|
5
|
+
- Authentication retries once on HTTP 401 and backs off after rejected login.
|
|
6
|
+
- Only documented read routes are exposed; POST is restricted to query-only search where applicable.
|
|
7
|
+
- Treat missing, partial and unverified responses as unknown, not healthy or zero.
|
|
8
|
+
- No live Symantec Data Center Security environment has yet been verified.
|