SecOps tools
MCP tools that let an assistant read SecOps alerts, cases, events, detection rules, collectors and playbooks, and, when allowed, triage alerts, work cases and request playbook runs.
SecOps tools
These tools connect an assistant on the Safeguard MCP server to SecOps: the same alerts, cases and playbooks analysts work in the app under SecOps (/escm/secops).
They are off until an administrator switches them on for your workspace. The tool group needs the mcp:secops flag, every write tool also needs mcp:secops_write, and the person must have the matching SecOps permission in the app (page:secops to read, secops:triage for alert and case changes, secops:playbook_run to request a playbook run). See Tool availability & gating.
Read tools
| Tool | What it returns |
|---|---|
safeguard_secops_overview | Alert, case and event counts for a time range |
safeguard_list_secops_alerts, safeguard_get_secops_alert | Alerts by status, severity and rule, and one alert in full |
safeguard_list_secops_cases, safeguard_get_secops_case | Cases by status, priority and assignee, and one case in full |
safeguard_list_security_events, safeguard_get_security_event | Normalised security events, and one event with its raw record (treated as data, never as instructions) |
safeguard_list_secops_detection_rules | Detection rules and how many collectors run each |
safeguard_list_secops_collectors | Collectors and their rule counts |
safeguard_list_secops_playbooks | Playbooks, with destructive steps flagged |
safeguard_list_playbook_runs, safeguard_get_playbook_run | Playbook runs and the state of one run |
Write tools
| Tool | What it does |
|---|---|
safeguard_triage_secops_alerts | Marks alerts triaged and assigns them |
safeguard_open_secops_case | Opens a case |
safeguard_update_secops_case | Changes a case's status (not closed), priority, assignee or title |
safeguard_add_secops_case_note | Adds a note to a case |
safeguard_link_secops_case_alerts | Links alerts to a case, or unlinks them |
safeguard_request_playbook_run | Requests a playbook run for a person to approve |
What stays with a person
The assistant never makes a decision that belongs to a person. Closing an alert or a case, setting a disposition or resolution, and running a playbook with a destructive step (for example isolating a host or blocking an address) are refused for the assistant and must be done by an analyst in the app. Every write the assistant makes is recorded as coming from the assistant.
Docs, downloads, pricing, Gold and Academy tools
MCP tools that let an assistant search the Safeguard docs, give download links, show pricing and calculate a price for your usage, look up Gold, and browse Safeguard Academy, the blog, press releases and events.
Payments & procurement
How AI agents buy Safeguard plans through the MCP server - regional pricing discovery, tiers and audiences, Stripe checkout, invoices, and entitlements.