MCP Tools Reference: securitycenter.googleapis.com

Tool: group_findings

Groups and aggregates security findings by specific attributes (e.g. category, severity, project) to return summary counts.

Filtering (AIP-160 Syntax): The filter parameter uses AIP-160 syntax (string values MUST be in double quotes):

  • filter: 'state = "ACTIVE"'
  • filter: 'state = "ACTIVE" AND severity = "CRITICAL"'

Recommended for Macro Posture Assessment: Use this tool instead of list_findings when assessing overall security posture or counting issues:

  • Count by category: group_by: "category", filter: 'state = "ACTIVE"'
  • Count by severity: group_by: "severity", filter: 'state = "ACTIVE"'
  • Count by project: group_by: "resource.project_name", filter: 'state = "ACTIVE" AND severity = "CRITICAL"'

The following code sample shows how to use curl to call the group_findings MCP tool.

Curl Request 
curl --location 'https://securitycenter.googleapis.com/mcp/investigate' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "group_findings",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for grouping by findings.

GroupFindingsRequest

JSON representation 
{
  "parent": string,
  "filter": string,
  "groupBy": string,
  "pageToken": string,
  "pageSize": integer
}
Fields
parent

string

Required. Name of the source to groupBy. If no location is specified, finding is assumed to be in global. The following list shows some examples:

  • organizations/[organization_id]/sources/[source_id] + organizations/[organization_id]/sources/[source_id]/locations/[location_id]
  • folders/[folder_id]/sources/[source_id]
  • folders/[folder_id]/sources/[source_id]/locations/[location_id]
  • projects/[project_id]/sources/[source_id]
  • projects/[project_id]/sources/[source_id]/locations/[location_id]

To groupBy across all sources provide a source_id of -. The following list shows some examples:

  • organizations/{organization_id}/sources/-
  • organizations/{organization_id}/sources/-/locations/[location_id]
  • folders/{folder_id}/sources/-
  • folders/{folder_id}/sources/-/locations/[location_id]
  • projects/{project_id}/sources/-
  • projects/{project_id}/sources/-/locations/[location_id]
filter

string

Expression that defines the filter to apply across findings. The expression is a list of one or more restrictions combined via logical operators AND and OR. Parentheses are supported, and OR has higher precedence than AND.

Restrictions have the form <field> <operator> <value> and may have a - character in front of them to indicate negation. Examples include:

  • name
  • security_marks.marks.marka

The supported operators are:

  • = for all value types.
  • >, <, >=, <= for integer values.
  • :, meaning substring matching, for strings.

The supported value types are:

  • string literals in quotes.
  • integer literals without quotes.
  • boolean literals true and false without quotes.

The following field and operator combinations are supported:

  • name: =
  • parent: =, :
  • resource_name: =, :
  • state: =, :
  • category: =, :
  • external_uri: =, :
  • event_time: =, >, <, >=, <=

Usage: This should be milliseconds since epoch or an RFC3339 string. Examples: event_time = "2019-06-10T16:07:18-07:00" event_time = 1560208038000

  • severity: =, :
  • security_marks.marks: =, :
  • resource:
  • resource.name: =, :
  • resource.parent_name: =, :
  • resource.parent_display_name: =, :
  • resource.project_name: =, :
  • resource.project_display_name: =, :
  • resource.type: =, :
groupBy

string

Required. Expression that defines what assets fields to use for grouping. The string value should follow SQL syntax: comma separated list of fields. For example: "parent,resource_name".
pageToken

string

The value returned by the last GroupFindingsResponse; indicates that this is a continuation of a prior GroupFindings call, and that the system should return the next page of data.
pageSize

integer

The maximum number of results to return in a single response. Default is 10, minimum is 1, maximum is 1000.

Output Schema

Response message for group by findings.

GroupFindingsResponse

JSON representation 
{
  "groupByResults": [
    {
      object (GroupResult)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
groupByResults[]

object (GroupResult)

Group results. There exists an element for each existing unique combination of property/values. The element contains a count for the number of times those specific property/values appear.
nextPageToken

string

Token to retrieve the next page of results, or empty if there are no more results.
totalSize

integer

The total number of results matching the query.

GroupResult

JSON representation 
{
  "properties": {
    string: value,
    ...
  },
  "count": string
}
Fields
properties

map (key: string, value: value (Value format))

Properties matching the groupBy fields in the request.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
count

string (int64 format)

Total count of resources for the given properties.

PropertiesEntry

JSON representation 
{
  "key": string,
  "value": value
}
Fields
key

string
value

value (Value format)

Value

JSON representation 
{

  // Union field kind can be only one of the following:
  "nullValue": null,
  "numberValue": number,
  "stringValue": string,
  "boolValue": boolean,
  "structValue": {
    object
  },
  "listValue": array
  // End of list of possible types for union field kind.
}
Fields
Union field kind. The kind of value. kind can be only one of the following:
nullValue

null

Represents a JSON null.
numberValue

number

Represents a JSON number. Must not be NaN, Infinity or -Infinity, since those are not supported in JSON. This also cannot represent large Int64 values, since JSON format generally does not support them in its number type.
stringValue

string

Represents a JSON string.
boolValue

boolean

Represents a JSON boolean (true or false literal in JSON).
structValue

object (Struct format)

Represents a JSON object.
listValue

array (ListValue format)

Represents a JSON array.

Struct

JSON representation 
{
  "fields": {
    string: value,
    ...
  }
}
Fields
fields

map (key: string, value: value (Value format))

Unordered map of dynamically typed values.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

FieldsEntry

JSON representation 
{
  "key": string,
  "value": value
}
Fields
key

string
value

value (Value format)

ListValue

JSON representation 
{
  "values": [
    value
  ]
}
Fields
values[]

value (Value format)

Repeated field of dynamically typed values.

NullValue

Represents a JSON null.

NullValue is a sentinel, using an enum with only one value to represent the null value for the Value type union.

A field of type NullValue with any value other than 0 is considered invalid. Most ProtoJSON serializers will emit a Value with a null_value set as a JSON null regardless of the integer value, and so will round trip to a 0 value.

Enums
NULL_VALUE Null value.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌