MCP Tools Reference: securitycenter.googleapis.com

Tool: list_sources

Lists all finding sources (built-in security detectors and third-party integrations) belonging to an organization, folder, or project. Use this tool to discover available security providers and identify their numeric source_id needed for source-specific finding queries.

The following code sample shows how to use curl to call the list_sources MCP tool.

Curl Request 
curl --location 'https://securitycenter.googleapis.com/mcp/investigate' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "list_sources",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for listing sources.

ListSourcesRequest

JSON representation 
{
  "parent": string,
  "pageToken": string,
  "pageSize": integer
}
Fields
parent

string

Required. Resource name of the parent of sources to list. Its format should be organizations/[organization_id], folders/[folder_id], or projects/[project_id].
pageToken

string

The value returned by the last ListSourcesResponse; indicates that this is a continuation of a prior ListSources call, and that the system should return the next page of data.
pageSize

integer

The maximum number of results to return in a single response. Default is 10, minimum is 1, maximum is 1000.

Output Schema

Response message for listing sources.

ListSourcesResponse

JSON representation 
{
  "sources": [
    {
      object (Source)
    }
  ],
  "nextPageToken": string
}
Fields
sources[]

object (Source)

Sources belonging to the requested parent.
nextPageToken

string

Token to retrieve the next page of results, or empty if there are no more results.

Source

JSON representation 
{
  "name": string,
  "displayName": string,
  "description": string,
  "canonicalName": string
}
Fields
name

string

The relative resource name of this source. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}"
displayName

string

The source's display name. A source's display name must be unique amongst its siblings, for example, two sources with the same parent can't share the same display name. The display name must have a length between 1 and 64 characters (inclusive).
description

string

The description of the source (max of 1024 characters). Example: "Web Security Scanner is a web security scanner for common vulnerabilities in App Engine applications. It can automatically scan and detect four common vulnerabilities, including cross-site-scripting (XSS), Flash injection, mixed content (HTTP in HTTPS), and outdated or insecure libraries."
canonicalName

string

The canonical name of the finding source. It's either "organizations/{organization_id}/sources/{source_id}", "folders/{folder_id}/sources/{source_id}", or "projects/{project_number}/sources/{source_id}", depending on the closest CRM ancestor of the resource associated with the finding.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌