diff --git a/docs/servers/gti_mcp.md b/docs/servers/gti_mcp.md index 2cd9868c..e6abc766 100644 --- a/docs/servers/gti_mcp.md +++ b/docs/servers/gti_mcp.md @@ -71,6 +71,20 @@ $Env:VT_APIKEY = "your-vt-api-key" For more detailed instructions on setting up environment variables, refer to the [usage guide](../usage_guide.md#setting-up-environment-variables). +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "VT_APIKEY": "your-vt-api-key", + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `SSL_CERT_FILE` to the path of your corporate CA certificate bundle. See the [usage guide](../usage_guide.md#corporate-proxy-configuration) for details. + ## Tools ### Collections (Threats) diff --git a/docs/servers/scc_mcp.md b/docs/servers/scc_mcp.md index 9d9b90c9..3d33a044 100644 --- a/docs/servers/scc_mcp.md +++ b/docs/servers/scc_mcp.md @@ -38,6 +38,19 @@ Add the following configuration to your MCP client's settings file: This server relies primarily on Google Cloud Authentication, which is typically set up system-wide rather than through environment variables in the configuration. +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH` (for gRPC calls) and `REQUESTS_CA_BUNDLE` (for Google Cloud authentication) to the path of your corporate CA certificate bundle. See the [usage guide](../usage_guide.md#corporate-proxy-configuration) for details. + ## Tools - **`top_vulnerability_findings(project_id, max_findings=20)`** diff --git a/docs/servers/secops_mcp.md b/docs/servers/secops_mcp.md index df99f877..9ca16c40 100644 --- a/docs/servers/secops_mcp.md +++ b/docs/servers/secops_mcp.md @@ -149,6 +149,22 @@ The service account or user credentials need the following Chronicle roles: - `roles/chronicle.viewer` - For read-only operations - `roles/chronicle.admin` - For administrative operations +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "CHRONICLE_PROJECT_ID": "your-gcp-project-id", + "CHRONICLE_CUSTOMER_ID": "your-chronicle-customer-id", + "CHRONICLE_REGION": "us", + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `REQUESTS_CA_BUNDLE` to the path of your corporate CA certificate bundle. See the [usage guide](../usage_guide.md#corporate-proxy-configuration) for details. + ## Tools - **`search_security_events(text, project_id=None, customer_id=None, hours_back=24, max_events=100, region=None)`** diff --git a/docs/servers/secops_soar_mcp.md b/docs/servers/secops_soar_mcp.md index 113a16d0..0b677f7f 100644 --- a/docs/servers/secops_soar_mcp.md +++ b/docs/servers/secops_soar_mcp.md @@ -82,6 +82,21 @@ For more detailed instructions on setting up environment variables, refer to the If the server closes with a `Failed to fetch valid scopes from SOAR` error, confirm that `SOAR_URL` points to your SOAR base URL rather than your Backstory URL. The [usage guide](../usage_guide.md) includes steps for finding the correct value. +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "SOAR_URL": "https://your-soar-instance.example.com", + "SOAR_APP_KEY": "your-soar-api-key", + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `SSL_CERT_FILE` to the path of your corporate CA certificate bundle. See the [usage guide](../usage_guide.md#corporate-proxy-configuration) for details. + ### Available Integrations The `--integrations` flag in the server configuration allows you to enable specific integrations. The integration modules are located in the `marketplace/` directory. Here's a subset of the available integrations: diff --git a/docs/usage_guide.md b/docs/usage_guide.md index 64c17219..3fa52ff0 100644 --- a/docs/usage_guide.md +++ b/docs/usage_guide.md @@ -309,6 +309,6 @@ If you are running MCP servers behind an HTTP/HTTPS corporate proxy: } ``` -3. **Custom SSL/CA Certificates (SSL Decryption/Inspection)**: If your corporate proxy intercepts SSL traffic, point `SSL_CERT_FILE` to your corporate CA certificate bundle. +3. **Custom SSL/CA Certificates (SSL Decryption/Inspection)**: If your corporate proxy intercepts TLS traffic, point the appropriate certificate variable to your corporate CA bundle (`SSL_CERT_FILE` for `gti` and `secops-soar`, `REQUESTS_CA_BUNDLE` for `secops`, and `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH` plus `REQUESTS_CA_BUNDLE` for `scc-mcp`). diff --git a/server/gti/README.md b/server/gti/README.md index 662bfd0a..90147035 100644 --- a/server/gti/README.md +++ b/server/gti/README.md @@ -98,6 +98,20 @@ export VT_APIKEY="your-vt-api-key" $Env:VT_APIKEY = "your-vt-api-key" ``` +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "VT_APIKEY": "${VT_APIKEY}", + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `SSL_CERT_FILE` to the path of your corporate CA certificate bundle. See `docs/usage_guide.md` for details. + ## License Apache 2.0 diff --git a/server/scc/README.md b/server/scc/README.md index da8264cf..b901b864 100644 --- a/server/scc/README.md +++ b/server/scc/README.md @@ -107,6 +107,19 @@ Appropriate IAM permissions are required on the target Google Cloud project(s): - Security Command Center: `roles/securitycenter.adminViewer` (read-only tools) or `roles/securitycenter.adminEditor` (required for `set_finding_mute`) - Cloud Asset Inventory: `roles/cloudasset.viewer` +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH` (for gRPC calls) and `REQUESTS_CA_BUNDLE` (for Google Cloud authentication) to the path of your corporate CA certificate bundle. See `docs/usage_guide.md` for details. + ## License Apache 2.0 diff --git a/server/secops/README.md b/server/secops/README.md index 8b1d7600..e71d9b7d 100644 --- a/server/secops/README.md +++ b/server/secops/README.md @@ -407,6 +407,22 @@ service account for authentication. This is useful for automated deployments, CI/CD pipelines, or environments where ADC is not available. +### Corporate Proxy Configuration + +The server honors standard proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`). To run behind a corporate proxy, set these variables in your environment or pass them in the `env` block of your MCP client settings: + +```json +"env": { + "CHRONICLE_PROJECT_ID": "${CHRONICLE_PROJECT_ID}", + "CHRONICLE_CUSTOMER_ID": "${CHRONICLE_CUSTOMER_ID}", + "CHRONICLE_REGION": "${CHRONICLE_REGION}", + "HTTP_PROXY": "http://proxy.corp.example.com:8080", + "HTTPS_PROXY": "http://proxy.corp.example.com:8080" +} +``` + +If your corporate proxy intercepts TLS traffic, set `REQUESTS_CA_BUNDLE` to the path of your corporate CA certificate bundle. See `docs/usage_guide.md` for details. + ## License Apache 2.0