When using the rule_text tool in secops, users report encountering: 'ChronicleClient' object has no attribute 'run_rule_test'. That was added to the secops-wrapper library in v0.6.0, but mcp-security only requires secops>=0.1.17. #135 is a draft PR that forces upgrade to the latest, v0.8.0.
That change requires testing, because there could be breaking changes between 0v.1.17 and v0.8.0. The test plan can look at the diff between those versions and just focus on the added/modified functions if they are found to be used in the mcp-security/server/security dir.
Longer term, we need a check to confirm new @tool definitions have corresponding changes in the TOML to ensure the requirements from the upstream SDK are included.
Workaround
To check the version of secops that your secops-mcp is using, change to the --directory that is specified in your cline config. Mine is:
"command": "/Users/dandye/homebrew/bin/uv",
"args": [
"--directory",
"/Users/dandye/Projects/google__mcp-security/server/secops/secops_mcp",
Once there, run:
Mine is:
❯ uv pip show secops
Using Python 3.13.2 environment at: /Users/dandye/Projects/google__mcp-security/server/secops/.venv
Name: secops
Version: 0.6.2
Location: /Users/dandye/Projects/google__mcp-security/server/secops/.venv/lib/python3.13/site-packages
Requires: google-api-python-client, google-auth, google-auth-httplib2
Required-by: secops-mcp
If yours is older than v0.6.0, you can upgrade to anything >= 0.6.0 to work around this bug. The latest is v0.8.0, so this works for example:
❯ pwd # confirm you are in the dir specified by `--directory` above
/Users/dandye/Projects/google__mcp-security/server/secops/secops_mcp
❯ uv pip install "secops>=0.8.0" # upgrade. quotes are needed in zsh
When using the rule_text tool in secops, users report encountering: 'ChronicleClient' object has no attribute 'run_rule_test'. That was added to the
secops-wrapperlibrary inv0.6.0, butmcp-securityonly requiressecops>=0.1.17. #135 is a draft PR that forces upgrade to the latest,v0.8.0.That change requires testing, because there could be breaking changes between
0v.1.17andv0.8.0. The test plan can look at the diff between those versions and just focus on the added/modified functions if they are found to be used in themcp-security/server/securitydir.Longer term, we need a check to confirm new
@tooldefinitions have corresponding changes in the TOML to ensure the requirements from the upstream SDK are included.Workaround
To check the version of secops that your secops-mcp is using, change to the --directory that is specified in your cline config. Mine is:
Once there, run:
Mine is:
If yours is older than
v0.6.0, you can upgrade to anything >= 0.6.0 to work around this bug. The latest isv0.8.0, so this works for example: