Beyond Chat: Building Multi Agent SOC Ecosystems with Claude and Google MCP

Google Cloud Security’s community blog walks through a hierarchical multi-agent SOC architecture that stacks reusable Skills (playbooks) under specialized sub-agents under coordinated agent teams, all wired into Google’s security stack over the Model Context Protocol. The worked examples (a sweep for the NetScaler memory overread CVE-2025-5777 and a user behavior investigation) finish in minutes rather than hours, with mandatory human approval gates before any production change and a recommendation to set cost controls and turn limits so an agent doesn’t analyze itself into an infinite loop. It builds on the author’s earlier single-agent setup, which connected Claude Code to the Google SecOps MCP server and still required a human to approve create_rule before a YARA-L detection went live. The peer-to-peer layer relies on Claude Code’s agent teams, which Anthropic’s documentation flags as experimental and which use significantly more tokens than a single session, since every teammate is a separate Claude instance. Your SOC org chart now has middle management, and it bills by the token.