[dandye]

Draft status: Hold in Draft until the hosted Google Threat Intelligence Agentic MCP endpoint transitions from private preview to public preview.

Summary

Documents how to configure and verify the managed Google Threat Intelligence Agentic MCP server (https://www.virustotal.com/api/v3/agentspace/mcp/, documented upstream at Agentic MCP Server Configuration).

• Adds docs/gti_remote_server.md mirroring docs/remote_server.md for Google SecOps:
  • Comparison table and theme-neutral currentColor SVG architecture diagram (docs/img/gti_remote/gti_remote_vs_local.svg) comparing the 7-tool remote Agentic Streamable HTTP server (gti-agentic) against the local stdio gti-mcp package (gti), including running both side by side with the same VT_APIKEY.
  • License and data-handling requirements (Google Threat Intelligence Enterprise or Enterprise Plus entitlement and x-apikey header hygiene).
  • Verified Streamable HTTP transport requirements: mandatory trailing / to avoid HTTP 307 Temporary Redirect, dual Accept: application/json, text/event-stream media types to avoid HTTP 406 Not Acceptable, and 300-second client timeouts for 45 to 180 second server-side multi-agent investigations.
  • Ready-to-copy client configurations for Cursor / VS Code / Cline (url), Gemini CLI (httpUrl), Antigravity (serverUrl), Claude Code (claude mcp add --transport http and "type": "http"), Claude Desktop (mcp-remote), Goose (streamable_http), curl verification, and Python Google ADK (McpToolset + StreamableHTTPConnectionParams).
  • Reference table for all 7 tools (ask_gti_agent, continue_chat, list_sessions, get_session_history, delete_session, share_session, copy_shared_session), multi-turn investigation examples, and a troubleshooting matrix.
• Cross-links the new guide from README.md, docs/index.md, docs/toc.md, docs/usage_guide.md, docs/servers/gti_mcp.md, and server/gti/README.md.

Related PRs

• Complements feat(gti): add GTI Agentic session and VT scan/reanalysis tools #333 (local gti-mcp Python wrappers for /api/v3/agentspace/sessions and workflow guides).
• Follows the Markdown heading, link text, and accessibility conventions introduced in docs: add WCAG 2.1 AA accessibility checks and reconcile documentation with main #340 (MD001, MD025, MD042, MD045, MD059); if docs: add WCAG 2.1 AA accessibility checks and reconcile documentation with main #340 merges first, docs/index.md and docs/toc.md can be rebased cleanly to include gti_remote_server in the Getting Started {toctree}.

Verification

• Verified initialize and tools/list tool schemas, HTTP 307 trailing-slash redirect behavior, and HTTP 406 Accept header validation directly against https://www.virustotal.com/api/v3/agentspace/mcp/.
• Built HTML documentation cleanly with Sphinx + Furo + MyST (sphinx-build -M html docs ...) with zero cross-reference or syntax warnings on new/updated content and verified SVG embedding.
• Checked Markdown accessibility rules (MD001, MD025, MD042, MD045, MD059) and git diff --check.