During January 2026, Mluwork developed threat hunting and incident investigation tooling for the google/mcp-security repository, focusing on improving security operations across distributed environments. Leveraging Python and expertise in incident response and threat hunting, Mluwork implemented a structured tool selection framework that prioritized remote tools to better support geographically dispersed teams. The work included comprehensive mapping of available tools across different environments, enabling more adaptable and efficient incident response processes. By documenting the decision-making process in Markdown, Mluwork ensured the approach was repeatable and scalable. This contribution provided a foundation for faster, more consistent tooling decisions in security operations workflows.