MCP Server for TheHive

@gbrigandi

Repository

Basic information

About MCP Server for TheHive

MCP Server for TheHive config

No standard config provided

This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.

Repository

MCP Server for TheHive tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is MCP Server for TheHive?

It is a bridge between MCP clients (such as AI assistants) and the TheHive incident response platform, enabling retrieval and analysis of alerts, case information, and incident response operations.

How to use MCP Server for TheHive?

Configure the server by setting THEHIVE_URL and THEHIVE_API_TOKEN environment variables, then run the pre-compiled binary or build from source. Integrate with an MCP client by adding a server entry in the client’s config, specifying the binary path and environment variables.

Key features of MCP Server for TheHive

Retrieve lists of alerts and cases from TheHive
Get detailed information for a specific alert or case by ID
Promote an alert to a case automatically
Create new cases with full details (title, description, severity, tags, etc.)
Communicate over stdio using the Model Context Protocol

Use cases of MCP Server for TheHive

AI-assisted SOC analysts querying recent security alerts
Automatically escalating high-severity alerts into cases
Enriching incident response workflows with case creation from tools
Fetching case details during triage or reporting

Frequently asked questions

How do I get a TheHive API token?

Log into your TheHive instance, go to User Settings → API Keys, click Create API Key, and copy the generated token.

What environment variables are required?

`THEHIVE_URL` (default `http://localhost:9000/api`) and `THEHIVE_API_TOKEN` (required). Optional: `VERIFY_SSL` (default `false`) and `RUST_LOG`.

How does the server communicate with MCP clients?

It communicates over stdio using the MCP protocol. Clients must be configured with the server binary path and environment variables.

Are there any dependencies beyond TheHive itself?

The server is a Rust binary; no additional runtime is needed beyond the TheHive 5 instance and a valid API token.

What transport does the server use?

It uses stdio-based transport via the Model Context Protocol. No authentication is built into the server beyond the TheHive API token.

Comments

More Other MCP servers

Hindsight

vectorize-io

Hindsight: Agent Memory That Learns

50.4K

The Living Bread

A free remote MCP server for The Living Bread. Bible passages read word for word from a stored public domain text with an evidence label, keyword search and cross references, real churches, gatherings and prayer groups w

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K

EverArt

modelcontextprotocol

Model Context Protocol Servers

88.1K

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.