MCP.so
Sign In

MCP Server for TheHive

@gbrigandi

Repository

About MCP Server for TheHive

MCP Server for TheHive

Basic information

Category

Other

License

MIT

Runtime

rust

Transports

stdio

Publisher

gbrigandi

Config

No standard config provided

This server doesn't expose a parseable MCP config block in its README. See the repository for install instructions.

Repository

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is MCP Server for TheHive?

It is a bridge between MCP clients (such as AI assistants) and the TheHive incident response platform, enabling retrieval and analysis of alerts, case information, and incident response operations.

How to use MCP Server for TheHive?

Configure the server by setting THEHIVE_URL and THEHIVE_API_TOKEN environment variables, then run the pre-compiled binary or build from source. Integrate with an MCP client by adding a server entry in the client’s config, specifying the binary path and environment variables.

Key features of MCP Server for TheHive

  • Retrieve lists of alerts and cases from TheHive
  • Get detailed information for a specific alert or case by ID
  • Promote an alert to a case automatically
  • Create new cases with full details (title, description, severity, tags, etc.)
  • Communicate over stdio using the Model Context Protocol

Use cases of MCP Server for TheHive

  • AI-assisted SOC analysts querying recent security alerts
  • Automatically escalating high-severity alerts into cases
  • Enriching incident response workflows with case creation from tools
  • Fetching case details during triage or reporting

FAQ from MCP Server for TheHive

How do I get a TheHive API token?

Log into your TheHive instance, go to User Settings → API Keys, click Create API Key, and copy the generated token.

What environment variables are required?

THEHIVE_URL (default http://localhost:9000/api) and THEHIVE_API_TOKEN (required). Optional: VERIFY_SSL (default false) and RUST_LOG.

How does the server communicate with MCP clients?

It communicates over stdio using the MCP protocol. Clients must be configured with the server binary path and environment variables.

Are there any dependencies beyond TheHive itself?

The server is a Rust binary; no additional runtime is needed beyond the TheHive 5 instance and a valid API token.

What transport does the server use?

It uses stdio-based transport via the Model Context Protocol. No authentication is built into the server beyond the TheHive API token.

Comments

More Other MCP servers

Sequential Thinking

modelcontextprotocol

Model Context Protocol Servers

88.2K

ghidraMCP

LaurieWired

MCP Server for Ghidra

9.4K

Unity MCP ✨

justinpbarnett

Unity MCP acts as a bridge between AI assistants and your Unity Editor. Give your LLM tools to manage assets, control scenes, edit scripts, and automate tasks within Unity.

12.2K

FastMCP v2 🚀

jlowin

🚀 The fast, Pythonic way to build MCP servers and clients.

26.0K

ICSS

chokcoco

不止于 CSS

20.7K