MCP Server for TheHive

What is MCP Server for TheHive?

It is a bridge between MCP clients (such as AI assistants) and the TheHive incident response platform, enabling retrieval and analysis of alerts, case information, and incident response operations.

How to use MCP Server for TheHive?

Configure the server by setting THEHIVE_URL and THEHIVE_API_TOKEN environment variables, then run the pre-compiled binary or build from source. Integrate with an MCP client by adding a server entry in the client’s config, specifying the binary path and environment variables.

Key features of MCP Server for TheHive

• Retrieve lists of alerts and cases from TheHive
• Get detailed information for a specific alert or case by ID
• Promote an alert to a case automatically
• Create new cases with full details (title, description, severity, tags, etc.)
• Communicate over stdio using the Model Context Protocol

Use cases of MCP Server for TheHive

• AI-assisted SOC analysts querying recent security alerts
• Automatically escalating high-severity alerts into cases
• Enriching incident response workflows with case creation from tools
• Fetching case details during triage or reporting

FAQ from MCP Server for TheHive

How do I get a TheHive API token?

Log into your TheHive instance, go to User Settings → API Keys, click Create API Key, and copy the generated token.

What environment variables are required?

THEHIVE_URL (default http://localhost:9000/api) and THEHIVE_API_TOKEN (required). Optional: VERIFY_SSL (default false) and RUST_LOG.

How does the server communicate with MCP clients?

It communicates over stdio using the MCP protocol. Clients must be configured with the server binary path and environment variables.

Are there any dependencies beyond TheHive itself?

The server is a Rust binary; no additional runtime is needed beyond the TheHive 5 instance and a valid API token.

What transport does the server use?

It uses stdio-based transport via the Model Context Protocol. No authentication is built into the server beyond the TheHive API token.