thehive-mcp

Active

Running a SOC through TheHive means clicking through cases, alerts, observables, and Cortex jobs one screen at a time. thehive-mcp hands the whole incident-response workflow to your agent: triage alerts, open and update cases, enrich observables, and run analyzers in plain language, with the irreversible verbs gated off by default.

GitHub repo → npm →

$npx -y thehive-mcp

write-gatedTheHive 5

See it workrepresentative session

you

Any new high-severity alerts this morning, and does the source IP look malicious?

tool

thehive_list_alerts{ status: "New", severity: ">=3", range: "12h" }

result

2 alerts ~alrt-8842 Suspicious outbound C2 severity 3 src 203.0.113.47 sight/edr ~alrt-8846 Failed MFA burst severity 2 src 198.51.100.9 okta

tool

thehive_run_analyzer_and_wait{ observable: "203.0.113.47", analyzer: "AbuseIPDB_1_0" }

result

malicious confidence 92 14 reports, last seen 4h ago category: C2, brute-force

agent

~alrt-8842 is the real one. The C2 destination 203.0.113.47 scores 92 malicious on AbuseIPDB with recent C2 reports. I would promote it to a case and block the IP. The MFA burst looks like noise.

Representative session. Illustrative values, RFC 5737 addresses. Promote and delete are gated off by default. Your data never leaves the box.

What it does

thehive-mcp is a Model Context Protocol server for TheHive 5, the open-source incident-response and case-management platform. Point any MCP client at it and TheHive becomes 47 named, typed tools your agent can call in natural language: open and triage cases, promote and manage alerts, add and search observables, run and poll Cortex analyzers, and file task logs and comments. It differs from a raw REST client or a generic OpenAPI-to-MCP bridge because it is hand-built for TheHive: the irreversible verbs (delete case, delete alert, merge, promote) and the raw Query DSL ship disabled behind explicit environment flags, TLS relaxation is scoped to TheHive requests only, and the tool descriptions carry the correct TheHive 5 status enums so an agent cannot destroy case data or drift on stale semantics. It speaks stdio and launches on demand, so nothing listens on a port and nothing phones home.

Capabilities47 tools across the SOC workflow

Cases

16 tools

List, get, create, update, search, close, assign, tag, flag, bulk-assign and bulk-close cases, plus timeline summaries; delete and merge are gated.

Alerts

6 tools

List, get, create, and update alerts; promote-to-case and delete are gated behind the destructive flag.

Observables & tasks

11 tools

Add single or bulk observables, search across all cases, and manage tasks with their log entries.

Cortex analyzers

7 tools

List analyzers, find enrichment options, run analyzers, poll jobs to completion, and summarize reports.

Comments, users & templates

6 tools

Add and list case comments, list users and the current profile, and list case templates.

Query & status

2 tools

Guarded raw TheHive Query DSL (gated) for complex searches, plus a server health and capability check.

Full tool reference on GitHub →

Setup

01 · install

npx -y thehive-mcp

02 · configure

Configure with THEHIVE_URL and THEHIVE_API_KEY. Add THEHIVE_ALLOW_DESTRUCTIVE_TOOLS=true and THEHIVE_ENABLE_RAW_QUERY=true only to opt into the gated tools.

03 · mcp client config

{ "mcpServers": { "thehive": { "command": "npx", "args": ["-y", "thehive-mcp"], "env": { "THEHIVE_URL": "https://192.0.2.10:9000", "THEHIVE_API_KEY": "your-api-key" } } } }

Safety

how it stays safe

Destructive and irreversible tools (delete case, delete alert, merge cases, promote alert) and the raw Query DSL ship disabled and only become callable behind explicit environment flags, so an agent cannot quietly wipe or merge case data. TLS relaxation is scoped to TheHive requests via a per-client dispatcher, never the whole process, and sensitive values are redacted from error output.

More in Security / SOC8 tools

wazuh-mcpRead your Wazuh SIEM from your agent: alerts, agents, and CVEs, read-only. misp-mcpTurn MISP threat intel into answers: events, correlations, and IOC exports on demand. suricata-mcpHunt Suricata and Zeek NSM logs from your agent: alerts, flows, and C2 analytics. cortex-mcpDetonate an indicator and get one verdict: Cortex analyzers, confirm-gated. mitre-mcpMap alerts to ATT&CK and profile threat groups without leaving your agent. zeek-mcpQuery and correlate Zeek and Suricata NSM logs from your agent. hotwashBuild IR playbooks as flowcharts and run them step by step, agent-drivable. soc-stackOne command stands up a full SOC on Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata.