thehive-mcp

Active

Running a SOC through TheHive means clicking through cases, alerts, observables, and Cortex jobs one screen at a time. thehive-mcp hands the whole incident-response workflow to your agent: triage alerts, open and update cases, enrich observables, and run analyzers in plain language, with the irreversible verbs gated off by default.

GitHub repo → npm: thehive-mcp →

47 tools3 resources3 promptswrite-gatedTheHive 5MIT

See it work

one question, the tools it calls, the answer

representative session · claude + thehive-mcp

Any new high-severity alerts this morning, and does the source IP look malicious?

thehive_list_alerts{ status: "New", severity: ">=3", range: "12h" }

2 alerts ~alrt-8842 Suspicious outbound C2 severity 3 src 203.0.113.47 sight/edr ~alrt-8846 Failed MFA burst severity 2 src 198.51.100.9 okta

thehive_run_analyzer_and_wait{ observable: "203.0.113.47", analyzer: "AbuseIPDB_1_0" }

malicious confidence 92 14 reports, last seen 4h ago category: C2, brute-force

~alrt-8842 is the real one. The C2 destination 203.0.113.47 scores 92 malicious on AbuseIPDB with recent C2 reports. I would promote it to a case and block the IP. The MFA burst looks like noise.

Representative session. Illustrative values, RFC 5737 addresses. Promote and delete are gated off by default. Your data never leaves the box.

What it does

thehive-mcp is a Model Context Protocol server for TheHive 5, the open-source incident-response and case-management platform. Point any MCP client at it and TheHive becomes 47 named, typed tools your agent can call in natural language: open and triage cases, promote and manage alerts, add and search observables, run and poll Cortex analyzers, and file task logs and comments. It differs from a raw REST client or a generic OpenAPI-to-MCP bridge because it is hand-built for TheHive: the irreversible verbs (delete case, delete alert, merge, promote) and the raw Query DSL ship disabled behind explicit environment flags, TLS relaxation is scoped to TheHive requests only, and the tool descriptions carry the correct TheHive 5 status enums so an agent cannot destroy case data or drift on stale semantics. It speaks stdio and launches on demand, so nothing listens on a port and nothing phones home.

Capabilities

47 tools across the SOC workflow

Cases16 tools

List, get, create, update, search, close, assign, tag, flag, bulk-assign and bulk-close cases, plus timeline summaries; delete and merge are gated.

Alerts6 tools

List, get, create, and update alerts; promote-to-case and delete are gated behind the destructive flag.

Observables & tasks11 tools

Add single or bulk observables, search across all cases, and manage tasks with their log entries.

Cortex analyzers7 tools

List analyzers, find enrichment options, run analyzers, poll jobs to completion, and summarize reports.

Comments, users & templates6 tools

Add and list case comments, list users and the current profile, and list case templates.

Query & status2 tools

Guarded raw TheHive Query DSL (gated) for complex searches, plus a server health and capability check.

Full reference on GitHub →

Set it up

npx -y thehive-mcp

Configure with THEHIVE_URL and THEHIVE_API_KEY. Add THEHIVE_ALLOW_DESTRUCTIVE_TOOLS=true and THEHIVE_ENABLE_RAW_QUERY=true only to opt into the gated tools.

MCP client config

{ "mcpServers": { "thehive": { "command": "npx", "args": ["-y", "thehive-mcp"], "env": { "THEHIVE_URL": "https://192.0.2.10:9000", "THEHIVE_API_KEY": "your-api-key" } } } }

[ shield ]

Destructive and irreversible tools (delete case, delete alert, merge cases, promote alert) and the raw Query DSL ship disabled and only become callable behind explicit environment flags, so an agent cannot quietly wipe or merge case data. TLS relaxation is scoped to TheHive requests via a per-client dispatcher, never the whole process, and sensitive values are redacted from error output.

MCP tools

gated verbs

stdio

no open port

MIT

license