TheHive

You set up an MCP server that bridges AI agents with TheHive, enabling you to retrieve alerts and cases, promote alerts to cases, and perform common incident-response actions directly from MCP clients.

How to use

You run the MCP server locally or in your environment and connect MCP clients to it over stdio. The server exposes a set of tools that let you fetch TheHive alerts and cases, view details, promote alerts to cases, and create new cases. Use these tools from your MCP client to automate incident response workflows, escalate incidents, or run scripted investigations against TheHive data.

How to install

Prerequisites: you need a TheHive 5 instance and a valid TheHive API token.

1. Install Rust and Cargo if you do not have them already.

2. Obtain the MCP server source code and navigate to the project root.

3. Build the project for release.

4. Run the server using one of the provided methods.

Configuration

The server relies on environment variables to connect to TheHive and to configure runtime behavior. You should provide these values in your environment or an .env file in the project root.

THEHIVE_URL=https://your-thehive-instance.com/api
THEHIVE_API_TOKEN=your-api-token-here
VERIFY_SSL=true
RUST_LOG=info

Usage examples

You can start the server in development mode with Cargo or run the built binary. Use one of the commands below to start the server, then connect your MCP client to it.

# Using Cargo
cargo run

# Using the built binary
./target/release/mcp-server-thehive

MCP connection configurations

The MCP server can be connected to as a stdio server. If you want to run it as a local process and connect via stdio, use one of the following configurations:

{
  "mcpServers": {
    "thehive": {
      "type": "stdio",
      "name": "thehive",
      "command": "cargo",
      "args": ["run"],
      "env": [
        {"name": "THEHIVE_URL", "value": "https://your-thehive-instance.com/api"},
        {"name": "THEHIVE_API_TOKEN", "value": "your-api-token-here"},
        {"name": "VERIFY_SSL", "value": "true"},
        {"name": "RUST_LOG", "value": "info"}
      ]
    },
    "thehive_binary": {
      "type": "stdio",
      "name": "thehive",
      "command": "./target/release/mcp-server-thehive",
      "args": [],
      "env": [
        {"name": "THEHIVE_URL", "value": "https://your-thehive-instance.com/api"},
        {"name": "THEHIVE_API_TOKEN", "value": "your-api-token-here"},
        {"name": "VERIFY_SSL", "value": "true"},
        {"name": "RUST_LOG", "value": "info"}
      ]
    }
  }
}

Tools and capabilities

The MCP server provides the following tools to interact with TheHive data. You can call these tools from your MCP client to perform common incident-response tasks.

• get_thehive_alerts — Retrieve a list of alerts from TheHive with an optional limit (default 100). Returns alert IDs, titles, severities, and statuses.
• get_thehive_alert_by_id — Get detailed information about a specific alert using alert_id.
• get_thehive_cases — Retrieve a list of cases with an optional limit (default 100).
• get_thehive_case_by_id — Get detailed information about a specific case using case_id.
• promote_alert_to_case — Promote an alert to a new case using alert_id and return the created case details.
• create_thehive_case — Create a new TheHive case with required title and description and optional fields like severity, tags, tlp, pap, status, assignee, case_template, start_date.

Security considerations

Store API tokens securely (use environment variables or a secure credential store). Never commit tokens to version control. Enable SSL verification in production, and limit network access to your TheHive instance. Use least-privilege API tokens and rotate tokens regularly.

Troubleshooting

If you encounter issues connecting to TheHive, verify the URL and API token, ensure SSL verification settings are aligned with your environment, and check network access to TheHive. Increase logging for more detail if needed.

Available tools

get_thehive_alerts

Fetches a list of alerts from TheHive with optional limit parameter and returns basic alert details.

get_thehive_alert_by_id

Retrieves detailed information for a specific alert identified by alert_id.

get_thehive_cases

Retrieves a list of cases from TheHive with optional limit parameter.

get_thehive_case_by_id

Fetches comprehensive details for a specific case by case_id.

promote_alert_to_case

Promotes an existing alert to a new case and returns the newly created case details.

create_thehive_case

Creates a new case in TheHive with required title and description and optional fields like severity, tags, tlp, pap, status, assignee, case_template, start_date.