TheHive

You can use TheHive MCP Server to expose a standard Model Context Protocol interface for TheHive, enabling automated interactions with cases, alerts, observables, tasks, and more from MCP clients. This server lets you perform common incident response actions in a consistent, scalable way with your TheHive instance.

How to use

You integrate an MCP client with the TheHive MCP Server to perform actions such as creating cases, updating alerts, adding attachments, running analyzers, and managing tasks. The MCP interface exposes a wide set of endpoints that map to TheHive capabilities, so you can automate incident handling, enrichment, and collaboration workflows from your preferred automation or orchestration tool.

How to install

Prerequisites: you need Python installed on your system to install and run the MCP server.

Install the MCP server package dependencies and the official TheHive client library automatically when you install the package.

Install dependencies and set up the server locally:

Environment setup and running the server

Configure your TheHive connection by setting the required environment variables for the server to authenticate with TheHive.

export HIVE_URL=https://your-thehive-host:9000
export HIVE_API_KEY=your-api-key

Run the MCP server using the runtime command shown in typical setups. You start the server from the package that provides the MCP entry point.

pip install .
export HIVE_URL=https://your-thehive-host:9000
export HIVE_API_KEY=your-api-key
python -m thehive_mcp

Configuration notes

The server expects TheHive to be reachable at the URL you provide and an API key to authorize requests. Use a dedicated API key with appropriate permissions for MCP operations. You can run the server in a development environment or as part of a larger automation platform.

Security considerations

Keep your API key secure and rotate it periodically. Do not expose URL or credentials in logs or shared configurations. If you run the server in production, use secure channels (HTTPS) and consider network access controls to limit who can initiate MCP requests.

Troubleshooting tips

If you cannot reach TheHive from the MCP server, verify network connectivity, DNS resolution, and that the HIVE_URL is correct. If the API key is rejected, check that it has not expired and that it has the necessary permissions for MCP actions.

Notes

Multiple MCP runtime options are supported. If you use a local runner or a task orchestrator, ensure the command and environment align with the MCP startup requirements described above.

Available tools

add_case_attachment

Attach a file or note to an existing case.

assign_task

Assign a task to a user or a group within a case.

bulk_delete_alerts

Delete multiple alerts in bulk.

bulk_delete_observables

Delete multiple observables in bulk.

bulk_merge_alerts_into_case

Merge several alerts into a single case.

bulk_update_alerts

Apply updates to multiple alerts at once.

bulk_update_cases

Update several cases in a single operation.

bulk_update_observables

Update multiple observables in one call.

bulk_update_tasks

Update several tasks simultaneously.

close_case

Close an active case.

complete_task

Mark a task as completed.

count_alerts

Return the number of alerts matching criteria.

count_cases

Return the number of cases matching criteria.

count_observables

Return the number of observables matching criteria.

count_tasks

Return the number of tasks matching criteria.

create_alert

Create a new alert.

create_alert_observable

Create and associate an observable to an alert.

create_case

Create a new case.

create_case_observable

Create and associate an observable to a case.

create_case_page

Create a new page in a case.

create_case_procedure

Create a procedure for a case.

create_case_task

Create a task within a case.

create_cortex_analyzer_job

Submit a Cortex analyzer job.

create_cortex_responder_action

Create a responder action for Cortex integration.

create_observable_in_alert

Create an observable and attach it to an alert.

create_observable_in_case

Create an observable and attach it to a case.

create_task

Create a standalone task.

create_task_log

Log an entry for a task.

delete_alert

Delete a specific alert.

delete_case

Delete a specific case.

delete_case_attachment

Remove an attachment from a case.

delete_observable

Delete a specific observable.

delete_task

Delete a specific task.

download_case_attachment

Download an attachment from a case.

find_alert_observables

Find observables related to an alert.

find_case_attachments

List attachments for a case.

find_case_comments

Retrieve comments on a case.

find_case_observables

List observables within a case.

find_case_pages

List pages in a case.

find_case_procedures

List procedures for a case.

find_case_tasks

List tasks in a case.

find_task_logs

Retrieve logs for a task.

follow_alert

Follow an alert for updates.

get_alert

Retrieve a specific alert.

get_alert_similar_observables

Find observables similar to an alert.

get_alerts

List alerts matching criteria.

get_case

Retrieve a specific case.

get_case_similar_observables

Find observables similar to a case.

get_cases

List cases matching criteria.

get_cortex_analyzer

Retrieve a Cortex analyzer configuration.

get_cortex_analyzer_job

Get a Cortex analyzer job status.

get_observable

Retrieve a specific observable.

get_observable_analyzer_jobs

List analyzer jobs for an observable.

get_observables

List observables matching criteria.

get_task

Retrieve a specific task.

get_tasks

List tasks matching criteria.

import_alert_into_case

Import an alert into an existing case.

list_cortex_analyzers

List available Cortex analyzers.

list_cortex_analyzers_by_type

List Cortex analyzers filtered by type.

list_cortex_responders

List Cortex responders.

merge_alert_into_case

Merge an alert into a case.

merge_cases

Merge multiple cases into one.

promote_alert_to_case

Promote an alert to a new case.

run_observable_analyzer

Run an analyzer on an observable.

run_observable_analyzers

Run multiple analyzers on an observable.

share_observable

Share an observable with another user or system.

start_task

Start or activate a task.

unfollow_alert

Stop following an alert.

unshare_observable

Unshare an observable.

update_alert

Update an alert.

update_case

Update a case.

update_observable

Update an observable.

update_task

Update a task.