MCP Server that bridges MCP clients with TheHive incident-response platform.
https://github.com/gbrigandi/mcp-server-thehiveTurn your AI assistant into a security analyst that can actually do something about incidents. This MCP server bridges Claude, ChatGPT, or any MCP-compatible AI directly to your TheHive incident response platform.
Security teams are drowning in alerts, but AI assistants can't touch your actual incident response systems. You're stuck copy-pasting between your AI chat and TheHive, losing context and wasting precious response time.
This server changes that. Your AI can now:
You: "Show me high-severity alerts from the last 24 hours and analyze which ones might be related to the APT campaign we're tracking."
AI: *Retrieves alerts, correlates IoCs, identifies 3 potential matches*
"Based on the domain patterns and timing, these alerts likely belong to the same campaign. Should I promote them to a case?"
You: "Yes, create a case called 'APT-29 Infrastructure Expansion'"
AI: *Creates case, links related alerts, applies appropriate TLP and severity*
Your AI assistant can now handle the tedious parts of incident response:
You: "What similar malware cases have we handled in the past 6 months?"
AI: *Searches cases, analyzes patterns*
"Found 4 similar cases involving the same C2 infrastructure. Here's the progression and our successful containment strategy..."
Built for security teams who need reliability. Written in Rust for performance, with comprehensive error handling and proper SSL verification.
export THEHIVE_URL=https://your-thehive.company.com/api
export THEHIVE_API_TOKEN=your-api-token
export VERIFY_SSL=true
{
"mcpServers": {
"thehive": {
"command": "/path/to/mcp-server-thehive",
"env": {
"THEHIVE_URL": "https://your-thehive.company.com/api",
"THEHIVE_API_TOKEN": "your-api-token"
}
}
}
}
Alert Management:
get_thehive_alerts - Retrieve and filter alerts with custom limitsget_thehive_alert_by_id - Deep-dive into specific alert detailspromote_alert_to_case - Convert critical alerts to full investigationsCase Operations:
get_thehive_cases - Query your case databaseget_thehive_case_by_id - Access complete case informationcreate_thehive_case - Generate new investigations with proper metadataEach tool returns structured data your AI can analyze, correlate, and act upon.
This isn't a proof-of-concept. It includes:
Download the latest binary from the releases page or build from source:
git clone https://github.com/gbrigandi/mcp-server-thehive.git
cd mcp-server-thehive
cargo build --release
Stop manually juggling between AI insights and your security tools. Give your AI assistant direct access to your incident response platform and watch your team's efficiency multiply.
Your SOC deserves better than copy-paste workflows.