mcp -thehive

This MCP server exposes a set of tools that interface with TheHive to assist with incident response and threat hunting. Clients can query alerts and cases, fetch detailed information, promote alerts into cases, and create new cases directly from MCP workflows. Each tool is exposed as a named action (e.g., get_thehive_alerts, get_thehive_alert_by_id, promote_alert_to_case, etc.) and can be invoked by an MCP client using the MCP stdio protocol. The server handles authentication against TheHive via API tokens, and returns structured data about alerts and cases for downstream automation or AI assistants.

To use the server, configure your MCP client to point at the server binary and supply the required environment variables for TheHive access. Typical usage involves calling tools/call with the tool name and any required arguments, then processing the returned data to drive automation or case management in your workflow.

Prerequisites

• A TheHive 5 instance and a valid API token
• Rust toolchain (rustc/cargo) installed on your machine
• Access to build or download the pre-built binary for mcp-server-thehive

Installation steps

1. Install Rust and build from source (optional if you download a pre-built binary):

# Install Rust (if not already installed)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Clone the repository
git clone <repository-url>
cd mcp-server-thehive

# Build in release mode
cargo build --release

2. Download and run the pre-built binary (if available):

# Example: download and set executable permissions, then run
# (Replace with actual release asset URL)
wget https://github.com/gbrigandi/mcp-server-thehive/releases/download/vX.Y.Z/mcp-server-thehive-linux
chmod +x mcp-server-thehive-linux
./mcp-server-thehive-linux

3. Run directly via cargo (development):

cargo run

4. Prepare configuration (see mcp_config section) and ensure environment variables are set before starting the server.

• TheHive_URL should point to your TheHive API base URL, typically something like https://thehive.example.com/api. Ensure network access from the MCP server to TheHive.
• THEHIVE_API_TOKEN must be a valid API token with appropriate permissions for alerts and cases access.
• VERIFY_SSL controls SSL certificate verification; disable only in non-production environments.
• The server communicates over stdio via the MCP protocol; ensure your MCP client is configured to use the specified server entry (e.g., thehive).
• When promoting an alert to a case or creating a new case, provide required parameters (alert_id for promote, title and description for create_thehive_case).
• Review logs (set RUST_LOG) for troubleshooting during integration and testing.