mcp-panther

Panther MCP Server provides a suite of tooling to write and tune detections, query security logs with natural language, and triage alerts all from a unified interface. The server exposes tools under categories like Alerts, Data Lake, Detections, Scheduled Queries, Sources, Global Helpers, Data Models, Schemas, Metrics, and Users & Access Management. With these tools you can add comments to alerts, start AI-powered triage, retrieve summaries, run SQL-like queries against Panther’s data lake, inspect alert events, manage scheduled queries, and retrieve schema or log source details. Typical workflows include writing or tuning detections from your IDE, querying logs using natural language prompts, and bulk-updating alert statuses or assignees to triage incidents efficiently.

Prerequisites:

• Node.js (recommended v14+ or as required by the MCP server) and npm installed on your system
• Optional: Docker for containerized startup

Install and run using npx (no global install required):

1. Ensure you are authenticated to access the MCP package if needed (e.g., a private registry). 2) Start the server: npx -y panther-mcp-panther

Alternative: run via Docker (if provided by the project):

1. Pull the image: docker pull panther/mcp-panther:latest
2. Run the container: docker run -i panther/mcp-panther:latest

If you prefer a global npm install (less common for ephemeral runs):

1. Install globally: npm install -g panther-mcp-panther
2. Run the server (adjust path as needed): panther-mcp-panther

Note: If the MCP server requires specific environment variables (for example, API keys, endpoints, or authentication tokens), set them in your environment before starting the server (see additional_notes for details).

Environment variables and configuration options may control authentication, data sources, and destinations for detections and alerts. Common items to document include:

• API_ENDPOINT or PANTHER_API_URL: base URL for Panther API
• API_TOKEN or PANTHER_API_TOKEN: authentication token
• LOG_LEVEL or MCP_LOG_LEVEL: logging verbosity
• DATA_LAKE_CONNECTION_STRING or PANTHER_DATA_LAKE_URI: connection to the data lake If you encounter startup issues, check that your Node/npm versions are compatible with the MCP package, verify network access to any required Panther endpoints, and ensure any required tokens or secrets are provided. For local development, you can start with a minimal configuration and gradually enable advanced tools like AI triage or data-lake queries as you confirm connectivity.