An MCP (Model Context Protocol) server that provides AI models and automation tools with access to TheHive incident response platform. This server acts as a bridge between MCP clients (like AI assistants) and TheHive, allowing them to: - Retrieve and analyze security alerts - Access case information - Promote alerts to cases - Perform incident response operations 1. getthehivealerts - Retrieve a l
Add this skill
npx mdskills install gbrigandi/mcp-server-thehiveWell-documented MCP server enabling comprehensive security incident management through TheHive API integration
1# MCP Server for TheHive23An MCP (Model Context Protocol) server that provides AI models and automation tools with access to TheHive incident response platform.45## Overview67This server acts as a bridge between MCP clients (like AI assistants) and TheHive, allowing them to:89- Retrieve and analyze security alerts10- Access case information11- Promote alerts to cases12- Perform incident response operations1314## Features1516### Available Tools17181. **get_thehive_alerts** - Retrieve a list of alerts from TheHive19 - Optional `limit` parameter (default: 100)20 - Returns formatted alert information including ID, title, severity, and status21222. **get_thehive_alert_by_id** - Get detailed information about a specific alert23 - Required `alert_id` parameter24 - Returns comprehensive alert details25263. **get_thehive_cases** - Retrieve a list of cases from TheHive27 - Optional `limit` parameter (default: 100)28 - Returns formatted case information29304. **get_thehive_case_by_id** - Get detailed information about a specific case31 - Required `case_id` parameter32 - Returns comprehensive case details33345. **promote_alert_to_case** - Promote an alert to a case35 - Required `alert_id` parameter36 - Returns information about the newly created case37386. **create_thehive_case** - Create a new case in TheHive39 - Required `title` and `description` parameters40 - Optional parameters: `severity`, `tags`, `tlp`, `pap`, `status`, `assignee`, `case_template`, `start_date`41 - Returns information about the newly created case4243## Installation4445### Prerequisites4647- Access to a TheHive 5 instance48- Valid TheHive API token4950### Downloading Pre-compiled Binaries5152You can download pre-compiled binaries for various operating systems from the [GitHub Releases page](https://github.com/gbrigandi/mcp-server-thehive/releases). Download the appropriate binary for your system, make it executable, and place it in your desired location.5354### Building from Source5556```bash57git clone <repository-url>58cd mcp-server-thehive59cargo build --release60```6162## Configuration6364The server requires the following environment variables:6566- `THEHIVE_URL` - TheHive API base URL (default: `http://localhost:9000/api`)67- `THEHIVE_API_TOKEN` - TheHive API token (required)68- `VERIFY_SSL` - Whether to verify SSL certificates (default: `false`)69- `RUST_LOG` - Logging level (optional, e.g., `debug`, `info`)7071### Environment File7273Create a `.env` file in the project root:7475```env76THEHIVE_URL=https://your-thehive-instance.com/api77THEHIVE_API_TOKEN=your-api-token-here78VERIFY_SSL=true79RUST_LOG=info80```8182### Getting a TheHive API Token83841. Log into your TheHive instance852. Go to **User Settings** → **API Keys**863. Click **Create API Key**874. Copy the generated token and use it as `THEHIVE_API_TOKEN`8889## Usage9091### Running the Server9293```bash94# Using cargo95cargo run9697# Using the built binary98./target/release/mcp-server-thehive99```100101### Integration with MCP Clients102103The server communicates over stdio using the MCP protocol. Configure your MCP client to use this server:104105```json106{107 "mcpServers": {108 "thehive": {109 "command": "/path/to/mcp-server-thehive",110 "env": {111 "THEHIVE_URL": "https://your-thehive-instance.com:9000/api",112 "THEHIVE_API_TOKEN": "your-api-token-here"113 }114 }115 }116}117```118119## Examples120121### Retrieving Recent Alerts122123```json124{125 "method": "tools/call",126 "params": {127 "name": "get_thehive_alerts",128 "arguments": {129 "limit": 10130 }131 }132}133```134135### Getting Alert Details136137```json138{139 "method": "tools/call",140 "params": {141 "name": "get_thehive_alert_by_id",142 "arguments": {143 "alert_id": "~123456"144 }145 }146}147```148149### Promoting an Alert to Case150151```json152{153 "method": "tools/call",154 "params": {155 "name": "promote_alert_to_case",156 "arguments": {157 "alert_id": "~123456"158 }159 }160}161```162163### Creating a New Case164165```json166{167 "method": "tools/call",168 "params": {169 "name": "create_thehive_case",170 "arguments": {171 "title": "Potential Malware Outbreak",172 "description": "Multiple endpoints reporting suspicious process activity.",173 "severity": 3,174 "tags": ["malware", "endpoint", "epp"],175 "tlp": 2,176 "assignee": "soc_level2"177 }178 }179}180```181182## Development183184### Project Structure185186```187mcp-server-thehive/188├── src/189│ ├── main.rs # Main server implementation190│ ├── lib.rs # Library exports191│ └── thehive/192│ ├── mod.rs # Module declarations193│ ├── client.rs # TheHive API client194│ └── error.rs # Error types195├── tests/196│ ├── bin/197│ │ └── mock_thehive_server.rs # Mock TheHive API server for testing198│ ├── integration_test.rs # Integration tests199│ └── mcp_stdio_test.rs # Stdio interface tests200├── Cargo.toml # Dependencies and metadata201└── README.md # This file202```203204### Dependencies205206- **rmcp** - MCP protocol implementation207- **thehive-client** - TheHive API client library208- **tokio** - Async runtime209- **reqwest** - HTTP client210- **serde** - Serialization framework211- **tracing** - Logging and instrumentation212213### Testing214215The project includes a comprehensive suite of integration tests that leverage a mock TheHive server. This mock server simulates the TheHive API, allowing for isolated and repeatable testing of the MCP server's functionality without requiring a live TheHive instance.216217**Running Tests:**218219```bash220# Run all tests (including integration tests that use the mock server)221cargo test222223# Run tests with verbose logging (includes MCP server and mock server logs)224RUST_LOG=debug MCP_SERVER_THEHIVE_VERBOSE_TEST_LOGS=true cargo test225```226227## Security Considerations228229- Store API tokens securely (use environment variables or secure credential stores)230- Never commit API tokens to version control231- Enable SSL verification in production environments232- Limit network access to TheHive instance233- Use least-privilege API tokens for TheHive access234- Monitor and log all API interactions235- Rotate API tokens regularly236237## Troubleshooting238239### Common Issues2402411. **Connection Refused**242 - Verify `THEHIVE_URL` is correct243 - Check network connectivity to TheHive instance244 - Ensure TheHive is running and accessible2452462. **Authentication Failed**247 - Verify `THEHIVE_API_TOKEN` is correct and not expired248 - Check if the API token has necessary permissions249 - Ensure the token is properly formatted2502513. **SSL Certificate Errors**252 - Set `VERIFY_SSL=false` for testing (not recommended for production)253 - Install proper SSL certificates254 - Use valid certificate authority255256### Logging257258Enable debug logging for troubleshooting:259260```bash261RUST_LOG=debug cargo run262```263264## Contributing2652661. Fork the repository2672. Create a feature branch2683. Make your changes2694. Add tests if applicable2705. Submit a pull request271272## License273274This project is licensed under the MIT License - see the LICENSE file for details.275276## Related Projects277278- [thehive-client-rs](https://github.com/gbrigandi/thehive-client-rs) - Rust client library for TheHive API279- [mcp-server-cortex](https://github.com/gbrigandi/mcp-server-cortex) - MCP server for Cortex280- [mcp-server-wazuh](https://github.com/gbrigandi/mcp-server-wazuh) - MCP server for Wazuh SIEM281
Full transparency — inspect the skill content before installing.