gbrigandi/mcp-server-thehive

MCP Server for TheHive

An MCP (Model Context Protocol) server that provides AI models and automation tools with access to TheHive incident response platform.

Overview

This server acts as a bridge between MCP clients (like AI assistants) and TheHive, allowing them to:

• Retrieve and analyze security alerts
• Access case information
• Promote alerts to cases
• Perform incident response operations

Features

Available Tools

1. get_thehive_alerts - Retrieve a list of alerts from TheHive

   • Optional limit parameter (default: 100)
   • Returns formatted alert information including ID, title, severity, and status

2. get_thehive_alert_by_id - Get detailed information about a specific alert

   • Required alert_id parameter
   • Returns comprehensive alert details

3. get_thehive_cases - Retrieve a list of cases from TheHive

   • Optional limit parameter (default: 100)
   • Returns formatted case information

4. get_thehive_case_by_id - Get detailed information about a specific case

   • Required case_id parameter
   • Returns comprehensive case details

5. promote_alert_to_case - Promote an alert to a case

   • Required alert_id parameter
   • Returns information about the newly created case

6. create_thehive_case - Create a new case in TheHive

   • Required title and description parameters
   • Optional parameters: severity, tags, tlp, pap, status, assignee, case_template, start_date
   • Returns information about the newly created case