gbrigandi/mcp-server-thehive

An MCP (Model Context Protocol) server that provides AI models and automation tools with access to TheHive incident response platform.
Overview
This server acts as a bridge between MCP clients (like AI assistants) and TheHive, allowing them to:
- Retrieve and analyze security alerts
- Access case information
- Promote alerts to cases
- Perform incident response operations
Features
Available Tools
1. **get_thehive_alerts** - Retrieve a list of alerts from TheHive
- Optional limit parameter (default: 100)
- Returns formatted alert information including ID, title, severity, and status
2. **get_thehive_alert_by_id** - Get detailed information about a specific alert
- Required alert_id parameter
- Returns comprehensive alert details
3. **get_thehive_cases** - Retrieve a list of cases from TheHive
- Optional limit parameter (default: 100)
- Returns formatted case information
4. **get_thehive_case_by_id** - Get detailed information about a specific case
- Required case_id parameter
- Returns comprehensive case details
5. **promote_alert_to_case** - Promote an alert to a case
- Required alert_id parameter
- Returns information about the newly created case
6. **create_thehive_case** - Create a new case in TheHive
- Required title and description parameters
- Optional parameters: severity, tags, tlp, pap, status, assignee, case_template, start_date
- Returns information about the newly created case
Installation
Prerequisites
- Access to a TheHive 5 instance
- Valid TheHive API token
Downloading Pre-compiled Binaries
You can download pre-compiled binaries for various operating systems from the GitHub Releases page. Download the appropriate binary for your system, make it executable, and place it in your desired location.
Building from Source
Configuration
The server requires the following environment variables:
- THEHIVE_URL - TheHive API base URL (default: http://localhost:9000/api)
- THEHIVE_API_TOKEN - TheHive API token (required)
- VERIFY_SSL - Whether to verify SSL certificates (default: false)
- RUST_LOG - Logging level (optional, e.g., debug, info)
Environment File
Create a .env file in the project root:
Getting a TheHive API Token
1. Log into your TheHive instance
2. Go to **User Settings** → **API Keys**
3. Click **Create API Key**
4. Copy the generated token and use it as THEHIVE_API_TOKEN
Usage
Running the Server
Integration with MCP Clients
The server communicates over stdio using the MCP protocol. Configure your MCP client to use this server:
Examples
Retrieving Recent Alerts
Getting Alert Details
Promoting an Alert to Case
Creating a New Case
Development
Project Structure
Dependencies
- **rmcp** - MCP protocol implementation
- **thehive-client** - TheHive API client library
- **tokio** - Async runtime
- **reqwest** - HTTP client
- **serde** - Serialization framework
- **tracing** - Logging and instrumentation
Testing
The project includes a comprehensive suite of integration tests that leverage a mock TheHive server. This mock server simulates the TheHive API, allowing for isolated and repeatable testing of the MCP server's functionality without requiring a live TheHive instance.