mcp-server-thehiveMCP Server for TheHive

— (0)

Reviewed by Daniel Nikulshyn·Updated July 2026

Overview

MCP Server for TheHive is a bridge between MCP clients and TheHive incident response platform. It allows AI models and automation tools to access TheHive's features, such as retrieving and analyzing security alerts, accessing case information, promoting alerts to cases, and performing incident response operations. The server provides a set of tools for interacting with TheHive, including retrieving alerts and cases, getting detailed information about specific alerts and cases, promoting alerts to cases, and creating new cases. It communicates over stdio using the MCP protocol.

Key features

get_thehive_alerts - Retrieve a list of alerts from TheHive
get_thehive_alert_by_id - Get detailed information about a specific alert
get_thehive_cases - Retrieve a list of cases from TheHive
get_thehive_case_by_id - Get detailed information about a specific case
promote_alert_to_case - Promote an alert to a case
create_thehive_case - Create a new case in TheHive

Pricing

Model: Free
Category: MCP Servers
Rating: No reviews yet

Use cases

Incident Response

Use MCP Server for TheHive to retrieve and analyze security alerts, and perform incident response operations.

Automation

Integrate MCP Server for TheHive with AI models and automation tools to automate incident response workflows.

Pros & Cons

Pros

Acts as a bridge between MCP clients and TheHive
Provides access to TheHive incident response platform features
Allows AI models and automation tools to interact with TheHive

Cons

Requires access to a TheHive 5 instance
Needs a valid TheHive API token for authentication

Reviews

No reviews yet. Be the first!

Q&A

How do I install and configure the server?

You can download a pre‑compiled binary for your OS from the GitHub releases, make it executable, and set the required environment variables in a .env file (THEHIVE_URL and THEHIVE_API_TOKEN). Alternatively, you can build from source using Cargo.

Asked by Wei Chen · Mar 1, 2026

Which TheHive functions can the MCP server expose to AI models?

It provides tools to retrieve alerts and cases, get detailed info for a specific alert or case, promote an alert into a case, and create new cases with optional fields like severity, tags, and assignee.

Asked by Nadia Benali · Feb 15, 2026

What do I need to run the MCP Server for TheHive?

You must have access to a TheHive 5 instance and a valid TheHive API token. The server also requires the environment variables THEHIVE_URL and THEHIVE_API_TOKEN (and optionally VERIFY_SSL and RUST_LOG).

Asked by Fatima Zahra · Feb 9, 2026