MCP (Model Context Protocol) server for TheHive security incident response platform. Lets AI agents create cases, manage alerts, track observables, run Cortex analyzers, and orchestrate incident response workflows.

Tested against TheHive 5.4.11 with full end-to-end verification (36 live integration tests).

• 35 tools covering the full TheHive 5 API surface
• Case management - create, list, get, update, close, delete, search, merge cases
• Alert management - create, list, get, update, promote to case, delete alerts
• Task management - create, list, get, update tasks within cases
• Observable management - add (single + bulk), list, get, search observables
• Task logs - add and list log entries on tasks
• Comments - add and list comments on cases
• User management - list users, get current user info
• Cortex integration - list analyzers, run analyzer jobs, get job results
• Raw query API - execute arbitrary TheHive Query DSL for complex searches
• Case templates - list available templates for case creation
• Status - health check, version info, capabilities
• 3 prompt templates - case summary, alert triage, incident response workflow
• 3 resources - open cases, new alerts, current user

npm install -g thehive-mcp

Or run directly:

npx thehive-mcp

Set environment variables:

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "thehive": {
      "command": "thehive-mcp",
      "env": {
        "THEHIVE_URL": "http://your-thehive:9000",
        "THEHIVE_API_KEY": "your-api-key"
      }
    }
  }
}

claude mcp add thehive \
  --env THEHIVE_URL=http://your-thehive:9000 \
  --env THEHIVE_API_KEY=your-api-key \
  -- thehive-mcp

Add --scope user to make it available from any directory instead of only the current project.

If you're running from a source checkout instead of the npm-installed binary, point command/args at the built dist/index.js:

openclaw mcp set thehive '{
  "command": "node",
  "args": ["/absolute/path/to/thehive-mcp/dist/index.js"],
  "env": {
    "THEHIVE_URL": "http://your-thehive:9000",
    "THEHIVE_API_KEY": "your-api-key"
  }
}'

Or, with the global npm install:

openclaw mcp set thehive '{
  "command": "thehive-mcp",
  "env": {
    "THEHIVE_URL": "http://your-thehive:9000",
    "THEHIVE_API_KEY": "your-api-key"
  }
}'

Then restart the OpenClaw gateway so the new server is picked up:

systemctl --user restart openclaw-gateway
openclaw mcp list   # confirm "thehive" is registered

Hermes Agent reads MCP config from ~/.hermes/config.yaml under the mcp_servers key. Add an entry:

mcp_servers:
  thehive:
    command: "thehive-mcp"
    env:
      THEHIVE_URL: "http://your-thehive:9000"
      THEHIVE_API_KEY: "your-api-key"

Or, when running from a source checkout instead of the global npm install:

mcp_servers:
  thehive:
    command: "node"
    args: ["/absolute/path/to/thehive-mcp/dist/index.js"]
    env:
      THEHIVE_URL: "http://your-thehive:9000"
      THEHIVE_API_KEY: "your-api-key"

Then reload MCP from inside a Hermes session:

/reload-mcp

Codex CLI registers MCP servers via codex mcp add:

codex mcp add thehive \
  --env THEHIVE_URL=http://your-thehive:9000 \
  --env THEHIVE_API_KEY=your-api-key \
  -- thehive-mcp

Or, when running from a source checkout:

codex mcp add thehive \
  --env THEHIVE_URL=http://your-thehive:9000 \
  --env THEHIVE_API_KEY=your-api-key \
  -- node /absolute/path/to/thehive-mcp/dist/index.js

Codex writes the entry to ~/.codex/config.toml under [mcp_servers.thehive]. Verify with:

codex mcp list

# Install dependencies
npm install

# Build
npm run build

# Run tests (unit, 68 tests)
npm test

# Run live integration tests (36 tests, requires TheHive instance)
THEHIVE_URL=http://your-thehive:9000 THEHIVE_API_KEY=your-key npx tsx scripts/live-test.ts

# Type check
npm run typecheck

# Development mode
THEHIVE_URL=http://your-thehive:9000 THEHIVE_API_KEY=your-key npm run dev

• Organizations matter. The admin org only has platform permissions. Create a separate org (e.g. "SOC") with an org-admin user for full case/alert/task/observable access.
• Case statuses changed in v5. Closed statuses are: TruePositive, FalsePositive, Indeterminate, Duplicated, Other. There is no "Resolved" status.
• PATCH returns 204. Update operations return no body; the client re-fetches the entity automatically.
• Observable creation returns arrays. The client handles this transparently. Bulk creation uses data as an array.
• Cortex connector endpoints live under /api/connector/ not /api/v1/.
• description is required when creating cases and alerts.

MIT