TheHive MCP server

This is a small helper that connects your AI assistant to TheHive, a tool that security teams use to track alerts and investigate incidents. Once it is set up, you can ask your AI about your alerts and cases in plain language instead of clicking around. It is handy for anyone who works in a security operations centre or handles incident response.

What this MCP server does

You ask your AI something about your security alerts or cases, in normal words. The AI passes that request to this helper program running on your computer. The helper then talks to your TheHive instance using your API token, and pulls back the alerts or case details you asked about. It can also take actions, like turning an alert into a case or creating a brand new case. The AI then shows you the result right in the chat.

Click to zoom

What you can do with it

• List recent alerts from TheHive
• Look up the full details of one alert by its ID
• List your open cases
• Look up the full details of one case by its ID
• Promote an alert into a case
• Create a new case with a title, description, severity and tags

Try asking your AI

• “Show me the last 10 alerts in TheHive”
• “Give me the details of alert ~123456”
• “List my open cases”
• “Create a case called Suspicious login attempts, severity 3, tagged phishing”

What it gives back to you

You get answers in the chat, usually as a list or a short summary. For alerts you see things like the ID, title, severity and status. For cases you see the case details, and when you create or promote one, you get back information about the new case that was made.

Before you start

Who it's for

Security analysts, incident responders and SOC teams who already use TheHive and want to ask their AI about alerts and cases.