TheHive MCP Server for Security Incident Response

Overview

TheHive MCP Server implements a lightweight Model Context Protocol (MCP) server that sits between alert producers and TheHive incident response platform. It centralizes incoming alerts and contextual data, exposes a consistent REST API for consumers and automation, and simplifies the flow of alerts into TheHive for faster triage and remediation. Developers and SecOps teams can use it to normalize alerts from many sources, add enrichment or deduplication logic, and push curated context into TheHive cases.

This server is intended for deployment alongside TheHive or as a centralized ingestion service for multiple TheHive instances. It is commonly deployed in containerized environments and integrates with existing toolchains (SIEMs, MISP, EDRs, mail gateways) so that alerts arrive in a predictable format and can be programmatically consumed by orchestration workflows.

Features

• Centralized REST API to ingest and retrieve alerts and contextual models
• Schema-driven alert payloads (JSON) for consistent handling
• Persistence (local DB or mounted volume) for reliable storage of received models
• Authentication via API tokens / JWT (configurable)
• TLS support for secure transport (configurable)
• Ability to attach files/artefacts to alerts (attachments)
• Integration-ready: simple hooks to forward or map alerts to TheHive, SIEMs, or enrichment engines
• Lightweight and container-friendly (Docker / docker-compose)

Installation / Configuration

Minimum prerequisites: Docker (or another container runtime) and a host for persistent storage.

Quick start (Docker):

docker run -d \
  --name thehive-mcp \
  -p 8080:8080 \
  -e MCP_JWT_SECRET="replace-with-strong-secret" \
  -e MCP_BIND=0.0.0.0:8080 \
  -v /opt/thehive-mcp/data:/data \
  redwaysecurity/the-hive-mcp-server:latest

Example docker-compose.yml:

version: "3.7"
services:
  thehive-mcp:
    image: redwaysecurity/the-hive-mcp-server:latest
    ports:
      - "8080:8080"
    environment:
      MCP_BIND: "0.0.0.0:8080"
      MCP_JWT_SECRET: "replace-with-strong-secret"
      MCP_TLS_CERT: "/certs/server.crt"   # optional
      MCP_TLS_KEY: "/certs/server.key"    # optional
    volumes:
      - ./data:/data
      - ./certs:/certs   # if using TLS
    restart: unless-stopped

Common environment variables

Configuration can also be provided via a JSON/YAML file mounted into the container, depending on the specific build you use. Ensure persistent storage is used for message durability.

Integrating with TheHive

• Use the MCP server to aggregate and normalize alerts first.
• Then either configure the MCP server to forward mapped alerts to TheHive via TheHive API or write a small connector that pulls from the MCP REST API and creates cases in TheHive.

Available Resources

Common REST endpoints (typical; verify against the running server’s OpenAPI or docs):

• POST /api/models or /api/alerts — submit a new alert/model
• GET /api/alerts — list recent alerts
• GET /api/alerts/{id} — fetch a specific alert
• POST /api/alerts/{id}/attachments — upload an attachment
• POST /api/forward — optional endpoint to forward to configured downstream systems

Example: submit a simple alert with curl

curl -X POST "http://localhost:8080/api/alerts" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <API_TOKEN>" \
  -d '{
    "source": "siem-prod",
    "type": "suspicious_connection",
    "timestamp": "2026-04-10T12:00:00Z",
    "observables": [
      {"type": "ip", "value": "198.51.100.23"},
      {"type": "url", "value": "http://malicious.example/"}
    ],
    "metadata": {
      "severity": "high",
      "raw": "original SIEM message..."
    }
  }'

Python example (requests):

import requests
url = "https://mcp.example.local/api/alerts"
headers = {"Authorization": "Bearer YOUR_TOKEN"}
payload = {"source":"siem","type":"malicious","timestamp":"2026-04-10T12:00:00Z"}
r = requests.post(url, json=payload, headers=headers)
print(r.status_code, r.json())

Always consult the server’s OpenAPI spec (if provided) for exact paths and schemas.

Use Cases

• Centralizing SIEM and EDR alerts: Route alerts from multiple SIEM instances into the MCP server for normalization and deduplication before creating cases in TheHive.

  • SIEM sends raw alerts to MCP → MCP normalizes observables and metadata → automation reads MCP and opens TheHive case.

• Enrichment pipeline: Use MCP as a staging area for enrichment jobs (threat intel, WHOIS, passive DNS).

  • Ingest alert into MCP → enrichment workers pull alert, add enrichment data → updated alert is forwarded to TheHive.

• Attachment management: Some alert producers include logs, PCAPs, or screenshots. MCP stores attachments alongside the alert and