TheHive FastMCP

Enable AI agents to manage TheHive cases, alerts, observables, and tasks.

Source

third_party_registry

Updated

2026-07-12

// securityCaution

Runs locally
Open source

Running security audit…

Credentials
Network egress
Code execution
Data access
Supply chain

// install

Copy the install command and let the AI configure it · recommended for beginners

No copy-paste install info for "TheHive FastMCP" yet — see the docs or source repo.

// examples

Create and assign a security case

Prompt

Create a new case in TheHive from this phishing email alert. Title it "Suspected Phishing Email Investigation," set severity to high, assign it to analyst1, and add initial tasks: analyze headers, extract IOCs, and contact the affected user.

Expected

Returns the new case details, including case ID, assignee, and a summary of added tasks.

Add IOCs to a case

Prompt

Add the following observables to TheHive case CASE-142 and classify them by type: malicious domain example-bad.com, IP 185.23.44.9, and hash d41d8cd98f00b204e9800998ecf8427e. Then provide a summary.

Expected

Returns the list of added observables, their types, and confirmation that they were linked to the case.

Update an alert and close tasks

Prompt

Find high-priority TheHive alerts from the EDR source with status New. Select the alert related to host HOST-77, update it to InProgress, and if the related case task "Isolate host" is completed, mark that task as closed and report the results.

Expected

Returns the matched alert, status update result, task closure status, and a final action summary.