Panther MCP Server

Created By
panther-labsa year ago
MCP Server for Panther
Overview

What is Panther MCP Server?

Panther MCP Server is a Model Context Protocol server designed for cybersecurity operations, enabling users to write detections, query security logs using natural language, and manage alerts effectively.

How to use Panther MCP Server?

To use Panther MCP Server, set up the server using Docker or UVX, create an API token, and configure your client to connect to the server. You can then interact with the server through various tools to manage alerts and data.

Key features of Panther MCP Server?

  • Write and tune detections directly from your IDE.
  • Query security logs interactively using natural language.
  • Manage alerts by triaging, commenting, and resolving them.
  • Execute SQL queries against Panther's data lake.
  • Create and manage detection rules.

Use cases of Panther MCP Server?

  1. Triage and manage security alerts in real-time.
  2. Analyze security logs for suspicious activities.
  3. Automate detection rule creation based on patterns in alerts.
  4. Facilitate collaboration among security teams through comments and alerts management.

FAQ from Panther MCP Server?

  • What is the purpose of the MCP Server?

The MCP Server is designed to enhance cybersecurity operations by providing tools for alert management and data analysis.

  • Is there a recommended installation method?

Yes, using Docker is the recommended method for setting up the MCP Server.

  • Can I customize detection rules?

Yes, users can create and update detection rules based on their specific needs.

Project Info
Created At
a year ago
Updated At
a year ago
Author Name
panther-labs
Star
14
Language
Python
License
Apache-2.0 license
Category
security

Recommend Servers

View All
Bring your real authenticated browser session to AI coding agents. Local-first MCP server + Chrome MV3 extension. No cloud. No telemetry.
@Cubenest

peek records the user's actual logged-in browser (DOM via rrweb, console events, network metadata, optional response bodies via opt-in Deep capture) through a Chrome MV3 extension. The extension ships events through a native-messaging stdio bridge to a local MCP server (peek-mcp), which persists them to a SQLite database at ~/.peek/sessions.db. AI coding agents (Claude Code, Cursor, Cline, Windsurf) read sessions from the database via 10 MCP tools: Tool What it does list_recent_sessions List recently recorded sessions (id, origin, ts, event count). get_session_summary LLM-readable narrative summary of a session. get_session_console_errors Console errors recorded in a session. get_session_network_errors Failed/notable network requests in a session. get_user_action_before_error Last N user actions before a console error. generate_playwright_repro Generate a runnable Playwright test from a session. get_dom_snapshot Reconstruct the DOM at a given timestamp. query_dom_history Timeline of attribute/text changes for a selector. request_authorization Side-panel consent for write actions (Level 3). execute_action Dispatch a UI action (gated by permission level + destructive blocklist). Why local-first matters Every other "browser session for AI" tool ships to a vendor cloud. peek's SQLite + extension live on the user's machine — no remote endpoints, no telemetry. The privacy policy (docs/peek/PRIVACY_POLICY.md) is the source of truth. Install # 1. Add the MCP server to Claude Code claude mcp add peek -- npx -y @peekdev/mcp # 2. Install the Chrome extension from the Chrome Web Store # (link added once the CWS listing is approved)

a day ago