MCP Panther

{
  "mcpServers": {
    "mcp-panther": {
      "command": "uvx",
      "args": [
        "mcp-panther"
      ],
      "env": {
        "PANTHER_API_TOKEN": "your-value"
      }
    }
  }
}

claude mcp add --env PANTHER_API_TOKEN=your-value --transport stdio mcp-panther -- uvx mcp-panther

{
  "mcpServers": {
    "mcp-panther": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-panther"
      ],
      "env": {
        "PANTHER_API_TOKEN": "your-value"
      }
    }
  }
}

{
  "inputs": [
    {
      "type": "promptString",
      "id": "panther_api_token",
      "description": "PANTHER_API_TOKEN",
      "password": true
    }
  ],
  "servers": {
    "mcp-panther": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-panther"
      ],
      "env": {
        "PANTHER_API_TOKEN": "${input:panther_api_token}"
      }
    }
  }
}

Config formats checked against the official docs on Oct 7, 2026: modelcontextprotocol.io (opens in a new tab), code.claude.com (opens in a new tab), cursor.com (opens in a new tab), code.visualstudio.com (opens in a new tab).

• add_alert_comment

  Add a comment to a Panther alert

• start_ai_alert_triage

  Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations

• get_ai_alert_triage_summary

  Retrieve the latest AI triage summary previously generated for a specific alert

• get_alert

  Get detailed information about a specific alert

• get_alert_events

  Get a small sampling of events for a given alert

• list_alerts

  List alerts with comprehensive filtering options (date range, severity, status, etc.)

• bulk_update_alerts

  Bulk update multiple alerts with status, assignee, and/or comment changes

• update_alert_assignee

  Update the assignee of one or more alerts

• update_alert_status

  Update the status of one or more alerts

• list_alert_comments

  List all comments for a specific alert

• query_data_lake

  Execute SQL queries against Panther's data lake with synchronous results

• get_table_schema

  Get schema information for a specific table

• list_databases

  List all available data lake databases in Panther

• list_database_tables

  List all available tables for a specific database in Panther's data lake

• get_alert_event_stats

  Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics

• list_scheduled_queries

  List all scheduled queries with pagination support

• get_scheduled_query

  Get detailed information about a specific scheduled query by ID

• list_log_sources

  List log sources with optional filters (health status, log types, integration type)

• get_http_log_source

  Get detailed information about a specific HTTP log source by ID

• list_detections

  List detections from Panther with comprehensive filtering support.

• get_detection

  Get detailed information about a specific detection including the detection body and tests.

• disable_detection

  Disable a detection by setting enabled to false. Supports rules, scheduledrules, simplerules, and policies

• list_global_helpers

  List global helper functions with comprehensive filtering options (name search, creator, modifier)

• get_global_helper

  Get detailed information and complete Python code for a specific global helper

• list_data_models

  List data models that control UDM mappings in rules

• get_data_model

  Get detailed information about a specific data model

• list_log_type_schemas

  List available log type schemas with optional filters

• get_log_type_schema_details

  Get detailed information for specific log type schemas

• get_rule_alert_metrics

  Get metrics about alerts grouped by rule

• get_severity_alert_metrics

  Get metrics about alerts grouped by severity

• get_bytes_processed_metrics

  Get data ingestion metrics by log type and source

• list_users

  List all Panther user accounts with pagination support

• get_user

  Get detailed information about a specific user

• get_permissions

  Get the current user's permissions

• list_roles

  List all roles with filtering options (name search, role IDs, sort direction)

• get_role

  Get detailed information about a specific role including permissions

Panther's Model Context Protocol (MCP) server provides functionality to: Follow these steps to configure your API credentials and environment.

• cybersecurity
• mcp-server
• security-operations
• ai