# MCP Panther (MCP server) > MCP Panther is an MCP server that adds cloud and DevOps tools to AI assistants such as Claude Desktop, Claude Code and Cursor. Write detections, investigate alerts, and query logs from your favorite AI agents. It has 47 GitHub stars, is released under the Apache-2.0 license and runs locally with uvx mcp-panther. Panther's Model Context Protocol (MCP) server provides functionality to: Follow these steps to configure your API credentials and environment. ## Key facts | Fact | Value | |---|---| | Repository | https://github.com/panther-labs/mcp-panther | | GitHub stars | 47 | | License | Apache-2.0 | | Language | Python | | Transport | stdio | | Packages | pypi: mcp-panther; docker: ghcr.io/panther-labs/mcp-panther | | Remote URL | none | | Needs API key | yes | | Official | yes | | Works with | Claude Desktop, Claude Code, Cursor, VS Code | | Category | Cloud & DevOps | | Latest release | v2.4.0 (Oct 6, 2026) | | Last commit | Oct 9, 2026 | ## Install ### Claude Desktop (claude_desktop_config.json) ```json { "mcpServers": { "mcp-panther": { "command": "uvx", "args": [ "mcp-panther" ], "env": { "PANTHER_API_TOKEN": "your-value" } } } } ``` Settings > Developer > Edit Config. macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\. Restart Claude Desktop afterwards. ### Claude Code ```sh claude mcp add --env PANTHER_API_TOKEN=your-value --transport stdio mcp-panther -- uvx mcp-panther ``` ### Cursor (.cursor/mcp.json) ```json { "mcpServers": { "mcp-panther": { "type": "stdio", "command": "uvx", "args": [ "mcp-panther" ], "env": { "PANTHER_API_TOKEN": "your-value" } } } } ``` Project file; use ~/.cursor/mcp.json to enable it in every project. ### VS Code (.vscode/mcp.json) ```json { "inputs": [ { "type": "promptString", "id": "panther_api_token", "description": "PANTHER_API_TOKEN", "password": true } ], "servers": { "mcp-panther": { "type": "stdio", "command": "uvx", "args": [ "mcp-panther" ], "env": { "PANTHER_API_TOKEN": "${input:panther_api_token}" } } } } ``` Config formats checked against the official docs on 2026-10-07. ## Environment variables - `PANTHER_INSTANCE_URL`: Shown in the README's example configuration. - `PANTHER_API_TOKEN` (secret): Shown in the README's example configuration. ## Tools - `add_alert_comment`: Add a comment to a Panther alert - `start_ai_alert_triage`: Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations - `get_ai_alert_triage_summary`: Retrieve the latest AI triage summary previously generated for a specific alert - `get_alert`: Get detailed information about a specific alert - `get_alert_events`: Get a small sampling of events for a given alert - `list_alerts`: List alerts with comprehensive filtering options (date range, severity, status, etc.) - `bulk_update_alerts`: Bulk update multiple alerts with status, assignee, and/or comment changes - `update_alert_assignee`: Update the assignee of one or more alerts - `update_alert_status`: Update the status of one or more alerts - `list_alert_comments`: List all comments for a specific alert - `query_data_lake`: Execute SQL queries against Panther's data lake with synchronous results - `get_table_schema`: Get schema information for a specific table - `list_databases`: List all available data lake databases in Panther - `list_database_tables`: List all available tables for a specific database in Panther's data lake - `get_alert_event_stats`: Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics - `list_scheduled_queries`: List all scheduled queries with pagination support - `get_scheduled_query`: Get detailed information about a specific scheduled query by ID - `list_log_sources`: List log sources with optional filters (health status, log types, integration type) - `get_http_log_source`: Get detailed information about a specific HTTP log source by ID - `list_detections`: List detections from Panther with comprehensive filtering support. - `get_detection`: Get detailed information about a specific detection including the detection body and tests. - `disable_detection`: Disable a detection by setting enabled to false. Supports rules, scheduledrules, simplerules, and policies - `list_global_helpers`: List global helper functions with comprehensive filtering options (name search, creator, modifier) - `get_global_helper`: Get detailed information and complete Python code for a specific global helper - `list_data_models`: List data models that control UDM mappings in rules - `get_data_model`: Get detailed information about a specific data model - `list_log_type_schemas`: List available log type schemas with optional filters - `get_log_type_schema_details`: Get detailed information for specific log type schemas - `get_rule_alert_metrics`: Get metrics about alerts grouped by rule - `get_severity_alert_metrics`: Get metrics about alerts grouped by severity - `get_bytes_processed_metrics`: Get data ingestion metrics by log type and source - `list_users`: List all Panther user accounts with pagination support - `get_user`: Get detailed information about a specific user - `get_permissions`: Get the current user's permissions - `list_roles`: List all roles with filtering options (name search, role IDs, sort direction) - `get_role`: Get detailed information about a specific role including permissions ## Similar MCP servers - [Uptimepage](https://appsgit.com/mcp-servers/uptimepage): Monitor uptime and incidents, run checks, and publish status updates from your Uptimepage org. (49 stars, AGPL-3.0, official) - [Bitrise](https://appsgit.com/mcp-servers/bitrise): Set up & manage mobile CI/CD on Bitrise: build, test, distribute iOS, Android, Flutter, RN apps. (43 stars, MIT, official, needs API key) - [Neuronto ARD Registry: Agentic Resource Discovery (ARD) Inde](https://appsgit.com/mcp-servers/neuronto-ard-registry-agentic-resource-discovery-ard-inde): Neuronto ARD Registry: one search across every public ARD registry + 200,000+ verified MCP tools. (56 stars, Apache-2.0, official) - [Containerization Assist](https://appsgit.com/mcp-servers/containerization-assist): TypeScript MCP server for AI-powered containerization workflows with Docker and Kubernetes support. (43 stars, MIT, official) - [Last9 MCP Server](https://appsgit.com/mcp-servers/last9-mcp-server): Your AI agent doesn't know what's broken in production. (63 stars, Apache-2.0, official, needs API key) - [Greptimedb MCP Server](https://appsgit.com/mcp-servers/greptimedb-mcp-server): Query GreptimeDB metrics, logs and traces with SQL, TQL and RANGE. (29 stars, MIT, official, needs API key) --- Canonical page: https://appsgit.com/mcp-servers/mcp-panther Source: appsgit (https://appsgit.com), the app store for github. Data from the GitHub API, refreshed daily. Machine access: JSON API https://appsgit.com/api/v1/apps (OpenAPI: https://appsgit.com/openapi.json), MCP server https://mcp.appsgit.com/mcp, full index https://appsgit.com/llms-full.txt.