MCP server for interacting with Panther SIEM via natural language to manage detections, alerts, and query logs.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Not yet automatically verified
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Overview
Use cases
Write and tune detection rules from an IDE
Query security logs using natural language
Triage and resolve security alerts interactively
Add comments and update alert statuses in bulk
Retrieve schema and metadata for data lake tables
Key features
Natural language querying of Panther data lake logs
Alert management including triage, commenting, and bulk updates
Detection rule listing, details retrieval, and disabling
Access to scheduled queries and log source configurations
Global helper function retrieval with filtering
Capabilities & Tool Schemas (36)
Inspect callable tools, capabilities, and parameters exposed to AI agents by MCP Panther.
add_alert_commentAdd a comment to a Panther alert
start_ai_alert_triageStart an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations
get_ai_alert_triage_summaryRetrieve the latest AI triage summary previously generated for a specific alert
get_alertGet detailed information about a specific alert
get_alert_eventsGet a small sampling of events for a given alert
list_alertsList alerts with comprehensive filtering options (date range, severity, status, etc.)
Documentation Overview
Panther MCP Server
Panther's Model Context Protocol (MCP) server provides functionality to:
- Write and tune detections from your IDE
- Interactively query security logs using natural language
- Triage, comment, and resolve one or many alerts
Available Tools
Alerts
| Tool Name | Description | Sample Prompt |
|---|---|---|
add_alert_comment | Add a comment to a Panther alert | "Add comment 'Looks pretty bad' to alert abc123" |
start_ai_alert_triage | Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations | "Start AI triage for alert abc123" / "Generate a detailed AI analysis of alert def456" |
get_ai_alert_triage_summary | Retrieve the latest AI triage summary previously generated for a specific alert | "Get the AI triage summary for alert abc123" / "Show me the AI analysis for alert def456" |
get_alert | Get detailed information about a specific alert | "What's the status of alert 8def456?" |
get_alert_events | Get a small sampling of events for a given alert | "Show me events associated with alert 8def456" |
list_alerts | List alerts with comprehensive filtering options (date range, severity, status, etc.) | "Show me all high severity alerts from the last 24 hours" |
bulk_update_alerts | Bulk update multiple alerts with status, assignee, and/or comment changes | "Update alerts abc123, def456, and ghi789 to resolved status and add comment 'Fixed'" |
update_alert_assignee | Update the assignee of one or more alerts | "Assign alerts abc123 and def456 to John" |
update_alert_status | Update the status of one or more alerts | "Mark alerts abc123 and def456 as resolved" |
list_alert_comments | List all comments for a specific alert | "Show me all comments for alert abc123" |
Data Lake
| Tool Name | Description | Sample Prompt |
|---|---|---|
query_data_lake | Execute SQL queries against Panther's data lake with synchronous results | "Query AWS CloudTrail logs for failed login attempts in the last day" |
get_table_schema | Get schema information for a specific table | "Show me the schema for the AWS_CLOUDTRAIL table" |
list_databases | List all available data lake databases in Panther | "List all available databases" |
list_database_tables | List all available tables for a specific database in Panther's data lake | "What tables are in the panther_logs database" |
get_alert_event_stats | Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics | "Show me patterns in events from alerts abc123 and def456" |
Scheduled Queries
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_scheduled_queries | List all scheduled queries with pagination support | "Show me all scheduled queries" / "List the first 25 scheduled queries" |
get_scheduled_query | Get detailed information about a specific scheduled query by ID | "Get details for scheduled query 'weekly-security-report'" |
Sources
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_log_sources | List log sources with optional filters (health status, log types, integration type) | "Show me all healthy S3 log sources" |
get_http_log_source | Get detailed information about a specific HTTP log source by ID | "Show me the configuration for HTTP source 'webhook-collector-123'" |
Detections
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_detections | List detections from Panther with comprehensive filtering support. Supports multiple detection types and filtering by name, state, severity, tags, log types, resource types, output IDs (destinations), and more. Returns outputIDs for each detection showing configured alert destinations | "Show me all enabled HIGH severity rules with tag 'AWS'" / "List disabled policies for S3 resources" / "Find all rules with outputID 'prod-slack'" / "Show me detections that alert to production destinations" |
get_detection | Get detailed information about a specific detection including the detection body and tests. Accepts a list with one detection type: ["rules"], ["scheduled_rules"], ["simple_rules"], or ["policies"] | "Get details for rule ID abc123" / "Get details for policy ID AWS.S3.Bucket.PublicReadACP" |
disable_detection | Disable a detection by setting enabled to false. Supports rules, scheduled_rules, simple_rules, and policies | "Disable rule abc123" / "Disable policy AWS.S3.Bucket.PublicReadACP" |
Global Helpers
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_global_helpers | List global helper functions with comprehensive filtering options (name search, creator, modifier) | "Show me global helpers containing 'aws' in the name" |
get_global_helper | Get detailed information and complete Python code for a specific global helper | "Get the complete code for global helper 'AWSUtilities'" |
Data Models
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_data_models | List data models that control UDM mappings in rules | "Show me all data models for log parsing" |
get_data_model | Get detailed information about a specific data model | "Get the complete details for the 'AWS_CloudTrail' data model" |
Schemas
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_log_type_schemas | List available log type schemas with optional filters | "Show me all AWS-related schemas" |
get_log_type_schema_details | Get detailed information for specific log type schemas | "Get full details for AWS.CloudTrail schema" |
Metrics
| Tool Name | Description | Sample Prompt |
|---|---|---|
get_rule_alert_metrics | Get metrics about alerts grouped by rule | "Show top 10 rules by alert count" |
get_severity_alert_metrics | Get metrics about alerts grouped by severity | "Show alert counts by severity for the last week" |
get_bytes_processed_metrics | Get data ingestion metrics by log type and source | "Show me data ingestion volume by log type" |
Users & Access Management
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_users | List all Panther user accounts with pagination support | "Show me all active Panther users" / "List the first 25 users" |
get_user | Get detailed information about a specific user | "Get details for user ID 'john.doe@company.com'" |
get_permissions | Get the current user's permissions | "What permissions do I have?" |
list_roles | List all roles with filtering options (name search, role IDs, sort direction) | "Show me all roles containing 'Admin' in the name" |
get_role | Get detailed information about a specific role including permissions | "Get complete details for the 'Admin' role" |
Panther Configuration
Follow these steps to configure your API credentials and environment.
-
Create an API token in Panther:
-
Navigate to Settings (gear icon) → API Tokens
-
Create a new token with the following permissions (recommended read-only approach to start):
-
View Required Permissions
-
-
Store the generated token securely (e.g., 1Password)
-
Copy the Panther instance URL from your browser (e.g.,
https://YOUR-PANTHER-INSTANCE.domain)- Note: This must include
https://
- Note: This must include
MCP Server Installation
Choose one of the following installation methods:
Docker (Recommended)
The easiest way to get started is using our pre-built Docker image:
Version Pinning: For production stability, pin to a specific version tag:
Available tags can be found on the GitHub Container Registry.
UVX
For Python users, you can run directly from PyPI using uvx:
-
Configure your MCP client:
Related MCP Servers
Adoption & maintenance
Factual signals from GitHub, npm, and our automated checks — not a rating.
GitHub stars
47
Stargazers on the source repository.
Last commit
Today
Most recent push to the default branch.
Tools exposed
36
Callable tools this server registers over MCP.
Directory activity
1 views
Config copies, upvotes, and views on AllMCPs.
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about MCP Panther
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/panther-labs-mcp-panther)HTML Embed
<a href="https://allmcps.com/mcp/panther-labs-mcp-panther"><img src="https://allmcps.com/api/badge/panther-labs-mcp-panther?style=directory" alt="MCP Panther on AllMCPs" /></a>Technical Specs & Signals
CategorySecurity
10/11 checks healthy over the last 32d
57Quality signal: Good · 57/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools26/30
Adoption & activity7/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Supply-chain signal
No high-severity advisories surfaced by our automated scan.
Critical 0High 0Medium 0Low 0
Scanned 14d ago via OSV.dev · mcp-panther (PyPI)
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.