How do I install the mcp panther mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `PANTHER_INSTANCE_URL`, `PANTHER_API_TOKEN` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

MCP Panther MCP Server

Panther's Model Context Protocol (MCP) server provides functionality to:

Local serverstdioPython

What is the MCP Panther MCP Server?

Panther's Model Context Protocol (MCP) server provides functionality to:

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
add_alert_comment	Add a comment to a Panther alert
start_ai_alert_triage	Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations
get_ai_alert_triage_summary	Retrieve the latest AI triage summary previously generated for a specific alert
get_alert	Get detailed information about a specific alert
get_alert_events	Get a small sampling of events for a given alert
list_alerts	List alerts with comprehensive filtering options (date range, severity, status, etc.)
bulk_update_alerts	Bulk update multiple alerts with status, assignee, and/or comment changes
update_alert_assignee	Update the assignee of one or more alerts
update_alert_status	Update the status of one or more alerts
list_alert_comments	List all comments for a specific alert
query_data_lake	Execute SQL queries against Panther's data lake with synchronous results
get_table_schema	Get schema information for a specific table
list_databases	List all available data lake databases in Panther
list_database_tables	List all available tables for a specific database in Panther's data lake
get_alert_event_stats	Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics
list_scheduled_queries	List all scheduled queries with pagination support
get_scheduled_query	Get detailed information about a specific scheduled query by ID
list_log_sources	List log sources with optional filters (health status, log types, integration type)
get_http_log_source	Get detailed information about a specific HTTP log source by ID
list_detections	List detections from Panther with comprehensive filtering support. Supports multiple detection types and filtering by name, state, severity, tags, log types, re
get_detection	Get detailed information about a specific detection including the detection body and tests. Accepts a list with one detection type: ["rules"], ["scheduled_rules
disable_detection	Disable a detection by setting enabled to false. Supports rules, scheduled_rules, simple_rules, and policies
list_global_helpers	List global helper functions with comprehensive filtering options (name search, creator, modifier)
get_global_helper	Get detailed information and complete Python code for a specific global helper
list_data_models	List data models that control UDM mappings in rules
get_data_model	Get detailed information about a specific data model
list_log_type_schemas	List available log type schemas with optional filters
get_log_type_schema_details	Get detailed information for specific log type schemas
get_rule_alert_metrics	Get metrics about alerts grouped by rule
get_severity_alert_metrics	Get metrics about alerts grouped by severity
get_bytes_processed_metrics	Get data ingestion metrics by log type and source
list_users	List all Panther user accounts with pagination support
get_user	Get detailed information about a specific user
get_permissions	Get the current user's permissions
list_roles	List all roles with filtering options (name search, role IDs, sort direction)
get_role	Get detailed information about a specific role including permissions

How to install the MCP Panther MCP Server

{
  "mcpServers": {
    "mcp-panther": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "-e",
        "PANTHER_INSTANCE_URL",
        "-e",
        "PANTHER_API_TOKEN",
        "--rm",
        "ghcr.io/panther-labs/mcp-panther"
      ],
      "env": {
        "PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
        "PANTHER_API_TOKEN": "YOUR_PANTHER_API_TOKEN"
      }
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

Variable	Description	Required
PANTHER_INSTANCE_URL	Declared in the maintainer’s client configuration.	Check documentation
PANTHER_API_TOKEN	Declared in the maintainer’s client configuration.	Check documentation

Example prompts to try

“Use MCP Panther to add alert comment.”
“Use MCP Panther to start ai alert triage.”
“Use MCP Panther to get ai alert triage summary.”

Frequently asked questions

Panther's Model Context Protocol (MCP) server provides functionality to: Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.