Panther's Model Context Protocol (MCP) server provides functionality to:
Connect MCP Panther to Claude, Cursor or any other MCP client and it stops being a tab you switch to. Panther's Model Context Protocol (MCP) server provides functionality to:. The mcp panther mcp server is what makes that connection.
The server ships on PyPI as For, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.
The toolset is worth reading before you wire it up, because it tells you what the integration is really for:
add_alert_comment — Add a comment to a Panther alertstart_ai_alert_triage — Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendationsget_ai_alert_triage_summary — Retrieve the latest AI triage summary previously generated for a specific alertget_alert — Get detailed information about a specific alertget_alert_events — Get a small sampling of events for a given alertlist_alerts — List alerts with comprehensive filtering options (date range, severity, status, etc.)bulk_update_alerts — Bulk update multiple alerts with status, assignee, and/or comment changesupdate_alert_assignee — Update the assignee of one or more alertsupdate_alert_status — Update the status of one or more alertslist_alert_comments — List all comments for a specific alertquery_data_lake — Execute SQL queries against Panther's data lake with synchronous resultsget_table_schema — Get schema information for a specific tableConfiguration is passed through the environment: PANTHER_INSTANCE_URL, PANTHER_API_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of database access servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. MCP Panther's toolset — add_alert_comment, start_ai_alert_triage, get_ai_alert_triage_summary and 11 more — is a fair guide to whether it matches your workflow. It is maintained by panther-labs; worth a glance at recent repository activity before you build anything load-bearing on it.
We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.
| Tool | What it does |
|---|---|
| add_alert_comment | Add a comment to a Panther alert |
| start_ai_alert_triage | Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations |
| get_ai_alert_triage_summary | Retrieve the latest AI triage summary previously generated for a specific alert |
| get_alert | Get detailed information about a specific alert |
| get_alert_events | Get a small sampling of events for a given alert |
| list_alerts | List alerts with comprehensive filtering options (date range, severity, status, etc.) |
| bulk_update_alerts | Bulk update multiple alerts with status, assignee, and/or comment changes |
| update_alert_assignee | Update the assignee of one or more alerts |
| update_alert_status | Update the status of one or more alerts |
| list_alert_comments | List all comments for a specific alert |
| query_data_lake | Execute SQL queries against Panther's data lake with synchronous results |
| get_table_schema | Get schema information for a specific table |
| list_databases | List all available data lake databases in Panther |
| list_database_tables | List all available tables for a specific database in Panther's data lake |
{
"mcpServers": {
"mcp-panther": {
"command": "docker",
"args": [
"run",
"-i",
"-e", "PANTHER_INSTANCE_URL",
"-e", "PANTHER_API_TOKEN",
"--rm",
"ghcr.io/panther-labs/mcp-panther"
],
"env": {
"PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
"PANTHER_API_TOKEN": "YOUR-API-KEY"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| PANTHER_INSTANCE_URL | Endpoint or connection string the server talks to. | Yes |
| PANTHER_API_TOKEN | Credential the server authenticates with. | Yes |
Read-only SQL access to Postgres — let your assistant inspect schemas and answer questions from real data.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.
Serverless Postgres with database branching — point your assistant at Neon and let it work on disposable copies.