by panther-labs
Integrate with Panther Labs to streamline cybersecurity workflows, manage detection rules, triage alerts, and boost inci
Connects to Panther Labs' cybersecurity platform for managing security alerts, writing detection rules, and querying security logs. Enables AI-powered alert triage and incident response workflows.
Panther Labs is an official MCP server published by panther-labs that provides AI assistants with tools and capabilities via the Model Context Protocol. Integrate with Panther Labs to streamline cybersecurity workflows, manage detection rules, triage alerts, and boost inci It is categorized under auth security, analytics data.
You can install Panther Labs in your AI client of choice. Use the install panel on this page to get one-click setup for Cursor, Claude Desktop, VS Code, and other MCP-compatible clients. This server runs locally on your machine via the stdio transport.
Apache-2.0
Panther Labs is released under the Apache-2.0 license. This is a permissive open-source license, meaning you can freely use, modify, and distribute the software.
Add new capabilities to Claude beyond text generation
Example
Access external data sources, execute code, interact with tools and services
Transform Claude from chatbot to action-taking agent
Provide Claude with access to relevant context and data
Example
Load project documentation, access knowledge bases, query databases
Get more accurate, context-aware responses
Automate multi-step workflows combining AI and external tools
Example
Research → Summarize → Create document → Send notification
Complete complex tasks end-to-end without manual steps
Share your MCP server with the developer community
Panther Labs has been reliable for tool-calling workflows; the MCP profile page is a good permalink for internal docs.
Strong directory entry: Panther Labs surfaces stars and publisher context so we could sanity-check maintenance before adopting.
According to our notes, Panther Labs benefits from clear Model Context Protocol framing — fewer ambiguous “AI plugin” claims.
I recommend Panther Labs for teams standardizing on MCP; the explainx.ai page compares cleanly with sibling servers.
According to our notes, Panther Labs benefits from clear Model Context Protocol framing — fewer ambiguous “AI plugin” claims.
I recommend Panther Labs for teams standardizing on MCP; the explainx.ai page compares cleanly with sibling servers.
Panther Labs has been reliable for tool-calling workflows; the MCP profile page is a good permalink for internal docs.
Strong directory entry: Panther Labs surfaces stars and publisher context so we could sanity-check maintenance before adopting.
Panther Labs is among the better-indexed MCP projects we tried; the explainx.ai summary tracks the official description.
We evaluated Panther Labs against two servers with overlapping tools; this profile had the clearer scope statement.
showing 1-10 of 75
Panther's Model Context Protocol (MCP) server provides functionality to:
| Tool Name | Description | Sample Prompt |
|---|---|---|
add_alert_comment | Add a comment to a Panther alert | "Add comment 'Looks pretty bad' to alert abc123" |
start_ai_alert_triage | Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations | "Start AI triage for alert abc123" / "Generate a detailed AI analysis of alert def456" |
get_ai_alert_triage_summary | Retrieve the latest AI triage summary previously generated for a specific alert | "Get the AI triage summary for alert abc123" / "Show me the AI analysis for alert def456" |
get_alert | Get detailed information about a specific alert | "What's the status of alert 8def456?" |
get_alert_events | Get a small sampling of events for a given alert | "Show me events associated with alert 8def456" |
list_alerts | List alerts with comprehensive filtering options (date range, severity, status, etc.) | "Show me all high severity alerts from the last 24 hours" |
bulk_update_alerts | Bulk update multiple alerts with status, assignee, and/or comment changes | "Update alerts abc123, def456, and ghi789 to resolved status and add comment 'Fixed'" |
update_alert_assignee | Update the assignee of one or more alerts | "Assign alerts abc123 and def456 to John" |
update_alert_status | Update the status of one or more alerts | "Mark alerts abc123 and def456 as resolved" |
list_alert_comments | List all comments for a specific alert | "Show me all comments for alert abc123" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
query_data_lake | Execute SQL queries against Panther's data lake with synchronous results | "Query AWS CloudTrail logs for failed login attempts in the last day" |
get_table_schema | Get schema information for a specific table | "Show me the schema for the AWS_CLOUDTRAIL table" |
list_databases | List all available data lake databases in Panther | "List all available databases" |
list_database_tables | List all available tables for a specific database in Panther's data lake | "What tables are in the panther_logs database" |
get_alert_event_stats | Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics | "Show me patterns in events from alerts abc123 and def456" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_scheduled_queries | List all scheduled queries with pagination support | "Show me all scheduled queries" / "List the first 25 scheduled queries" |
get_scheduled_query | Get detailed information about a specific scheduled query by ID | "Get details for scheduled query 'weekly-security-report'" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_log_sources | List log sources with optional filters (health status, log types, integration type) | "Show me all healthy S3 log sources" |
get_http_log_source | Get detailed information about a specific HTTP log source by ID | "Show me the configuration for HTTP source 'webhook-collector-123'" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_detections | List detections from Panther with comprehensive filtering support. Supports multiple detection types and filtering by name, state, severity, tags, log types, resource types, output IDs (destinations), and more. Returns outputIDs for each detection showing configured alert destinations | "Show me all enabled HIGH severity rules with tag 'AWS'" / "List disabled policies for S3 resources" / "Find all rules with outputID 'prod-slack'" / "Show me detections that alert to production destinations" |
get_detection | Get detailed information about a specific detection including the detection body and tests. Accepts a list with one detection type: ["rules"], ["scheduled_rules"], ["simple_rules"], or ["policies"] | "Get details for rule ID abc123" / "Get details for policy ID AWS.S3.Bucket.PublicReadACP" |
disable_detection | Disable a detection by setting enabled to false. Supports rules, scheduled_rules, simple_rules, and policies | "Disable rule abc123" / "Disable policy AWS.S3.Bucket.PublicReadACP" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_global_helpers | List global helper functions with comprehensive filtering options (name search, creator, modifier) | "Show me global helpers containing 'aws' in the name" |
get_global_helper | Get detailed information and complete Python code for a specific global helper | "Get the complete code for global helper 'AWSUtilities'" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_data_models | List data models that control UDM mappings in rules | "Show me all data models for log parsing" |
get_data_model | Get detailed information about a specific data model | "Get the complete details for the 'AWS_CloudTrail' data model" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_log_type_schemas | List available log type schemas with optional filters | "Show me all AWS-related schemas" |
get_log_type_schema_details | Get detailed information for specific log type schemas | "Get full details for AWS.CloudTrail schema" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
get_rule_alert_metrics | Get metrics about alerts grouped by rule | "Show top 10 rules by alert count" |
get_severity_alert_metrics | Get metrics about alerts grouped by severity | "Show alert counts by severity for the last week" |
get_bytes_processed_metrics | Get data ingestion metrics by log type and source | "Show me data ingestion volume by log type" |
| Tool Name | Description | Sample Prompt |
|---|---|---|
list_users | List all Panther user accounts with pagination support | "Show me all active Panther users" / "List the first 25 users" |
get_user | Get detailed information about a specific user | "Get details for user ID '[email protected]'" |
get_permissions | Get the current user's permissions | "What permissions do I have?" |
list_roles | List all roles with filtering options (name search, role IDs, sort direction) | "Show me all roles containing 'Admin' in the name" |
get_role | Get detailed information about a specific role including permissions | "Get complete details for the 'Admin' role" |
Follow these steps to configure your API credentials and environment.
Create an API token in Panther:
Navigate to Settings (gear icon) → API Tokens
Create a new token with the following permissions (recommended read-only approach to start):
Store the generated token securely (e.g., 1Password)
Copy the Panther instance URL from your browser (e.g., https://YOUR-PANTHER-INSTANCE.domain)
https://Choose one of the following installation methods:
The easiest way to get started is using our pre-built Docker image:
{
"mcpServers": {
"mcp-panther": {
"command": "docker",
"args": [
"run",
"-i",
"-e", "PANTHER_INSTANCE_URL",
"-e", "PANTHER_API_TOKEN",
"--rm",
"ghcr.io/panther-labs/mcp-panther"
],
"env": {
"PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
"PANTHER_API_TOKEN": "YOUR-API-KEY"
}
}
}
}
Version Pinning: For production stability, pin to a specific version tag:
"ghcr.io/panther-labs/mcp-panther:v2.2.0"
Available tags can be found on the GitHub Container Registry.
For Python users, you can run directly from PyPI using uvx:
Configure your MCP client:
{
"mcpServers": {
"mcp-panther": {
"command": "uvx",
"args": ["mcp-panther"],
"env": {
"PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
"PANTHER_API_TOK
---
Prerequisites
Time Estimate
15-60 minutes depending on server complexity
Steps
Troubleshooting
✓ Do
✗ Don't
💡 Pro Tips
Architecture
Model Context Protocol standardizes how AI hosts (Claude, Cursor) communicate with external tools and data sources through server implementations.
Protocols
Compatibility
✓ Use when
Use when you need Claude to access external data, execute actions, or integrate with tools. Best for extending AI capabilities beyond conversation.
✗ Avoid when
Avoid when native integrations exist (use official APIs directly), for real-time critical systems, or when security/compliance requires zero external dependencies.