Panther MCP Server

Panther's Model Context Protocol (MCP) server provides functionality to:

1. Write and tune detections from your IDE
2. Interactively query security logs using natural language
3. Triage, comment, and resolve one or many alerts

<a href="https://glama.ai/mcp/servers/@panther-labs/mcp-panther"> <img width="380" height="200" src="https://glama.ai/mcp/servers/@panther-labs/mcp-panther/badge" alt="Panther Server MCP server" /> </a>

Available Tools

<details> <summary><strong>Alerts</strong></summary> </details> <details> <summary><strong>Data Lake</strong></summary> </details> <details> <summary><strong>Scheduled Queries</strong></summary> </details> <details> <summary><strong>Sources</strong></summary> </details> <details> <summary><strong>Detections</strong></summary> </details> <details> <summary><strong>Global Helpers</strong></summary> </details> <details> <summary><strong>Data Models</strong></summary> </details> <details> <summary><strong>Schemas</strong></summary> </details> <details> <summary><strong>Metrics</strong></summary> </details> <details> <summary><strong>Users & Access Management</strong></summary> </details>

Panther Configuration

Follow these steps to configure your API credentials and environment.

1. Create an API token in Panther:

   • Navigate to Settings (gear icon) → API Tokens

   • Create a new token with the following permissions (recommended read-only approach to start):

   • <details> <summary><strong>View Required Permissions</strong></summary>

     

     </details>

2. Store the generated token securely (e.g., 1Password)

3. Copy the Panther instance URL from your browser (e.g., https://YOUR-PANTHER-INSTANCE.domain)

   • Note: This must include https://

MCP Server Installation

Choose one of the following installation methods:

Docker (Recommended)

The easiest way to get started is using our pre-built Docker image:

{
  "mcpServers": {
    "mcp-panther": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "-e", "PANTHER_INSTANCE_URL",
        "-e", "PANTHER_API_TOKEN",
        "--rm",
        "ghcr.io/panther-labs/mcp-panther"
      ],
      "env": {
        "PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
        "PANTHER_API_TOKEN": "YOUR-API-KEY"
      }
    }
  }
}

Version Pinning: For production stability, pin to a specific version tag:

"ghcr.io/panther-labs/mcp-panther:v2.2.0"

Available tags can be found on the GitHub Container Registry.

UVX

For Python users, you can run directly from PyPI using uvx:

1. Install UV

2. Configure your MCP client:

{
  "mcpServers": {
    "mcp-panther": {
      "command": "uvx",
      "args": ["mcp-panther"],
      "env": {
        "PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
        "PANTHER_API_TOK

---