panther-labs/mcp-panther

Overview

MCP-Panther is a Python-based tool that lets AI agents write security detections, investigate alerts, and query logs through the Model Context Protocol. It connects to Panther's detection-as-code platform, enabling automated security operations workflows.

Best for

Best for
Security engineers and SOC teams using Panther who want to automate detection writing and alert investigation with AI agents.

Use cases

• Automatically generate and test new security detections from natural language prompts
• Investigate security alerts by querying log data through an AI agent
• Integrate Panther's detection capabilities into AI-driven security pipelines

How to use

Install

docker run -i -e PANTHER_INSTANCE_URL -e PANTHER_API_TOKEN --rm ghcr.io/panther-labs/mcp-panther

Tools exposed

• add_alert_comment
• start_ai_alert_triage
• get_ai_alert_triage_summary
• get_alert
• get_alert_events
• list_alerts
• bulk_update_alerts
• update_alert_assignee
• update_alert_status
• list_alert_comments
• query_data_lake
• get_table_schema
• list_databases
• list_database_tables
• get_alert_event_stats
• list_scheduled_queries
• get_scheduled_query
• list_log_sources
• get_http_log_source
• list_detections

Example client config

{\n  "mcpServers": {\n    "mcp-panther": {\n      "command": "docker",\n      "args": [\n        "run",\n        "-i",\n        "-e", "PANTHER_INSTANCE_URL",\n        "-e", "PANTHER_API_TOKEN",\n        "--rm",\n        "ghcr.io/panther-labs/mcp-panther"\n      ],\n      "env": {\n        "PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",\n        "PANTHER_API_TOKEN": "YOUR-API-KEY"\n      }\n    }\n  }\n}

Notes

MCP-Panther is a Python-based tool that lets AI agents write security detections, investigate alerts, and query logs through the Model Context Protocol. It connects to Panther’s detection-as-code platform, enabling automated security operations workflows.

44 stars on GitHub. Last updated 2026-05-15. Licensed Apache-2.0.

Use cases

• Automatically generate and test new security detections from natural language prompts
• Investigate security alerts by querying log data through an AI agent
• Integrate Panther’s detection capabilities into AI-driven security pipelines

Pros

• Enables natural language interaction with Panther’s detection platform
• Open source with a permissive license for customization
• Reduces manual effort in writing and testing detections

Cons

• Limited community adoption with only 44 GitHub stars
• Requires Panther platform access and setup
• Dependency on MCP protocol may limit agent compatibility

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.