mcp-panther MCP server

Use Panther's SIEM platform in natural language to write detections, query logs and manage alerts.

Category: Security · Source: panther-labs/mcp-panther

Install in Claude Code

claude mcp add mcp-panther -e PANTHER_INSTANCE_URL=YOUR_VALUE -e PANTHER_API_TOKEN=YOUR_VALUE -- docker run -i -e PANTHER_INSTANCE_URL -e PANTHER_API_TOKEN --rm ghcr.io/panther-labs/mcp-panther

Install in Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "mcp-panther": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "-e",
        "PANTHER_INSTANCE_URL",
        "-e",
        "PANTHER_API_TOKEN",
        "--rm",
        "ghcr.io/panther-labs/mcp-panther"
      ],
      "env": {
        "PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
        "PANTHER_API_TOKEN": "YOUR-API-KEY"
      }
    }
  }
}

Install in VS Code (Copilot agent mode)

Add to .vscode/mcp.json:

{
  "servers": {
    "mcp-panther": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "-e",
        "PANTHER_INSTANCE_URL",
        "-e",
        "PANTHER_API_TOKEN",
        "--rm",
        "ghcr.io/panther-labs/mcp-panther"
      ],
      "env": {
        "PANTHER_INSTANCE_URL": "https://YOUR-PANTHER-INSTANCE.domain",
        "PANTHER_API_TOKEN": "YOUR-API-KEY"
      }
    }
  }
}

The same mcpServers block works in Claude Desktop (claude_desktop_config.json), Windsurf and most other MCP clients.

Required environment variables

PANTHER_INSTANCE_URL
PANTHER_API_TOKEN

Values shown as placeholders in the README; get them from the provider. Never commit them to git.

Config taken from the project README. Check the repository for the latest options before running third-party code.

Similar MCP servers (Security)

kakunin-mcp — Agent compliance and identity: verify an agent's X.509 certificate scope, read its behavioral risk score and a
agent-passport-mcp — Agent identity, scoped delegation and governance: issue passports, verify narrowing-only delegation chains, en
basedagents — Agent identity registry (reputation, capability search, task marketplace, messaging) plus a local encrypted va
claude-plugin — Scan and fix a domain's email authentication (SPF, DMARC, DKIM, MX), blacklist status and domain/SSL expiry, w
echelongraph-mcp — Keyless, read-only CVE and internet-exposure intelligence: CVE lookup and search, CISA KEV, EPSS history, CWE,
mandare — Accountability for AI agent fleets: verify a signed, hash-chained ledger, check budgets, kill an agent, and is
scalekit-mcp-server — Manage Scalekit organizations, users and SSO.
impri — Self-hostable human-in-the-loop approval inbox: humans approve, reject or edit proposed agent actions via web,