MCP

Panther exposes a Model Context Protocol (MCP) server so MCP clients — editors, chat tools, scripted agents — can use Panther's tools through natural language. Ask about alerts, query the data lake, look up an indicator, pull a detection's source, and more, all from your client of choice.

There are two ways to connect:

• Panther Remote MCP— the hosted endpoint at your Panther instance. OAuth-based sign-in, per-connection consent, and consolidated audit logging. Recommended for most users.

• Local MCP — the open-source mcp-panther package, installed via docker or uvx and authenticated with a Panther API token. Useful for CI pipelines, scripted agents, and custom internal tooling.

Use of Panther MCP features is subject to the AI disclaimer found on the Legal page.

MCP Integrations (Beta)