> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/~/revisions/i7lJ3BCO5BWSo8qHQtoL/ai/panther-mcp-server/local.md).

# Local MCP

## Overview

The [`mcp-panther`](https://github.com/panther-labs/mcp-panther) package is an open-source MCP server you run locally — installed via `docker` or `uvx` — that authenticates to your Panther instance with a [Panther API token](/~/revisions/i7lJ3BCO5BWSo8qHQtoL/panther-developer-workflows/api.md).

{% hint style="info" %}
For most users, [Panther Remote MCP](/~/revisions/i7lJ3BCO5BWSo8qHQtoL/ai/panther-mcp-server.md) is the better starting point — no install, OAuth-based sign-in, per-connection consent, and full audit logging. Use Local MCP when you need API-token-based auth or programmatic invocation from CI.
{% endhint %}

Local MCP is most useful for:

* **CI pipelines and scripted agents** that need to run without an interactive browser session.
* **Custom internal agents** built on top of MCP that want to manage their own credentials.
* **Detection engineering in editors like Cursor** when you prefer token-based auth over OAuth.

`mcp-panther` is open-source — see the [contribution guidelines](https://github.com/panther-labs/mcp-panther/blob/main/CONTRIBUTING.md). If you find a bug or need extra support, please [open an issue in the repository](https://github.com/panther-labs/mcp-panther/issues).

{% hint style="info" %}
Use of Panther MCP features is subject to the [AI disclaimer found on the Legal page](/~/revisions/i7lJ3BCO5BWSo8qHQtoL/resources/help/legal.md#ai-disclaimer).
{% endhint %}

## Setup

1. **Install** `mcp-panther` in your client of choice (e.g., Claude for Desktop, Cursor). You can install it via `docker` or `uvx` — full instructions are in the [MCP Server Installation section of the README](https://github.com/panther-labs/mcp-panther?tab=readme-ov-file#mcp-server-installation).
2. **Mint a Panther API token** with the permissions you want the MCP server to have (see [Permissions](/~/revisions/i7lJ3BCO5BWSo8qHQtoL/ai/panther-mcp-server.md#permissions) below).
3. **Configure the client** with the API token following the install instructions for your platform.
4. **Try a prompt** — for example, "Show me high-severity alerts from the last 24 hours."

Your MCP client uses [`mcp-panther`](https://github.com/panther-labs/mcp-panther?tab=readme-ov-file#available-tools) to interact with [Panther's APIs](/~/revisions/i7lJ3BCO5BWSo8qHQtoL/panther-developer-workflows/api.md) and answer your question or execute the action you requested.

## Available tools

For the up-to-date list of tools exposed by Local MCP, see [Available Tools in the `mcp-panther` README](https://github.com/panther-labs/mcp-panther?tab=readme-ov-file#available-tools). The package includes tools for working with alerts, the data lake, rules, data models, schemas, metrics, scheduled queries, and Panther users.

## Permissions

API tokens used with Local MCP carry whatever permissions you mint them with — there is no per-session consent step. Mint tokens narrowly for least-privilege use.

| Access level                        | Recommended API token permissions                                                                                                             |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Read-only (minimum recommended)** | `Read Alerts`, `View Rules`, `View Policies`, `Query Data Lake`, `View Log Sources`, `View Overview`, `Read User Info`, `Read API Token Info` |
| **Write actions**                   | Add `Manage Alerts`, `Manage Rules`, and/or `Manage Policies`                                                                                 |
| **AI triage**                       | Add `Run Panther AI`                                                                                                                          |

## Security

To safely use Local MCP, follow the guidelines in the [Security Best Practices section of the `mcp-panther` README](https://github.com/panther-labs/mcp-panther?tab=readme-ov-file#security-best-practices). Of particular note:

* **API tokens are bearer credentials.** Anyone with the token can act as the token's owner. Store them in your client's secret store (Claude Desktop's connector secrets, Cursor's MCP env, etc.) — never in plaintext config files.
* **Mint narrowly, rotate often.** Issue separate tokens per host/use case and rotate on schedule.
* **Audit trail is spread across REST API events.** Local MCP tool calls are audited at the REST API layer — every endpoint a tool hits produces its own audit log entry. The trail is complete, but reconstructing what an MCP session did means stitching together multiple events. [Panther Remote MCP](/~/revisions/i7lJ3BCO5BWSo8qHQtoL/ai/panther-mcp-server.md) records each tool call as a single `AI_TOOL_INVOKE` event, which is easier to follow when audit-trail clarity matters.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.panther.com/~/revisions/i7lJ3BCO5BWSo8qHQtoL/ai/panther-mcp-server/local.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.