panthermcp

A Model Context Protocol server for the Panther SIEM, written in Go and shipped as a ~20 MB Docker image.

Give it your Panther URL and an API token, and any MCP client (Claude Desktop, Claude Code, Cursor, …) can triage alerts, hunt in the data lake, manage detections, log sources, users and more — 85 tools covering every Panther REST endpoint plus the GraphQL API, with raw REST/GraphQL escape hatches for anything else.

Unofficial project, not affiliated with or endorsed by Panther Labs.

• Two transports selected with --transport: stdio (client spawns the container) or http (Streamable HTTP, long-running service).
• Read-only mode (PANTHER_READ_ONLY=true) registers only tools that cannot change anything.
• Safe updates: update_* tools fetch the current object and merge your changes, so you never wipe fields by accident.
• Data lake guard rails: read-only SQL only; queries on Panther tables must have a time filter unless you opt out; results are paged and size-capped.
• Bearer-token auth for the HTTP transport, non-root distroless image, no CGO.

Quick start

1. Create a Panther API token

In Panther go to Settings → API Tokens → Create New Token and grant the permissions you want the assistant to have (e.g. Read Alerts, Manage Alerts, Query Data Lake, View Rules, View Log Sources, Read Panther Metrics, Read User Info). The server can only do what the token allows; the get_permissions tool shows what it has.

2. Build the image

docker build -t panthermcp .

Or pull the prebuilt multi-arch image: ghcr.io/pmind12/panthermcp:latest.

3a. Use it over stdio (Claude Desktop / Claude Code)

The client starts the container itself. Claude Desktop, claude_desktop_config.json:

{
  "mcpServers": {
    "panther": {
      "command": "docker",
      "args": ["run", "-i", "--rm",
               "-e", "PANTHER_URL", "-e", "PANTHER_API_KEY",
               "ghcr.io/pmind12/panthermcp:latest", "--transport", "stdio"],
      "env": {
        "PANTHER_URL": "https://your-instance.runpanther.net",
        "PANTHER_API_KEY": "your-api-token"
      }
    }
  }
}

Claude Code:

claude mcp add panther -e PANTHER_URL=https://your-instance.runpanther.net -e PANTHER_API_KEY=your-api-token -- docker run -i --rm -e PANTHER_URL -e PANTHER_API_KEY ghcr.io/pmind12/panthermcp:latest --transport stdio

3b. Run it as an HTTP service

cp .env.example .env        # fill in PANTHER_URL, PANTHER_API_KEY and MCP_AUTH_TOKEN
docker compose up -d

or without compose:

docker run -d -p 8080:8080 -e PANTHER_URL=https://your-instance.runpanther.net -e PANTHER_API_KEY=your-api-token -e MCP_AUTH_TOKEN=a-long-random-string ghcr.io/pmind12/panthermcp:latest --transport http

The MCP endpoint is http://:8080/mcp (health check: /healthz). Clients send