一个用于 Panther SIEM，用 Go 编写，并以 ~20 MB Docker 镜像形式发布。

给它你的 Panther URL 和 API 令牌，以及任何 MCP 客户端（Claude Desktop， Claude 代码、光标等）可以分流警报、在数据湖中搜索、管理 检测、日志源、用户及更多——85个工具涵盖每台Panther REST 端点加上 GraphQL API，其他应用则有原始的 REST/GraphQL 逃逸通道。

非官方项目，与Panther Labs无关或认可。

• 两种传输选择--transport：stdio（客户端生成容器）或http（可流式HTTP，长期服务）。
• 只读模式（PANTHER_READ_ONLY=true）只注册那些无法更改的任何工具。
• 安全更新：update_* 工具会获取当前对象并合并你的更改，避免你不小心擦除字段。
• 数据湖保护栏：仅支持只读 SQL;Panther 表上的查询必须有时间过滤器，除非你选择退出;结果被分页并限制大小。
• HTTP传输的承载令牌认证，非无根无发行镜像，无CGO。

快速开始

1.创建Panther API令牌

panthermcp

A Model Context Protocol server for the Panther SIEM, written in Go and shipped as a ~20 MB Docker image.

Give it your Panther URL and an API token, and any MCP client (Claude Desktop, Claude Code, Cursor, …) can triage alerts, hunt in the data lake, manage detections, log sources, users and more — 85 tools covering every Panther REST endpoint plus the GraphQL API, with raw REST/GraphQL escape hatches for anything else.

Unofficial project, not affiliated with or endorsed by Panther Labs.

• Two transports selected with --transport: stdio (client spawns the container) or http (Streamable HTTP, long-running service).
• Read-only mode (PANTHER_READ_ONLY=true) registers only tools that cannot change anything.
• Safe updates: update_* tools fetch the current object and merge your changes, so you never wipe fields by accident.
• Data lake guard rails: read-only SQL only; queries on Panther tables must have a time filter unless you opt out; results are paged and size-capped.
• Bearer-token auth for the HTTP transport, non-root distroless image, no CGO.

Quick start

1. Create a Panther API token

In Panther go to Settings → API Tokens → Create New Token and grant the permissions you want the assistant to have (e.g. Read Alerts, Manage Alerts, Query Data Lake, View Rules, View Log Sources, Read Panther Metrics, Read User Info). The server can only do what the token allows; the get_permissions tool shows what it has.

2. Build the image

docker build -t panthermcp .

Or pull the prebuilt multi-arch image: ghcr.io/pmind12/panthermcp:latest.

3a. Use it over stdio (Claude Desktop / Claude Code)

The client starts the container itself. Claude Desktop, claude_desktop_config.json:

{
  "mcpServers": {
    "panther": {
      "command": "docker",
      "args": ["run", "-i", "--rm",
               "-e", "PANTHER_URL", "-e", "PANTHER_API_KEY",
               "ghcr.io/pmind12/panthermcp:latest", "--transport", "stdio"],
      "env": {
        "PANTHER_URL": "https://your-instance.runpanther.net",
        "PANTHER_API_KEY": "your-api-token"
      }
    }
  }
}

Claude Code:

claude mcp add panther -e PANTHER_URL=https://your-instance.runpanther.net -e PANTHER_API_KEY=your-api-token -- docker run -i --rm -e PANTHER_URL -e PANTHER_API_KEY ghcr.io/pmind12/panthermcp:latest --transport stdio

3b. Run it as an HTTP service

cp .env.example .env        # fill in PANTHER_URL, PANTHER_API_KEY and MCP_AUTH_TOKEN
docker compose up -d

or without compose:

docker run -d -p 8080:8080 -e PANTHER_URL=https://your-instance.runpanther.net -e PANTHER_API_KEY=your-api-token -e MCP_AUTH_TOKEN=a-long-random-string ghcr.io/pmind12/panthermcp:latest --transport http

The MCP endpoint is http://:8080/mcp (health check: /healthz). Clients send