Skip to content
actionlake
Start free

Connectors · Identity & security

StrangeBee TheHive MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to StrangeBee TheHive and the rest of your systems. It gives your agent 339 StrangeBee TheHive actions (174 reads, 113 writes and 52 that wait for a confirmation) and holds the StrangeBee TheHive credential itself, so the agent never does. It paces StrangeBee TheHive's limits and records every call.

Connect StrangeBee TheHive freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "strangebee_thehive.users.list",  intent: "check which StrangeBee TheHive account is connected"}# List users · read · 1 upstream call
  • 339actionsin one signed file
  • 174readlook, never change
  • 113writecreate and update
  • 52wait for a yesdestructive, confirmed first

Set up

Connect StrangeBee TheHive in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect StrangeBee TheHive.

    Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_keyTheHive API key: avatar menu > Settings > API Key > Create/Reveal (Normal users), or Organization > Users > the…
    • hostWhere your StrangeBee TheHive lives: your host
    • organisationYour StrangeBee TheHive organisation
    account { op: "connections.requirements", service: "strangebee_thehive" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "strangebee_thehive.users.list" }# list users · read · 1 upstream callcheck { action: "strangebee_thehive.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

StrangeBee TheHive at a glance

Sign-in
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_key
Setup fields
hostorganisation
Limits we pace to
10 calls a second, per connection
API covered
TheHive API v1 (OpenAPI 3.1.0, v6.0.0), at your StrangeBee TheHive instance's API base URL, which you enter when connecting
Built from
StrangeBee TheHive's documentation, read 23 October 2026docs.strangebee.comdocs.strangebee.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
168 of 174 reads, for up to 5 minutes; a write clears what it affects
Shared entities
7, so ask can line StrangeBee TheHive up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in StrangeBee TheHive.

339 actions in 50 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 174readlook, never change
  • 113writecreate and update
  • 52destructivewait for a confirmation

  1. Cases

    37

    23 read · 10 write · 4 destructive

    List cases · List a case's comments · Create a case · Get a case

  2. Alerts

    25

    13 read · 9 write · 3 destructive

    List alerts · Get an alert · Create an alert · Update an alert

  3. Cortex

    20

    14 read · 5 write · 1 destructive

    Run responders in bulk · Create an analyzer template · List Cortex responder actions · List analyzer report templates

  4. Tasks

    18

    12 read · 5 write · 1 destructive

    List tasks · Create a task in a case · Get a task · Update a task

  5. Users

    15

    7 read · 5 write · 3 destructive

    List users · Create a user account · Get a user account · Update a user account

  6. Observables

    14

    9 read · 4 write · 1 destructive

    Add an observable to an alert · Add an observable to a case · List observables · List an observable's attachments

  7. Email intake

    11

    5 read · 5 write · 1 destructive

    Add a mailbox configuration · Complete Google Workspace OAuth 2.0 authorization · Get the email intake module configuration · List mailbox folders

  8. Organisations

    11

    6 read · 4 write · 1 destructive

    List organisations · List an organisation's users · Create an organization · List an organisation's alerts

42 more areas · 188 actions
  • Case shares 9
  • Functions 9
  • Procedures 9
  • Case report templates 8
  • Case templates 8
  • Task logs 8
  • Catalogs 7
  • Taxonomies 7
  • Alert feeders 6
  • Comments 6
  • Custom fields 6
  • Dashboards 6
  • Page templates 6
  • Pages 6
  • Alert statuses 5
  • Case links 5
  • Case statuses 5
  • Custom events 5
  • Licenses 5
  • Observable types 5
  • Patterns 5
  • Profiles 5
  • Case reports 4
  • Tags 4
  • Views 4
  • Audit 3
  • Auth 3
  • Case pages 3
  • Misp 3
  • Observable shares 3
  • Task shares 3
  • User config 3
  • Branding 2
  • Describe 2
  • Entities 2
  • Status 2
  • Admin 1
  • Attachments 1
  • Export 1
  • Permissions 1
  • Query 1
  • Sharing profiles 1

Top actions

The StrangeBee TheHive API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 31 of StrangeBee TheHive's 31 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
strangebee_thehive.users.listList usersList users.readidentity.user.list474 connectors
strangebee_thehive.users.createCreate a user accountCreate a user account.writeidentity.user.create262 connectors
strangebee_thehive.tasks.listList tasksList tasks.readwork.task.list122 connectors
strangebee_thehive.users.deleteDelete a user accountDelete a user account.destructiveidentity.user.delete253 connectors
strangebee_thehive.alerts.listList alertsList alerts.readsecurity.alert.list22 connectors
strangebee_thehive.cases.listList casesList cases.readsecurity.incident.list17 connectors
strangebee_thehive.tasks.createCreate a task in a caseCreate a task in a case.writework.task.create127 connectors
strangebee_thehive.tags.listList custom tagsList custom tags.readcrm.tag.list65 connectors
strangebee_thehive.users.meGet current user infoGet current user info.readidentity.current_user.get307 connectors
strangebee_thehive.audit.list_flowGet the audit trail of an objectGet the audit trail of an object.readsecurity.audit_log.list69 connectors
strangebee_thehive.cases.list_commentsList a case's commentsList a case's comments.readsecurity.incident_note.list9 connectors
strangebee_thehive.cases.createCreate a caseCreate a case.writesecurity.incident.create8 connectors

Try it

Prompts to paste into Claude.

Each one names the StrangeBee TheHive actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which StrangeBee TheHive tasks are overdue, and who owns each one?

    callsstrangebee_thehive.tasks.list

  2. Writewrite

    Create a user account in StrangeBee TheHive. Show me exactly what you will send before you save it.

    callsstrangebee_thehive.users.create

Governance for StrangeBee TheHive

Destructive actions wait for a yes.

52 StrangeBee TheHive actions are destructive. The first 10:

  • Delete a user accountstrangebee_thehive.users.delete
  • Delete a taskstrangebee_thehive.tasks.delete
  • Delete a commentstrangebee_thehive.comments.delete
  • Delete a casestrangebee_thehive.cases.delete
  • Delete a tagstrangebee_thehive.tags.delete
  • Delete an alertstrangebee_thehive.alerts.delete
  • Lock a user accountstrangebee_thehive.users.lock
  • Delete multiple alertsstrangebee_thehive.alerts.bulk_delete
  • Unlink an alert from a casestrangebee_thehive.cases.unlink_alert
  • Delete an observablestrangebee_thehive.observables.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dostrangebee_thehive.users.deleteconfirm_policy: human

Delete a user account?

intent: the user asked me to delete a user account

run suspended · waiting for a named person · key strangebee-thehive-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "strangebee-thehive-agent",  allowed_actions: ["strangebee_thehive.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "strangebee_thehive.users.delete", approver: "[email protected]" },    { match: "strangebee_thehive.tasks.delete", approver: "[email protected]" },    { match: "strangebee_thehive.comments.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to StrangeBee TheHive only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What StrangeBee TheHive costs on actionlake.

Every StrangeBee TheHive action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call StrangeBee TheHive refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 339 StrangeBee TheHive actions
  • 339actions pageeach page of a long list is one call
  • 168reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every StrangeBee TheHive action.

339 actions by area: the id your agent calls, what it does, and its effect.

Cases37
  • strangebee_thehive.cases.bulk_apply_case_templateApply a case template to existing caseswrite
  • strangebee_thehive.cases.bulk_set_accessSet the access mode of multiple caseswrite
  • strangebee_thehive.cases.bulk_updateUpdate multiple caseswrite
  • strangebee_thehive.cases.change_ownerChange the owner organization of a casewrite
  • strangebee_thehive.cases.countCount casesread
  • strangebee_thehive.cases.createCreate a casewrite
  • strangebee_thehive.cases.deduplicate_observablesDeduplicate observables in a casewrite
  • strangebee_thehive.cases.deleteDelete a casedestructive
  • strangebee_thehive.cases.delete_attachmentRemove an attachment from a casedestructive
  • strangebee_thehive.cases.getGet a caseread
  • strangebee_thehive.cases.get_timelineGet the timeline of a caseread
  • strangebee_thehive.cases.listList casesread
  • strangebee_thehive.cases.list_alertsList alerts merged into a caseread
  • strangebee_thehive.cases.list_all_commentsList comments on a case and its merged alertsread
  • strangebee_thehive.cases.list_assignable_usersList users assignable to a caseread
  • strangebee_thehive.cases.list_attachmentsList a case's attachmentsread
  • strangebee_thehive.cases.list_commentsList a case's commentsread
  • strangebee_thehive.cases.list_custom_eventsList a case's custom timeline eventsread
  • strangebee_thehive.cases.list_observablesList a case's observablesread
  • strangebee_thehive.cases.list_organisationsList organisations a case is shared withread
  • strangebee_thehive.cases.list_pagesList a case's pagesread
  • strangebee_thehive.cases.list_proceduresList a case's procedures (TTPs)read
  • strangebee_thehive.cases.list_reportsList a case's reportsread
  • strangebee_thehive.cases.list_responder_actionsList Cortex responder executions on a caseread
  • strangebee_thehive.cases.list_sharesList a case's sharing configurationsread
  • strangebee_thehive.cases.list_similar_alertsList alerts sharing observables with a caseread
  • strangebee_thehive.cases.list_similar_casesList cases sharing observables with a caseread
  • strangebee_thehive.cases.list_similar_legacyList similar casesread
  • strangebee_thehive.cases.list_similar_observablesList observables shared with another case or alertread
  • strangebee_thehive.cases.list_task_groupsList a case's task group namesread
  • strangebee_thehive.cases.list_tasksList a case's tasksread
  • strangebee_thehive.cases.mergeMerge cases into a new casewrite
  • strangebee_thehive.cases.remove_custom_fieldRemove a custom field from a casedestructive
  • strangebee_thehive.cases.set_accessSet the access mode of a casewrite
  • strangebee_thehive.cases.unlink_alertUnlink an alert from a casedestructive
  • strangebee_thehive.cases.updateUpdate a casewrite
  • strangebee_thehive.cases.update_attachmentUpdate a case attachmentwrite
Alerts25
  • strangebee_thehive.alerts.bulk_deleteDelete multiple alertsdestructive
  • strangebee_thehive.alerts.bulk_merge_into_caseMerge multiple alerts into a casewrite
  • strangebee_thehive.alerts.bulk_updateUpdate multiple alertswrite
  • strangebee_thehive.alerts.countCount alertsread
  • strangebee_thehive.alerts.createCreate an alertwrite
  • strangebee_thehive.alerts.create_caseCreate a case from an alertwrite
  • strangebee_thehive.alerts.deleteDelete an alertdestructive
  • strangebee_thehive.alerts.delete_attachmentRemove an attachment from an alertdestructive
  • strangebee_thehive.alerts.followFollow an alertwrite
  • strangebee_thehive.alerts.getGet an alertread
  • strangebee_thehive.alerts.get_caseGet the case an alert was merged intoread
  • strangebee_thehive.alerts.import_into_caseImport alert observables and procedures into a casewrite
  • strangebee_thehive.alerts.listList alertsread
  • strangebee_thehive.alerts.list_assignable_usersList users assignable to an alertread
  • strangebee_thehive.alerts.list_attachmentsList an alert's attachmentsread
  • strangebee_thehive.alerts.list_commentsList an alert's commentsread
  • strangebee_thehive.alerts.list_observablesList an alert's observablesread
  • strangebee_thehive.alerts.list_proceduresList an alert's procedures (TTPs)read
  • strangebee_thehive.alerts.list_responder_actionsList Cortex responder executions on an alertread
  • strangebee_thehive.alerts.list_similar_alertsList alerts sharing observables with an alertread
  • strangebee_thehive.alerts.list_similar_casesList cases sharing observables with an alertread
  • strangebee_thehive.alerts.list_similar_observablesList observables shared with another alert or caseread
  • strangebee_thehive.alerts.merge_into_caseMerge an alert into an existing casewrite
  • strangebee_thehive.alerts.unfollowUnfollow an alertwrite
  • strangebee_thehive.alerts.updateUpdate an alertwrite
Cortex20
  • strangebee_thehive.cortex.bulk_run_respondersRun responders in bulkwrite
  • strangebee_thehive.cortex.count_responder_executionsCount responder executions for a case or alertread
  • strangebee_thehive.cortex.create_analyzer_templateCreate an analyzer templatewrite
  • strangebee_thehive.cortex.delete_analyzer_templateDelete an analyzer templatedestructive
  • strangebee_thehive.cortex.get_actionGet a Cortex responder actionread
  • strangebee_thehive.cortex.get_analyzerGet an analyzerread
  • strangebee_thehive.cortex.get_analyzer_templateGet an analyzer report templateread
  • strangebee_thehive.cortex.get_jobGet a Cortex jobread
  • strangebee_thehive.cortex.list_actionsList Cortex responder actionsread
  • strangebee_thehive.cortex.list_analyzer_templatesList analyzer report templatesread
  • strangebee_thehive.cortex.list_analyzersList available analyzersread
  • strangebee_thehive.cortex.list_analyzers_by_typeList analyzers by observable data typeread
  • strangebee_thehive.cortex.list_job_report_observablesList observables produced by a Cortex analyzer reportread
  • strangebee_thehive.cortex.list_jobsList Cortex analysis jobsread
  • strangebee_thehive.cortex.list_responder_executionsList responder executions for a case or alertread
  • strangebee_thehive.cortex.list_responders_by_typeList responders available for an entity typeread
  • strangebee_thehive.cortex.list_responders_for_entityList responders available for an entityread
  • strangebee_thehive.cortex.run_analyzerRun an analyzer on an observablewrite
  • strangebee_thehive.cortex.run_responderRun a responderwrite
  • strangebee_thehive.cortex.update_analyzer_templateUpdate an analyzer templatewrite
Tasks18
  • strangebee_thehive.tasks.bulk_updateUpdate multiple taskswrite
  • strangebee_thehive.tasks.countCount tasksread
  • strangebee_thehive.tasks.createCreate a task in a casewrite
  • strangebee_thehive.tasks.deleteDelete a taskdestructive
  • strangebee_thehive.tasks.getGet a taskread
  • strangebee_thehive.tasks.get_action_requiredCheck action required for a taskread
  • strangebee_thehive.tasks.listList tasksread
  • strangebee_thehive.tasks.list_assignable_usersList users assignable to a taskread
  • strangebee_thehive.tasks.list_in_casesList tasks linked to casesread
  • strangebee_thehive.tasks.list_logsList a task's logsread
  • strangebee_thehive.tasks.list_mineList tasks assigned to meread
  • strangebee_thehive.tasks.list_organisationsList organisations a task is shared withread
  • strangebee_thehive.tasks.list_responder_actionsList Cortex responder executions on a taskread
  • strangebee_thehive.tasks.list_sharesList a task's sharing configurationsread
  • strangebee_thehive.tasks.list_waitingList waiting tasksread
  • strangebee_thehive.tasks.set_action_doneSet action done on a taskwrite
  • strangebee_thehive.tasks.set_action_requiredSet action required on a taskwrite
  • strangebee_thehive.tasks.updateUpdate a taskwrite
Users15
  • strangebee_thehive.users.change_passwordChange a user account passwordwrite
  • strangebee_thehive.users.createCreate a user accountwrite
  • strangebee_thehive.users.deleteDelete a user accountdestructive
  • strangebee_thehive.users.getGet a user accountread
  • strangebee_thehive.users.listList usersread
  • strangebee_thehive.users.list_alertsList alerts assigned to a userread
  • strangebee_thehive.users.list_casesList cases assigned to a userread
  • strangebee_thehive.users.list_tasksList tasks assigned to a userread
  • strangebee_thehive.users.list_visibleList users visible across organisationsread
  • strangebee_thehive.users.lockLock a user accountdestructive
  • strangebee_thehive.users.meGet current user inforead
  • strangebee_thehive.users.revoke_api_keyRevoke a user API keydestructive
  • strangebee_thehive.users.set_organisationsSet user account organizationswrite
  • strangebee_thehive.users.set_passwordSet a user account passwordwrite
  • strangebee_thehive.users.updateUpdate a user accountwrite
Observables14
  • strangebee_thehive.observables.bulk_updateUpdate multiple observableswrite
  • strangebee_thehive.observables.countCount observablesread
  • strangebee_thehive.observables.create_in_alertAdd an observable to an alertwrite
  • strangebee_thehive.observables.create_in_caseAdd an observable to a casewrite
  • strangebee_thehive.observables.deleteDelete an observabledestructive
  • strangebee_thehive.observables.getGet an observableread
  • strangebee_thehive.observables.listList observablesread
  • strangebee_thehive.observables.list_attachmentsList an observable's attachmentsread
  • strangebee_thehive.observables.list_jobsList Cortex analysis jobs run on an observableread
  • strangebee_thehive.observables.list_organisationsList organisations an observable is shared withread
  • strangebee_thehive.observables.list_responder_actionsList Cortex responder executions on an observableread
  • strangebee_thehive.observables.list_sharesList an observable's sharing configurationsread
  • strangebee_thehive.observables.list_similarList observables similar to an observableread
  • strangebee_thehive.observables.updateUpdate an observablewrite
Email intake11
  • strangebee_thehive.email_intake.create_configAdd a mailbox configurationwrite
  • strangebee_thehive.email_intake.delete_configDelete a mailbox configurationdestructive
  • strangebee_thehive.email_intake.exchange_authorization_codeComplete Google Workspace OAuth 2.0 authorizationwrite
  • strangebee_thehive.email_intake.get_configGet a mailbox configurationread
  • strangebee_thehive.email_intake.list_configsGet the email intake module configurationread
  • strangebee_thehive.email_intake.list_foldersList mailbox foldersread
  • strangebee_thehive.email_intake.list_providersList available email intake providersread
  • strangebee_thehive.email_intake.syncTrigger an immediate email fetchwrite
  • strangebee_thehive.email_intake.test_configTest a mailbox connectionread
  • strangebee_thehive.email_intake.update_configUpdate a mailbox configurationwrite
  • strangebee_thehive.email_intake.update_settingsUpdate the email intake module settingswrite
Organisations11
  • strangebee_thehive.organisations.createCreate an organizationwrite
  • strangebee_thehive.organisations.getGet an organizationread
  • strangebee_thehive.organisations.linkLink two organizationswrite
  • strangebee_thehive.organisations.listList organisationsread
  • strangebee_thehive.organisations.list_alertsList an organisation's alertsread
  • strangebee_thehive.organisations.list_case_templatesList an organisation's case templatesread
  • strangebee_thehive.organisations.list_linksList organization linksread
  • strangebee_thehive.organisations.list_usersList an organisation's usersread
  • strangebee_thehive.organisations.set_linksReplace all links for an organizationwrite
  • strangebee_thehive.organisations.unlinkRemove a link between two organizationsdestructive
  • strangebee_thehive.organisations.updateUpdate an organizationwrite
Case shares9
  • strangebee_thehive.case_shares.bulk_deleteDelete multiple sharesdestructive
  • strangebee_thehive.case_shares.createShare a case with other organizationswrite
  • strangebee_thehive.case_shares.deleteRemove a share by IDdestructive
  • strangebee_thehive.case_shares.getGet a sharing configurationread
  • strangebee_thehive.case_shares.listList shares of a caseread
  • strangebee_thehive.case_shares.list_allList sharing configurationsread
  • strangebee_thehive.case_shares.remove_organisationsUnshare a case from organizationsdestructive
  • strangebee_thehive.case_shares.setSet all shares for a casewrite
  • strangebee_thehive.case_shares.updateUpdate a share's permission profilewrite
Functions9
  • strangebee_thehive.functions.createCreate a functionwrite
  • strangebee_thehive.functions.deleteDelete a functiondestructive
  • strangebee_thehive.functions.getGet a functionread
  • strangebee_thehive.functions.get_context_documentationGet context object documentationread
  • strangebee_thehive.functions.invokeInvoke a functionwrite
  • strangebee_thehive.functions.invoke_on_objectInvoke a function on a case or alertwrite
  • strangebee_thehive.functions.listList functionsread
  • strangebee_thehive.functions.testTest a functionread
  • strangebee_thehive.functions.updateUpdate a functionwrite
Procedures9
  • strangebee_thehive.procedures.bulk_create_in_alertAdd multiple TTPs to an alertwrite
  • strangebee_thehive.procedures.bulk_create_in_caseAdd multiple TTPs to a casewrite
  • strangebee_thehive.procedures.bulk_deleteDelete multiple TTPsdestructive
  • strangebee_thehive.procedures.create_in_alertAdd a TTP to an alertwrite
  • strangebee_thehive.procedures.create_in_caseAdd a TTP to a casewrite
  • strangebee_thehive.procedures.deleteDelete a TTPdestructive
  • strangebee_thehive.procedures.getGet a procedure (TTP)read
  • strangebee_thehive.procedures.listList procedures (TTPs)read
  • strangebee_thehive.procedures.updateUpdate a TTPwrite
Case report templates8
  • strangebee_thehive.case_report_templates.createCreate a case report templatewrite
  • strangebee_thehive.case_report_templates.deleteDelete a case report templatedestructive
  • strangebee_thehive.case_report_templates.delete_attachmentRemove an attachment from a case report templatedestructive
  • strangebee_thehive.case_report_templates.getGet a case report templateread
  • strangebee_thehive.case_report_templates.get_infoList available widget types and field optionsread
  • strangebee_thehive.case_report_templates.listList case report templatesread
  • strangebee_thehive.case_report_templates.list_attachmentsList a case report template's image attachmentsread
  • strangebee_thehive.case_report_templates.updateUpdate a case report templatewrite
Case templates8
  • strangebee_thehive.case_templates.createCreate a case templatewrite
  • strangebee_thehive.case_templates.deleteDelete a case templatedestructive
  • strangebee_thehive.case_templates.getGet a case templateread
  • strangebee_thehive.case_templates.link_page_templatesLink page templates to a case templatewrite
  • strangebee_thehive.case_templates.listList case templatesread
  • strangebee_thehive.case_templates.list_page_templatesList a case template's page templatesread
  • strangebee_thehive.case_templates.list_tasksList a case template's task templatesread
  • strangebee_thehive.case_templates.updateUpdate a case templatewrite
Task logs8
  • strangebee_thehive.task_logs.createCreate a task logwrite
  • strangebee_thehive.task_logs.deleteDelete a task logdestructive
  • strangebee_thehive.task_logs.delete_attachmentDelete an attachment from a task logdestructive
  • strangebee_thehive.task_logs.getGet a task logread
  • strangebee_thehive.task_logs.listList task logsread
  • strangebee_thehive.task_logs.list_attachmentsList a task log's attachmentsread
  • strangebee_thehive.task_logs.list_responder_actionsList Cortex responder executions on a task logread
  • strangebee_thehive.task_logs.updateUpdate a task logwrite
Catalogs7
  • strangebee_thehive.catalogs.createCreate an attack technique catalogwrite
  • strangebee_thehive.catalogs.deleteDelete an attack technique catalogdestructive
  • strangebee_thehive.catalogs.getGet an attack technique catalogread
  • strangebee_thehive.catalogs.listList attack technique catalogsread
  • strangebee_thehive.catalogs.list_patternsList the techniques in an attack catalogread
  • strangebee_thehive.catalogs.list_tacticsList the tactics in an attack catalogread
  • strangebee_thehive.catalogs.updateUpdate an attack technique catalogwrite
Taxonomies7
  • strangebee_thehive.taxonomies.activateActivate a taxonomywrite
  • strangebee_thehive.taxonomies.createCreate a taxonomywrite
  • strangebee_thehive.taxonomies.deactivateDeactivate a taxonomywrite
  • strangebee_thehive.taxonomies.deleteDelete a taxonomydestructive
  • strangebee_thehive.taxonomies.getGet a taxonomyread
  • strangebee_thehive.taxonomies.listList taxonomiesread
  • strangebee_thehive.taxonomies.list_tagsList a taxonomy's tagsread
Alert feeders6
  • strangebee_thehive.alert_feeders.createCreate an alert feederwrite
  • strangebee_thehive.alert_feeders.deleteDelete an alert feederdestructive
  • strangebee_thehive.alert_feeders.listList all alert feedersread
  • strangebee_thehive.alert_feeders.runRun an alert feeder immediatelywrite
  • strangebee_thehive.alert_feeders.testTest an alert feeder connectionread
  • strangebee_thehive.alert_feeders.updateUpdate an alert feederwrite
Comments6
  • strangebee_thehive.comments.create_on_alertAdd a comment to an alertwrite
  • strangebee_thehive.comments.create_on_caseAdd a comment to a casewrite
  • strangebee_thehive.comments.deleteDelete a commentdestructive
  • strangebee_thehive.comments.getGet a commentread
  • strangebee_thehive.comments.listList commentsread
  • strangebee_thehive.comments.updateUpdate a commentwrite
Custom fields6
  • strangebee_thehive.custom_fields.createCreate a custom fieldwrite
  • strangebee_thehive.custom_fields.deleteDelete a custom fielddestructive
  • strangebee_thehive.custom_fields.getGet a custom fieldread
  • strangebee_thehive.custom_fields.listList custom fieldsread
  • strangebee_thehive.custom_fields.list_allList all custom fieldsread
  • strangebee_thehive.custom_fields.updateUpdate a custom fieldwrite
Dashboards6
  • strangebee_thehive.dashboards.change_ownerChange the owner of a dashboardwrite
  • strangebee_thehive.dashboards.createCreate a dashboardwrite
  • strangebee_thehive.dashboards.deleteDelete a dashboarddestructive
  • strangebee_thehive.dashboards.getGet a dashboardread
  • strangebee_thehive.dashboards.listList dashboardsread
  • strangebee_thehive.dashboards.updateUpdate a dashboardwrite
Page templates6
  • strangebee_thehive.page_templates.createCreate a case page templatewrite
  • strangebee_thehive.page_templates.deleteDelete a case page templatedestructive
  • strangebee_thehive.page_templates.getGet a page templateread
  • strangebee_thehive.page_templates.listList page templatesread
  • strangebee_thehive.page_templates.list_case_templatesList case templates that include a page templateread
  • strangebee_thehive.page_templates.updateUpdate a case page templatewrite
Pages6
  • strangebee_thehive.pages.createCreate a Knowledge Base pagewrite
  • strangebee_thehive.pages.deleteDelete a Knowledge Base pagedestructive
  • strangebee_thehive.pages.getGet a pageread
  • strangebee_thehive.pages.listList pagesread
  • strangebee_thehive.pages.list_organisationList knowledge base pagesread
  • strangebee_thehive.pages.updateUpdate a Knowledge Base pagewrite
Alert statuses5
  • strangebee_thehive.alert_statuses.createCreate an alert statuswrite
  • strangebee_thehive.alert_statuses.deleteDelete an alert statusdestructive
  • strangebee_thehive.alert_statuses.getGet an alert statusread
  • strangebee_thehive.alert_statuses.listList alert statusesread
  • strangebee_thehive.alert_statuses.updateUpdate an alert statuswrite
Case links5
  • strangebee_thehive.case_links.add_caseLink a case to another casewrite
  • strangebee_thehive.case_links.add_externalLink a case to an external URLwrite
  • strangebee_thehive.case_links.list_typesList all case link typesread
  • strangebee_thehive.case_links.remove_caseRemove a link to another casedestructive
  • strangebee_thehive.case_links.remove_externalRemove a link to an external URLdestructive
Case statuses5
  • strangebee_thehive.case_statuses.createCreate a case statuswrite
  • strangebee_thehive.case_statuses.deleteDelete a case statusdestructive
  • strangebee_thehive.case_statuses.getGet a case statusread
  • strangebee_thehive.case_statuses.listList case statusesread
  • strangebee_thehive.case_statuses.updateUpdate a case statuswrite
Custom events5
  • strangebee_thehive.custom_events.createAdd a custom event to a case timelinewrite
  • strangebee_thehive.custom_events.deleteDelete a custom eventdestructive
  • strangebee_thehive.custom_events.getGet a custom timeline eventread
  • strangebee_thehive.custom_events.listList custom timeline eventsread
  • strangebee_thehive.custom_events.updateUpdate a custom eventwrite
Licenses5
  • strangebee_thehive.licenses.activateActivate an existing licensewrite
  • strangebee_thehive.licenses.createAdd and activate a licensewrite
  • strangebee_thehive.licenses.getGet a licenseread
  • strangebee_thehive.licenses.get_currentGet the current license statusread
  • strangebee_thehive.licenses.listList all licensesread
Observable types5
  • strangebee_thehive.observable_types.createCreate an observable typewrite
  • strangebee_thehive.observable_types.deleteDelete an observable typedestructive
  • strangebee_thehive.observable_types.getGet an observable typeread
  • strangebee_thehive.observable_types.listList observable typesread
  • strangebee_thehive.observable_types.updateUpdate the case sensitivity of an observable typewrite
Patterns5
  • strangebee_thehive.patterns.deleteDelete an attack techniquedestructive
  • strangebee_thehive.patterns.getGet an attack techniqueread
  • strangebee_thehive.patterns.import_attackImport MITRE ATT&CK techniqueswrite
  • strangebee_thehive.patterns.listList attack techniquesread
  • strangebee_thehive.patterns.list_for_caseList attack techniques linked to a caseread
Profiles5
  • strangebee_thehive.profiles.createCreate a profilewrite
  • strangebee_thehive.profiles.deleteDelete a profiledestructive
  • strangebee_thehive.profiles.getGet a profileread
  • strangebee_thehive.profiles.listList profilesread
  • strangebee_thehive.profiles.updateUpdate a profilewrite
Case reports4
  • strangebee_thehive.case_reports.createGenerate a case report from a templatewrite
  • strangebee_thehive.case_reports.deleteDelete a case reportdestructive
  • strangebee_thehive.case_reports.getGet a case reportread
  • strangebee_thehive.case_reports.listList case reportsread
Tags4
  • strangebee_thehive.tags.deleteDelete a tagdestructive
  • strangebee_thehive.tags.getGet a tagread
  • strangebee_thehive.tags.listList custom tagsread
  • strangebee_thehive.tags.updateUpdate a tagwrite
Views4
  • strangebee_thehive.views.createCreate a viewwrite
  • strangebee_thehive.views.deleteDelete a viewdestructive
  • strangebee_thehive.views.getGet a viewread
  • strangebee_thehive.views.updateUpdate a viewwrite
Audit3
  • strangebee_thehive.audit.getGet an audit log entryread
  • strangebee_thehive.audit.list_flowGet the audit trail of an objectread
  • strangebee_thehive.audit.list_for_objectList audit logs for an objectread
Auth3
  • strangebee_thehive.auth.disable_own_mfaDeactivate multifactor authentication for your accountdestructive
  • strangebee_thehive.auth.disable_user_mfaDeactivate multifactor authentication for another userdestructive
  • strangebee_thehive.auth.get_password_policyGet the local authentication password policyread
Case pages3
  • strangebee_thehive.case_pages.createCreate a case pagewrite
  • strangebee_thehive.case_pages.deleteDelete a case pagedestructive
  • strangebee_thehive.case_pages.updateUpdate a case pagewrite
Misp3
  • strangebee_thehive.misp.export_caseExport a case to an MISP serverwrite
  • strangebee_thehive.misp.get_statusGet MISP server sync statusread
  • strangebee_thehive.misp.sync_alertsTrigger an MISP event synchronizationwrite
Observable shares3
  • strangebee_thehive.observable_shares.createShare an observable with organizationswrite
  • strangebee_thehive.observable_shares.listList shares of an observableread
  • strangebee_thehive.observable_shares.remove_organisationsUnshare an observable from organizationsdestructive
Task shares3
  • strangebee_thehive.task_shares.createShare a task with organizationswrite
  • strangebee_thehive.task_shares.listList shares of a taskread
  • strangebee_thehive.task_shares.remove_organisationsUnshare a task from organizationsdestructive
User config3
  • strangebee_thehive.user_config.getGet a configuration itemread
  • strangebee_thehive.user_config.listList your configuration itemsread
  • strangebee_thehive.user_config.setSet a configuration itemwrite
Branding2
  • strangebee_thehive.branding.delete_assetDelete a branding assetdestructive
  • strangebee_thehive.branding.getGet brandingread
Describe2
  • strangebee_thehive.describe.getGet the property metadata of an entity modelread
  • strangebee_thehive.describe.listGet the property metadata of every entity modelread
Entities2
  • strangebee_thehive.entities.get_anyGet any entity by IDread
  • strangebee_thehive.entities.list_anyList alerts, cases, observables, tasks and logs togetherread
Status2
  • strangebee_thehive.status.getGet the platform statusread
  • strangebee_thehive.status.get_publicGet the public platform statusread
Admin1
  • strangebee_thehive.admin.set_log_levelSet the log level for a packagewrite
Attachments1
  • strangebee_thehive.attachments.deleteRemove a file from an organizationdestructive
Export1
  • strangebee_thehive.export.list_fieldsGET /api/v1/export/_fieldsread
Permissions1
  • strangebee_thehive.permissions.listList all permissionsread
Query1
  • strangebee_thehive.query.runPOST /api/v1/queryread
Sharing profiles1
  • strangebee_thehive.sharing_profiles.listList sharing profilesread

Questions

The StrangeBee TheHive MCP server, answered.

Is there a StrangeBee TheHive MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 339 StrangeBee TheHive actions across cases, alerts, cortex and tasks, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by StrangeBee TheHive.

What do I need to connect StrangeBee TheHive?

TheHive API key: avatar menu > Settings > API Key > Create/Reveal (Normal users), or Organization > Users > the…. Plus your host and your organisation. The free call account { op: "connections.requirements", service: "strangebee_thehive" } lists exactly what to paste.

Can an AI agent delete or change things in StrangeBee TheHive?

Only if its key allows it, and only with an explicit confirmation. 52 StrangeBee TheHive actions are destructive, including delete a user account, delete a task and delete a comment. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my StrangeBee TheHive API limit?

actionlake paces every call to the limits in the StrangeBee TheHive service file: 10 calls a second per connection. Repeated reads are answered from cache (168 StrangeBee TheHive actions can be), which never reaches StrangeBee TheHive.

What does a StrangeBee TheHive action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (339 StrangeBee TheHive actions page). Cache hits, searches, dry runs and calls StrangeBee TheHive refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which StrangeBee TheHive API does it cover?

The TheHive API v1 (OpenAPI 3.1.0, v6.0.0) at your StrangeBee TheHive instance's API base URL, which you enter when connecting. It is built from StrangeBee TheHive's documentation as read on 23 October 2026. 339 actions in 50 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my StrangeBee TheHive data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your StrangeBee TheHive credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like StrangeBee TheHive

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by StrangeBee TheHive; the name is the vendor's own. Counts are from the StrangeBee TheHive service file, version 1.0.0.

Give your agent StrangeBee TheHive today.

Connect StrangeBee TheHive freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.