---
title: "StrangeBee TheHive MCP server for AI agents - actionlake"
description: "Give Claude 339 StrangeBee TheHive actions through one MCP server: cases, alerts, cortex. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/strangebee-thehive
updated: 2026-10-23
---

Connectors · Identity & security

# StrangeBee TheHive MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to StrangeBee TheHive and the rest of your systems. It gives your agent 339 StrangeBee TheHive actions (174 reads, 113 writes and 52 that wait for a confirmation) and holds the StrangeBee TheHive credential itself, so the agent never does. It paces StrangeBee TheHive's limits and records every call.

[Connect StrangeBee TheHive free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "strangebee_thehive.users.list",
  intent: "check which StrangeBee TheHive account is connected"
}
# List users · read · 1 upstream call
```

- 339 actions in one signed file
- 174 read look, never change
- 113 write create and update
- 52 wait for a yes destructive, confirmed first

Set up

## Connect StrangeBee TheHive in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect StrangeBee TheHive.
   Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `api_key` TheHive API key: avatar menu > Settings > API Key > Create/Reveal (Normal users), or Organization > Users > the…
   - `host` Where your StrangeBee TheHive lives: your host
   - `organisation` Your StrangeBee TheHive organisation
   ```
   account { op: "connections.requirements", service: "strangebee_thehive" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "strangebee_thehive.users.list" }
   # list users · read · 1 upstream call
   check { action: "strangebee_thehive.users.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

StrangeBee TheHive at a glance

**Sign-in**

Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`api_key`

**Setup fields**

`host` `organisation`

**Limits we pace to**

10 calls a second, per connection

**API covered**

TheHive API v1 (OpenAPI 3.1.0, v6.0.0), at your StrangeBee TheHive instance's API base URL, which you enter when connecting

**Built from**

StrangeBee TheHive's documentation, read 23 October 2026[docs.strangebee.com](https://docs.strangebee.com/thehive/api-docs/docs.yaml) [docs.strangebee.com](https://docs.strangebee.com/thehive/api-docs/)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

168 of 174 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

7, so ask can line StrangeBee TheHive up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in StrangeBee TheHive.

339 actions in 50 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **174** read look, never change
- **113** write create and update
- **52** destructive wait for a confirmation

1. ### Cases
   37
   23 read · 10 write · 4 destructive
   List cases · List a case's comments · Create a case · Get a case
2. ### Alerts
   25
   13 read · 9 write · 3 destructive
   List alerts · Get an alert · Create an alert · Update an alert
3. ### Cortex
   20
   14 read · 5 write · 1 destructive
   Run responders in bulk · Create an analyzer template · List Cortex responder actions · List analyzer report templates
4. ### Tasks
   18
   12 read · 5 write · 1 destructive
   List tasks · Create a task in a case · Get a task · Update a task
5. ### Users
   15
   7 read · 5 write · 3 destructive
   List users · Create a user account · Get a user account · Update a user account
6. ### Observables
   14
   9 read · 4 write · 1 destructive
   Add an observable to an alert · Add an observable to a case · List observables · List an observable's attachments
7. ### Email intake
   11
   5 read · 5 write · 1 destructive
   Add a mailbox configuration · Complete Google Workspace OAuth 2.0 authorization · Get the email intake module configuration · List mailbox folders
8. ### Organisations
   11
   6 read · 4 write · 1 destructive
   List organisations · List an organisation's users · Create an organization · List an organisation's alerts

**42 more areas · 188 actions**

- Case shares **9**
- Functions **9**
- Procedures **9**
- Case report templates **8**
- Case templates **8**
- Task logs **8**
- Catalogs **7**
- Taxonomies **7**
- Alert feeders **6**
- Comments **6**
- Custom fields **6**
- Dashboards **6**
- Page templates **6**
- Pages **6**
- Alert statuses **5**
- Case links **5**
- Case statuses **5**
- Custom events **5**
- Licenses **5**
- Observable types **5**
- Patterns **5**
- Profiles **5**
- Case reports **4**
- Tags **4**
- Views **4**
- Audit **3**
- Auth **3**
- Case pages **3**
- Misp **3**
- Observable shares **3**
- Task shares **3**
- User config **3**
- Branding **2**
- Describe **2**
- Entities **2**
- Status **2**
- Admin **1**
- Attachments **1**
- Export **1**
- Permissions **1**
- Query **1**
- Sharing profiles **1**

Top actions

## The StrangeBee TheHive API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 31 of StrangeBee TheHive's 31 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `strangebee_thehive.users.list` List users | List users. | read | `identity.user.list` 474 connectors |
| `strangebee_thehive.users.create` Create a user account | Create a user account. | write | `identity.user.create` 262 connectors |
| `strangebee_thehive.tasks.list` List tasks | List tasks. | read | `work.task.list` 122 connectors |
| `strangebee_thehive.users.delete` Delete a user account | Delete a user account. | destructive | `identity.user.delete` 253 connectors |
| `strangebee_thehive.alerts.list` List alerts | List alerts. | read | `security.alert.list` 22 connectors |
| `strangebee_thehive.cases.list` List cases | List cases. | read | `security.incident.list` 17 connectors |
| `strangebee_thehive.tasks.create` Create a task in a case | Create a task in a case. | write | `work.task.create` 127 connectors |
| `strangebee_thehive.tags.list` List custom tags | List custom tags. | read | `crm.tag.list` 65 connectors |
| `strangebee_thehive.users.me` Get current user info | Get current user info. | read | `identity.current_user.get` 307 connectors |
| `strangebee_thehive.audit.list_flow` Get the audit trail of an object | Get the audit trail of an object. | read | `security.audit_log.list` 69 connectors |
| `strangebee_thehive.cases.list_comments` List a case's comments | List a case's comments. | read | `security.incident_note.list` 9 connectors |
| `strangebee_thehive.cases.create` Create a case | Create a case. | write | `security.incident.create` 8 connectors |

Try it

## Prompts to paste into Claude.

Each one names the StrangeBee TheHive actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Which StrangeBee TheHive tasks are overdue, and who owns each one?
   calls `strangebee_thehive.tasks.list`
2. Write write
   Create a user account in StrangeBee TheHive. Show me exactly what you will send before you save it.
   calls `strangebee_thehive.users.create`

Governance for StrangeBee TheHive

## Destructive actions wait for a yes.

52 StrangeBee TheHive actions are destructive. The first 10:

- Delete a user account `strangebee_thehive.users.delete`
- Delete a task `strangebee_thehive.tasks.delete`
- Delete a comment `strangebee_thehive.comments.delete`
- Delete a case `strangebee_thehive.cases.delete`
- Delete a tag `strangebee_thehive.tags.delete`
- Delete an alert `strangebee_thehive.alerts.delete`
- Lock a user account `strangebee_thehive.users.lock`
- Delete multiple alerts `strangebee_thehive.alerts.bulk_delete`
- Unlink an alert from a case `strangebee_thehive.cases.unlink_alert`
- Delete an observable `strangebee_thehive.observables.delete`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do strangebee_thehive.users.delete confirm_policy: **human**

Delete a user account?

**intent:** the user asked me to delete a user account

run suspended · waiting for a named person · key _strangebee-thehive-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "strangebee-thehive-agent",
  allowed_actions: ["strangebee_thehive.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "strangebee_thehive.users.delete", approver: "lead@example.com" },
    { match: "strangebee_thehive.tasks.delete", approver: "lead@example.com" },
    { match: "strangebee_thehive.comments.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to StrangeBee TheHive only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What StrangeBee TheHive costs on actionlake.

Every StrangeBee TheHive action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call StrangeBee TheHive refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 339 StrangeBee TheHive actions
- 339 actions page each page of a long list is one call
- 168 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every StrangeBee TheHive action.

339 actions by area: the id your agent calls, what it does, and its effect.

**Cases 37**

- `strangebee_thehive.cases.bulk_apply_case_template` Apply a case template to existing cases write
- `strangebee_thehive.cases.bulk_set_access` Set the access mode of multiple cases write
- `strangebee_thehive.cases.bulk_update` Update multiple cases write
- `strangebee_thehive.cases.change_owner` Change the owner organization of a case write
- `strangebee_thehive.cases.count` Count cases read
- `strangebee_thehive.cases.create` Create a case write
- `strangebee_thehive.cases.deduplicate_observables` Deduplicate observables in a case write
- `strangebee_thehive.cases.delete` Delete a case destructive
- `strangebee_thehive.cases.delete_attachment` Remove an attachment from a case destructive
- `strangebee_thehive.cases.get` Get a case read
- `strangebee_thehive.cases.get_timeline` Get the timeline of a case read
- `strangebee_thehive.cases.list` List cases read
- `strangebee_thehive.cases.list_alerts` List alerts merged into a case read
- `strangebee_thehive.cases.list_all_comments` List comments on a case and its merged alerts read
- `strangebee_thehive.cases.list_assignable_users` List users assignable to a case read
- `strangebee_thehive.cases.list_attachments` List a case's attachments read
- `strangebee_thehive.cases.list_comments` List a case's comments read
- `strangebee_thehive.cases.list_custom_events` List a case's custom timeline events read
- `strangebee_thehive.cases.list_observables` List a case's observables read
- `strangebee_thehive.cases.list_organisations` List organisations a case is shared with read
- `strangebee_thehive.cases.list_pages` List a case's pages read
- `strangebee_thehive.cases.list_procedures` List a case's procedures (TTPs) read
- `strangebee_thehive.cases.list_reports` List a case's reports read
- `strangebee_thehive.cases.list_responder_actions` List Cortex responder executions on a case read
- `strangebee_thehive.cases.list_shares` List a case's sharing configurations read
- `strangebee_thehive.cases.list_similar_alerts` List alerts sharing observables with a case read
- `strangebee_thehive.cases.list_similar_cases` List cases sharing observables with a case read
- `strangebee_thehive.cases.list_similar_legacy` List similar cases read
- `strangebee_thehive.cases.list_similar_observables` List observables shared with another case or alert read
- `strangebee_thehive.cases.list_task_groups` List a case's task group names read
- `strangebee_thehive.cases.list_tasks` List a case's tasks read
- `strangebee_thehive.cases.merge` Merge cases into a new case write
- `strangebee_thehive.cases.remove_custom_field` Remove a custom field from a case destructive
- `strangebee_thehive.cases.set_access` Set the access mode of a case write
- `strangebee_thehive.cases.unlink_alert` Unlink an alert from a case destructive
- `strangebee_thehive.cases.update` Update a case write
- `strangebee_thehive.cases.update_attachment` Update a case attachment write

**Alerts 25**

- `strangebee_thehive.alerts.bulk_delete` Delete multiple alerts destructive
- `strangebee_thehive.alerts.bulk_merge_into_case` Merge multiple alerts into a case write
- `strangebee_thehive.alerts.bulk_update` Update multiple alerts write
- `strangebee_thehive.alerts.count` Count alerts read
- `strangebee_thehive.alerts.create` Create an alert write
- `strangebee_thehive.alerts.create_case` Create a case from an alert write
- `strangebee_thehive.alerts.delete` Delete an alert destructive
- `strangebee_thehive.alerts.delete_attachment` Remove an attachment from an alert destructive
- `strangebee_thehive.alerts.follow` Follow an alert write
- `strangebee_thehive.alerts.get` Get an alert read
- `strangebee_thehive.alerts.get_case` Get the case an alert was merged into read
- `strangebee_thehive.alerts.import_into_case` Import alert observables and procedures into a case write
- `strangebee_thehive.alerts.list` List alerts read
- `strangebee_thehive.alerts.list_assignable_users` List users assignable to an alert read
- `strangebee_thehive.alerts.list_attachments` List an alert's attachments read
- `strangebee_thehive.alerts.list_comments` List an alert's comments read
- `strangebee_thehive.alerts.list_observables` List an alert's observables read
- `strangebee_thehive.alerts.list_procedures` List an alert's procedures (TTPs) read
- `strangebee_thehive.alerts.list_responder_actions` List Cortex responder executions on an alert read
- `strangebee_thehive.alerts.list_similar_alerts` List alerts sharing observables with an alert read
- `strangebee_thehive.alerts.list_similar_cases` List cases sharing observables with an alert read
- `strangebee_thehive.alerts.list_similar_observables` List observables shared with another alert or case read
- `strangebee_thehive.alerts.merge_into_case` Merge an alert into an existing case write
- `strangebee_thehive.alerts.unfollow` Unfollow an alert write
- `strangebee_thehive.alerts.update` Update an alert write

**Cortex 20**

- `strangebee_thehive.cortex.bulk_run_responders` Run responders in bulk write
- `strangebee_thehive.cortex.count_responder_executions` Count responder executions for a case or alert read
- `strangebee_thehive.cortex.create_analyzer_template` Create an analyzer template write
- `strangebee_thehive.cortex.delete_analyzer_template` Delete an analyzer template destructive
- `strangebee_thehive.cortex.get_action` Get a Cortex responder action read
- `strangebee_thehive.cortex.get_analyzer` Get an analyzer read
- `strangebee_thehive.cortex.get_analyzer_template` Get an analyzer report template read
- `strangebee_thehive.cortex.get_job` Get a Cortex job read
- `strangebee_thehive.cortex.list_actions` List Cortex responder actions read
- `strangebee_thehive.cortex.list_analyzer_templates` List analyzer report templates read
- `strangebee_thehive.cortex.list_analyzers` List available analyzers read
- `strangebee_thehive.cortex.list_analyzers_by_type` List analyzers by observable data type read
- `strangebee_thehive.cortex.list_job_report_observables` List observables produced by a Cortex analyzer report read
- `strangebee_thehive.cortex.list_jobs` List Cortex analysis jobs read
- `strangebee_thehive.cortex.list_responder_executions` List responder executions for a case or alert read
- `strangebee_thehive.cortex.list_responders_by_type` List responders available for an entity type read
- `strangebee_thehive.cortex.list_responders_for_entity` List responders available for an entity read
- `strangebee_thehive.cortex.run_analyzer` Run an analyzer on an observable write
- `strangebee_thehive.cortex.run_responder` Run a responder write
- `strangebee_thehive.cortex.update_analyzer_template` Update an analyzer template write

**Tasks 18**

- `strangebee_thehive.tasks.bulk_update` Update multiple tasks write
- `strangebee_thehive.tasks.count` Count tasks read
- `strangebee_thehive.tasks.create` Create a task in a case write
- `strangebee_thehive.tasks.delete` Delete a task destructive
- `strangebee_thehive.tasks.get` Get a task read
- `strangebee_thehive.tasks.get_action_required` Check action required for a task read
- `strangebee_thehive.tasks.list` List tasks read
- `strangebee_thehive.tasks.list_assignable_users` List users assignable to a task read
- `strangebee_thehive.tasks.list_in_cases` List tasks linked to cases read
- `strangebee_thehive.tasks.list_logs` List a task's logs read
- `strangebee_thehive.tasks.list_mine` List tasks assigned to me read
- `strangebee_thehive.tasks.list_organisations` List organisations a task is shared with read
- `strangebee_thehive.tasks.list_responder_actions` List Cortex responder executions on a task read
- `strangebee_thehive.tasks.list_shares` List a task's sharing configurations read
- `strangebee_thehive.tasks.list_waiting` List waiting tasks read
- `strangebee_thehive.tasks.set_action_done` Set action done on a task write
- `strangebee_thehive.tasks.set_action_required` Set action required on a task write
- `strangebee_thehive.tasks.update` Update a task write

**Users 15**

- `strangebee_thehive.users.change_password` Change a user account password write
- `strangebee_thehive.users.create` Create a user account write
- `strangebee_thehive.users.delete` Delete a user account destructive
- `strangebee_thehive.users.get` Get a user account read
- `strangebee_thehive.users.list` List users read
- `strangebee_thehive.users.list_alerts` List alerts assigned to a user read
- `strangebee_thehive.users.list_cases` List cases assigned to a user read
- `strangebee_thehive.users.list_tasks` List tasks assigned to a user read
- `strangebee_thehive.users.list_visible` List users visible across organisations read
- `strangebee_thehive.users.lock` Lock a user account destructive
- `strangebee_thehive.users.me` Get current user info read
- `strangebee_thehive.users.revoke_api_key` Revoke a user API key destructive
- `strangebee_thehive.users.set_organisations` Set user account organizations write
- `strangebee_thehive.users.set_password` Set a user account password write
- `strangebee_thehive.users.update` Update a user account write

**Observables 14**

- `strangebee_thehive.observables.bulk_update` Update multiple observables write
- `strangebee_thehive.observables.count` Count observables read
- `strangebee_thehive.observables.create_in_alert` Add an observable to an alert write
- `strangebee_thehive.observables.create_in_case` Add an observable to a case write
- `strangebee_thehive.observables.delete` Delete an observable destructive
- `strangebee_thehive.observables.get` Get an observable read
- `strangebee_thehive.observables.list` List observables read
- `strangebee_thehive.observables.list_attachments` List an observable's attachments read
- `strangebee_thehive.observables.list_jobs` List Cortex analysis jobs run on an observable read
- `strangebee_thehive.observables.list_organisations` List organisations an observable is shared with read
- `strangebee_thehive.observables.list_responder_actions` List Cortex responder executions on an observable read
- `strangebee_thehive.observables.list_shares` List an observable's sharing configurations read
- `strangebee_thehive.observables.list_similar` List observables similar to an observable read
- `strangebee_thehive.observables.update` Update an observable write

**Email intake 11**

- `strangebee_thehive.email_intake.create_config` Add a mailbox configuration write
- `strangebee_thehive.email_intake.delete_config` Delete a mailbox configuration destructive
- `strangebee_thehive.email_intake.exchange_authorization_code` Complete Google Workspace OAuth 2.0 authorization write
- `strangebee_thehive.email_intake.get_config` Get a mailbox configuration read
- `strangebee_thehive.email_intake.list_configs` Get the email intake module configuration read
- `strangebee_thehive.email_intake.list_folders` List mailbox folders read
- `strangebee_thehive.email_intake.list_providers` List available email intake providers read
- `strangebee_thehive.email_intake.sync` Trigger an immediate email fetch write
- `strangebee_thehive.email_intake.test_config` Test a mailbox connection read
- `strangebee_thehive.email_intake.update_config` Update a mailbox configuration write
- `strangebee_thehive.email_intake.update_settings` Update the email intake module settings write

**Organisations 11**

- `strangebee_thehive.organisations.create` Create an organization write
- `strangebee_thehive.organisations.get` Get an organization read
- `strangebee_thehive.organisations.link` Link two organizations write
- `strangebee_thehive.organisations.list` List organisations read
- `strangebee_thehive.organisations.list_alerts` List an organisation's alerts read
- `strangebee_thehive.organisations.list_case_templates` List an organisation's case templates read
- `strangebee_thehive.organisations.list_links` List organization links read
- `strangebee_thehive.organisations.list_users` List an organisation's users read
- `strangebee_thehive.organisations.set_links` Replace all links for an organization write
- `strangebee_thehive.organisations.unlink` Remove a link between two organizations destructive
- `strangebee_thehive.organisations.update` Update an organization write

**Case shares 9**

- `strangebee_thehive.case_shares.bulk_delete` Delete multiple shares destructive
- `strangebee_thehive.case_shares.create` Share a case with other organizations write
- `strangebee_thehive.case_shares.delete` Remove a share by ID destructive
- `strangebee_thehive.case_shares.get` Get a sharing configuration read
- `strangebee_thehive.case_shares.list` List shares of a case read
- `strangebee_thehive.case_shares.list_all` List sharing configurations read
- `strangebee_thehive.case_shares.remove_organisations` Unshare a case from organizations destructive
- `strangebee_thehive.case_shares.set` Set all shares for a case write
- `strangebee_thehive.case_shares.update` Update a share's permission profile write

**Functions 9**

- `strangebee_thehive.functions.create` Create a function write
- `strangebee_thehive.functions.delete` Delete a function destructive
- `strangebee_thehive.functions.get` Get a function read
- `strangebee_thehive.functions.get_context_documentation` Get context object documentation read
- `strangebee_thehive.functions.invoke` Invoke a function write
- `strangebee_thehive.functions.invoke_on_object` Invoke a function on a case or alert write
- `strangebee_thehive.functions.list` List functions read
- `strangebee_thehive.functions.test` Test a function read
- `strangebee_thehive.functions.update` Update a function write

**Procedures 9**

- `strangebee_thehive.procedures.bulk_create_in_alert` Add multiple TTPs to an alert write
- `strangebee_thehive.procedures.bulk_create_in_case` Add multiple TTPs to a case write
- `strangebee_thehive.procedures.bulk_delete` Delete multiple TTPs destructive
- `strangebee_thehive.procedures.create_in_alert` Add a TTP to an alert write
- `strangebee_thehive.procedures.create_in_case` Add a TTP to a case write
- `strangebee_thehive.procedures.delete` Delete a TTP destructive
- `strangebee_thehive.procedures.get` Get a procedure (TTP) read
- `strangebee_thehive.procedures.list` List procedures (TTPs) read
- `strangebee_thehive.procedures.update` Update a TTP write

**Case report templates 8**

- `strangebee_thehive.case_report_templates.create` Create a case report template write
- `strangebee_thehive.case_report_templates.delete` Delete a case report template destructive
- `strangebee_thehive.case_report_templates.delete_attachment` Remove an attachment from a case report template destructive
- `strangebee_thehive.case_report_templates.get` Get a case report template read
- `strangebee_thehive.case_report_templates.get_info` List available widget types and field options read
- `strangebee_thehive.case_report_templates.list` List case report templates read
- `strangebee_thehive.case_report_templates.list_attachments` List a case report template's image attachments read
- `strangebee_thehive.case_report_templates.update` Update a case report template write

**Case templates 8**

- `strangebee_thehive.case_templates.create` Create a case template write
- `strangebee_thehive.case_templates.delete` Delete a case template destructive
- `strangebee_thehive.case_templates.get` Get a case template read
- `strangebee_thehive.case_templates.link_page_templates` Link page templates to a case template write
- `strangebee_thehive.case_templates.list` List case templates read
- `strangebee_thehive.case_templates.list_page_templates` List a case template's page templates read
- `strangebee_thehive.case_templates.list_tasks` List a case template's task templates read
- `strangebee_thehive.case_templates.update` Update a case template write

**Task logs 8**

- `strangebee_thehive.task_logs.create` Create a task log write
- `strangebee_thehive.task_logs.delete` Delete a task log destructive
- `strangebee_thehive.task_logs.delete_attachment` Delete an attachment from a task log destructive
- `strangebee_thehive.task_logs.get` Get a task log read
- `strangebee_thehive.task_logs.list` List task logs read
- `strangebee_thehive.task_logs.list_attachments` List a task log's attachments read
- `strangebee_thehive.task_logs.list_responder_actions` List Cortex responder executions on a task log read
- `strangebee_thehive.task_logs.update` Update a task log write

**Catalogs 7**

- `strangebee_thehive.catalogs.create` Create an attack technique catalog write
- `strangebee_thehive.catalogs.delete` Delete an attack technique catalog destructive
- `strangebee_thehive.catalogs.get` Get an attack technique catalog read
- `strangebee_thehive.catalogs.list` List attack technique catalogs read
- `strangebee_thehive.catalogs.list_patterns` List the techniques in an attack catalog read
- `strangebee_thehive.catalogs.list_tactics` List the tactics in an attack catalog read
- `strangebee_thehive.catalogs.update` Update an attack technique catalog write

**Taxonomies 7**

- `strangebee_thehive.taxonomies.activate` Activate a taxonomy write
- `strangebee_thehive.taxonomies.create` Create a taxonomy write
- `strangebee_thehive.taxonomies.deactivate` Deactivate a taxonomy write
- `strangebee_thehive.taxonomies.delete` Delete a taxonomy destructive
- `strangebee_thehive.taxonomies.get` Get a taxonomy read
- `strangebee_thehive.taxonomies.list` List taxonomies read
- `strangebee_thehive.taxonomies.list_tags` List a taxonomy's tags read

**Alert feeders 6**

- `strangebee_thehive.alert_feeders.create` Create an alert feeder write
- `strangebee_thehive.alert_feeders.delete` Delete an alert feeder destructive
- `strangebee_thehive.alert_feeders.list` List all alert feeders read
- `strangebee_thehive.alert_feeders.run` Run an alert feeder immediately write
- `strangebee_thehive.alert_feeders.test` Test an alert feeder connection read
- `strangebee_thehive.alert_feeders.update` Update an alert feeder write

**Comments 6**

- `strangebee_thehive.comments.create_on_alert` Add a comment to an alert write
- `strangebee_thehive.comments.create_on_case` Add a comment to a case write
- `strangebee_thehive.comments.delete` Delete a comment destructive
- `strangebee_thehive.comments.get` Get a comment read
- `strangebee_thehive.comments.list` List comments read
- `strangebee_thehive.comments.update` Update a comment write

**Custom fields 6**

- `strangebee_thehive.custom_fields.create` Create a custom field write
- `strangebee_thehive.custom_fields.delete` Delete a custom field destructive
- `strangebee_thehive.custom_fields.get` Get a custom field read
- `strangebee_thehive.custom_fields.list` List custom fields read
- `strangebee_thehive.custom_fields.list_all` List all custom fields read
- `strangebee_thehive.custom_fields.update` Update a custom field write

**Dashboards 6**

- `strangebee_thehive.dashboards.change_owner` Change the owner of a dashboard write
- `strangebee_thehive.dashboards.create` Create a dashboard write
- `strangebee_thehive.dashboards.delete` Delete a dashboard destructive
- `strangebee_thehive.dashboards.get` Get a dashboard read
- `strangebee_thehive.dashboards.list` List dashboards read
- `strangebee_thehive.dashboards.update` Update a dashboard write

**Page templates 6**

- `strangebee_thehive.page_templates.create` Create a case page template write
- `strangebee_thehive.page_templates.delete` Delete a case page template destructive
- `strangebee_thehive.page_templates.get` Get a page template read
- `strangebee_thehive.page_templates.list` List page templates read
- `strangebee_thehive.page_templates.list_case_templates` List case templates that include a page template read
- `strangebee_thehive.page_templates.update` Update a case page template write

**Pages 6**

- `strangebee_thehive.pages.create` Create a Knowledge Base page write
- `strangebee_thehive.pages.delete` Delete a Knowledge Base page destructive
- `strangebee_thehive.pages.get` Get a page read
- `strangebee_thehive.pages.list` List pages read
- `strangebee_thehive.pages.list_organisation` List knowledge base pages read
- `strangebee_thehive.pages.update` Update a Knowledge Base page write

**Alert statuses 5**

- `strangebee_thehive.alert_statuses.create` Create an alert status write
- `strangebee_thehive.alert_statuses.delete` Delete an alert status destructive
- `strangebee_thehive.alert_statuses.get` Get an alert status read
- `strangebee_thehive.alert_statuses.list` List alert statuses read
- `strangebee_thehive.alert_statuses.update` Update an alert status write

**Case links 5**

- `strangebee_thehive.case_links.add_case` Link a case to another case write
- `strangebee_thehive.case_links.add_external` Link a case to an external URL write
- `strangebee_thehive.case_links.list_types` List all case link types read
- `strangebee_thehive.case_links.remove_case` Remove a link to another case destructive
- `strangebee_thehive.case_links.remove_external` Remove a link to an external URL destructive

**Case statuses 5**

- `strangebee_thehive.case_statuses.create` Create a case status write
- `strangebee_thehive.case_statuses.delete` Delete a case status destructive
- `strangebee_thehive.case_statuses.get` Get a case status read
- `strangebee_thehive.case_statuses.list` List case statuses read
- `strangebee_thehive.case_statuses.update` Update a case status write

**Custom events 5**

- `strangebee_thehive.custom_events.create` Add a custom event to a case timeline write
- `strangebee_thehive.custom_events.delete` Delete a custom event destructive
- `strangebee_thehive.custom_events.get` Get a custom timeline event read
- `strangebee_thehive.custom_events.list` List custom timeline events read
- `strangebee_thehive.custom_events.update` Update a custom event write

**Licenses 5**

- `strangebee_thehive.licenses.activate` Activate an existing license write
- `strangebee_thehive.licenses.create` Add and activate a license write
- `strangebee_thehive.licenses.get` Get a license read
- `strangebee_thehive.licenses.get_current` Get the current license status read
- `strangebee_thehive.licenses.list` List all licenses read

**Observable types 5**

- `strangebee_thehive.observable_types.create` Create an observable type write
- `strangebee_thehive.observable_types.delete` Delete an observable type destructive
- `strangebee_thehive.observable_types.get` Get an observable type read
- `strangebee_thehive.observable_types.list` List observable types read
- `strangebee_thehive.observable_types.update` Update the case sensitivity of an observable type write

**Patterns 5**

- `strangebee_thehive.patterns.delete` Delete an attack technique destructive
- `strangebee_thehive.patterns.get` Get an attack technique read
- `strangebee_thehive.patterns.import_attack` Import MITRE ATT&CK techniques write
- `strangebee_thehive.patterns.list` List attack techniques read
- `strangebee_thehive.patterns.list_for_case` List attack techniques linked to a case read

**Profiles 5**

- `strangebee_thehive.profiles.create` Create a profile write
- `strangebee_thehive.profiles.delete` Delete a profile destructive
- `strangebee_thehive.profiles.get` Get a profile read
- `strangebee_thehive.profiles.list` List profiles read
- `strangebee_thehive.profiles.update` Update a profile write

**Case reports 4**

- `strangebee_thehive.case_reports.create` Generate a case report from a template write
- `strangebee_thehive.case_reports.delete` Delete a case report destructive
- `strangebee_thehive.case_reports.get` Get a case report read
- `strangebee_thehive.case_reports.list` List case reports read

**Tags 4**

- `strangebee_thehive.tags.delete` Delete a tag destructive
- `strangebee_thehive.tags.get` Get a tag read
- `strangebee_thehive.tags.list` List custom tags read
- `strangebee_thehive.tags.update` Update a tag write

**Views 4**

- `strangebee_thehive.views.create` Create a view write
- `strangebee_thehive.views.delete` Delete a view destructive
- `strangebee_thehive.views.get` Get a view read
- `strangebee_thehive.views.update` Update a view write

**Audit 3**

- `strangebee_thehive.audit.get` Get an audit log entry read
- `strangebee_thehive.audit.list_flow` Get the audit trail of an object read
- `strangebee_thehive.audit.list_for_object` List audit logs for an object read

**Auth 3**

- `strangebee_thehive.auth.disable_own_mfa` Deactivate multifactor authentication for your account destructive
- `strangebee_thehive.auth.disable_user_mfa` Deactivate multifactor authentication for another user destructive
- `strangebee_thehive.auth.get_password_policy` Get the local authentication password policy read

**Case pages 3**

- `strangebee_thehive.case_pages.create` Create a case page write
- `strangebee_thehive.case_pages.delete` Delete a case page destructive
- `strangebee_thehive.case_pages.update` Update a case page write

**Misp 3**

- `strangebee_thehive.misp.export_case` Export a case to an MISP server write
- `strangebee_thehive.misp.get_status` Get MISP server sync status read
- `strangebee_thehive.misp.sync_alerts` Trigger an MISP event synchronization write

**Observable shares 3**

- `strangebee_thehive.observable_shares.create` Share an observable with organizations write
- `strangebee_thehive.observable_shares.list` List shares of an observable read
- `strangebee_thehive.observable_shares.remove_organisations` Unshare an observable from organizations destructive

**Task shares 3**

- `strangebee_thehive.task_shares.create` Share a task with organizations write
- `strangebee_thehive.task_shares.list` List shares of a task read
- `strangebee_thehive.task_shares.remove_organisations` Unshare a task from organizations destructive

**User config 3**

- `strangebee_thehive.user_config.get` Get a configuration item read
- `strangebee_thehive.user_config.list` List your configuration items read
- `strangebee_thehive.user_config.set` Set a configuration item write

**Branding 2**

- `strangebee_thehive.branding.delete_asset` Delete a branding asset destructive
- `strangebee_thehive.branding.get` Get branding read

**Describe 2**

- `strangebee_thehive.describe.get` Get the property metadata of an entity model read
- `strangebee_thehive.describe.list` Get the property metadata of every entity model read

**Entities 2**

- `strangebee_thehive.entities.get_any` Get any entity by ID read
- `strangebee_thehive.entities.list_any` List alerts, cases, observables, tasks and logs together read

**Status 2**

- `strangebee_thehive.status.get` Get the platform status read
- `strangebee_thehive.status.get_public` Get the public platform status read

**Admin 1**

- `strangebee_thehive.admin.set_log_level` Set the log level for a package write

**Attachments 1**

- `strangebee_thehive.attachments.delete` Remove a file from an organization destructive

**Export 1**

- `strangebee_thehive.export.list_fields` GET /api/v1/export/_fields read

**Permissions 1**

- `strangebee_thehive.permissions.list` List all permissions read

**Query 1**

- `strangebee_thehive.query.run` POST /api/v1/query read

**Sharing profiles 1**

- `strangebee_thehive.sharing_profiles.list` List sharing profiles read

Questions

## The StrangeBee TheHive MCP server, answered.

**Is there a StrangeBee TheHive MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 339 StrangeBee TheHive actions across cases, alerts, cortex and tasks, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by StrangeBee TheHive.

**What do I need to connect StrangeBee TheHive?**

TheHive API key: avatar menu > Settings > API Key > Create/Reveal (Normal users), or Organization > Users > the…. Plus your host and your organisation. The free call account { op: "connections.requirements", service: "strangebee_thehive" } lists exactly what to paste.

**Can an AI agent delete or change things in StrangeBee TheHive?**

Only if its key allows it, and only with an explicit confirmation. 52 StrangeBee TheHive actions are destructive, including delete a user account, delete a task and delete a comment. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my StrangeBee TheHive API limit?**

actionlake paces every call to the limits in the StrangeBee TheHive service file: 10 calls a second per connection. Repeated reads are answered from cache (168 StrangeBee TheHive actions can be), which never reaches StrangeBee TheHive.

**What does a StrangeBee TheHive action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (339 StrangeBee TheHive actions page). Cache hits, searches, dry runs and calls StrangeBee TheHive refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which StrangeBee TheHive API does it cover?**

The TheHive API v1 (OpenAPI 3.1.0, v6.0.0) at your StrangeBee TheHive instance's API base URL, which you enter when connecting. It is built from StrangeBee TheHive's documentation as read on 23 October 2026. 339 actions in 50 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my StrangeBee TheHive data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your StrangeBee TheHive credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like StrangeBee TheHive

Shares the most action names with

- [Sekoia.io 17](https://actionlake.com/connectors/sekoia-io)
- [Splunk SOAR 16](https://actionlake.com/connectors/splunk-soar)
- [Expel Workbench 15](https://actionlake.com/connectors/expel-workbench)
- [Torq 14](https://actionlake.com/connectors/torq)
- [GitGuardian 12](https://actionlake.com/connectors/gitguardian)
- [Trend Vision One 12](https://actionlake.com/connectors/trend-vision-one)

Joins with, on shared entities

- [Docebo 3](https://actionlake.com/connectors/docebo)
- [Odoo 3](https://actionlake.com/connectors/odoo)
- [D2L Brightspace 3](https://actionlake.com/connectors/d2l-brightspace)
- [Microsoft Dynamics 365 3](https://actionlake.com/connectors/microsoft-dynamics-365)
- [Rootly 3](https://actionlake.com/connectors/rootly)
- [ActiveCampaign 3](https://actionlake.com/connectors/activecampaign)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by StrangeBee TheHive; the name is the vendor's own. Counts are from the StrangeBee TheHive service file, version 1.0.0.

## Give your agent StrangeBee TheHive today.

[Connect StrangeBee TheHive free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/strangebee-thehive
More: https://actionlake.com/llms.txt