Best for
- Security teams wanting persistent memory and structure for threat hunting
- Analysts using Claude Code, GitHub Copilot, or Cursor
- Organizations wiring existing PEAK/TaHiTI processes into AI workflows
A
Agentic Threat Hunting Framework MCP Server
Community
Memory, structure, and agency for your threat hunting program
- Category
- Other #71 of 230
- Stars
- ★ 392 Very popular
- Transport
- stdio (local process) · SSE · Streamable HTTP
- Runtime
- Python 3.8+
- Credentials
- No credential needed
- License
- MIT
- Last commit
60FMRS · C
ATHF is a MIT-licensed threat hunting framework maintained by Nebulock Inc., created by Sydney Marrone. Its MCP server (since v0.11.0) exposes 17 tools covering hunt management, semantic search, ATT&CK coverage, research, and hypothesis generation. The default stdio transport is the safest; the sse/streamable-http transports are unauthenticated and bound to loopback, with the README explicitly advising caution and an authenticating proxy.
Strongest · Setup experience 13/20 Weakest · Reliability 9/20
Why each score
- Reliability 9/20
- Static review sees only the README; no repository source, no server manifest, no tests and no CI configuration were supplied, so the `athf-mcp` entry point, the claimed 17 tools, and the stdio/sse init handshake cannot be verified against real behavior. Positives: the README states two concrete launch paths (`athf mcp serve --workspace` and the standalone `athf-mcp` with cwd/ATHF_WORKSPACE auto-detection), making the happy path plausible, and it documents a hardcoded ATT&CK v14 fallback when `mitreattack-python` is absent, showing deliberate degradation of an optional dependency. Deductions: no committed tests, no CI evidence, no way to check the Python 3.8-3.13 matrix or the semantic-search / LLM-agent code paths; error handling, retries, timeouts and diagnosable failure modes are entirely undisclosed. With the static ceiling of 12 and high uncertainty, scored 9.
- Security and permissions 13/20
- No red line triggered: no malware, credential theft, covert exfiltration, unconfirmed irreversible actions, or fabricated maintainer identity; install snippets contain no real tokens. Strongest positive evidence is self-disclosure: the README states that `sse`/`streamable-http` bind to 127.0.0.1 and are unauthenticated, warns that every tool reads the whole workspace and some invoke LLM agents at the user's expense, and recommends an authenticating proxy, while the default stdio transport opens no socket at all — a clear least-exposure default and honest data-flow/side-effect disclosure. Deductions: the MCP server ships no authentication or authorization layer of its own, relying on bind address plus an external proxy; tools have blanket workspace read/write with no per-directory or per-tool privilege granularity; LLM agent invocations (hypothesis-generator) consume user credits with no confirmation or quota control; credential storage, log redaction and audit trail are undocumented. Main risks are visible but permissions, confirmation and scoping are incomplete, placing it in the 10-14 band: 13.
- Maintenance 12/20
- MIT license, 370 stars and only 4 open issues; the README shows active evolution through v0.11.0 (MCP server, ATT&CK data management) with PyPI release and version badges, indicating a release cadence and versioning scheme. Deductions: no evidence of commit history, release notes, issue-response latency, dependency-update policy, or a security-response channel such as SECURITY.md; ownership appears to be a single credited author rather than an organization with governance or long-term support commitments. Active but with clear governance and versioning-evidence gaps: 12.
- Documentation 13/20
- Reasonably layered docs: three install paths (PyPI, source, pure Markdown), a full CLI command reference, explanations of the LOCK pattern and the five-level maturity model, an MCP client config JSON example, and links to CLI_REFERENCE, MCP_CATALOG and quickstart guides, with parameterized example commands (--workspace, --technique, --research). Limitations are partly disclosed too: ATT&CK fallback behavior, optional extras ([mcp], [attack]), and unauthenticated sse. Deductions: no per-tool parameter schemas or return shapes, no error codes or troubleshooting section, no cost/usage estimation, no explanation of semantic-search indexing or data boundaries; much of the MCP detail is external links that cannot be cross-checked against implementation from this static view. Usable but with hidden assumptions and troubleshooting gaps: 13.
- Setup experience 13/20
- Install path is clear: `pip install`, then `athf init`; MCP requires `pip install 'agentic-threat-hunting-framework[mcp]'`, with both `athf mcp serve --workspace` and a standalone `athf-mcp` entry point; the README supplies a complete `~/.claude/mcp-servers.json` snippet (command plus ATHF_WORKSPACE env) that a mainstream client can copy directly; a zero-install pure-Markdown path also lowers the barrier. Deductions: no Copilot/Cursor config examples, no Windows/macOS/Linux differences, no guidance for failed workspace init or path-detection conflicts, and no evidence of a successful live start. Between clear and manually fragile; with the static setup ceiling of 15, scored 13.
Static review · not runListed 2026-09-10
Read the FMRS scoring method →Fit and risk
What it can accessReads local filesWrites / deletes local filesUses the network
Not for
- Enterprises needing an authenticated multi-user remote service out of the box
- Users expecting a replacement for their SIEM/EDR platform
- Environments without local workspace file access
Required permissions
- Read the entire ATHF workspace
- Write/update hunt and research records
- Some tools invoke LLM agents (at your expense)
- Bind a local port when using sse or streamable-http transports
Risks and side effects
- The sse and streamable-http transports bind to 127.0.0.1 and are unauthenticated
- Every tool reads your whole workspace, risking exposure of sensitive hunt data
- Some tools invoke LLM agents at your expense
- A routable interface is bound only when --host is passed, and then an authenticating proxy is required
Setup
Before you start
Runtime：Python 3.8+
Other optional settings (1)
ATHF_WORKSPACE
Path to your ATHF hunts workspace; athf-mcp also auto-detects the workspace from the current working directory, so it is optional.
- Install MCP dependencies: pip install 'agentic-threat-hunting-framework[mcp]'.
- Start the MCP server: athf mcp serve --workspace /path/to/hunts.
- Configure in ~/.claude/mcp-servers.json: {"athf":{"command":"athf-mcp","env":{"ATHF_WORKSPACE":"/path/to/your/hunts"}}}. The standalone athf-mcp entry point auto-detects your workspace from cwd or the ATHF_WORKSPACE env var; use athf mcp serve --workspace /path for explicit paths.
.mcp.json
{"athf":{"command":"athf-mcp","env":{"ATHF_WORKSPACE":"/path/to/your/hunts"}}}
Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.
.vscode/mcp.json
{
"athf": {
"command": "athf-mcp",
"env": {
"ATHF_WORKSPACE": "/path/to/your/hunts"
}
}
}
Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).
Check that it works
After installing 'agentic-threat-hunting-framework[mcp]' and starting athf-mcp, the client's tool list should show the server's 17 exposed tools covering hunt management, semantic search, ATT&CK coverage, research, investigations, and hypothesis generation.
Troubleshooting
- Confirm the [mcp] optional dependency is installed
- Check that ATHF_WORKSPACE or --workspace points to the correct path
- The default stdio transport opens no socket; for sse/streamable-http verify port binding and proxy setup
- Confirm the athf-mcp executable is on PATH
- If ATT&CK metadata is missing, install 'agentic-threat-hunting-framework[attack]' and run athf attack update
Things to try
Once connected, you can ask your AI assistant things like:
- Search my past hunts for kerberoasting
- Show the MITRE ATT&CK coverage of my hunt repository
- Look up ATT&CK technique metadata for T1003.001
- Generate a new hunt hypothesis from recent threat intel
Use cases
Let AI assistants read and recall documented LOCK hunts
Run semantic and full-text search across an existing hunt library
Query MITRE ATT&CK coverage and technique metadata
Generate AI-powered hunting hypotheses from threat intel
Manage research documents and investigations
Supported clients
Claude Code
GitHub Copilot
Cursor
Listed from the project's documentation, not tested by this site.
Overview
The Agentic Threat Hunting Framework (ATHF) is the memory and automation layer for threat hunting programs. It is a markdown-based framework that documents hunts using the LOCK pattern (Learn → Observe → Check → Keep) and maintains a searchable repository of past investigations, enabling AI assistants to reference your environment and previous work. ATHF works with any SIEM/EDR platform and any hunting methodology (PEAK, TaHiTI, or your own). Since v0.11.0 it ships an MCP server that exposes hunt management, semantic search, ATT&CK coverage, research, investigations, and AI-powered hypothesis generation directly to AI coding assistants.
Similar servers
Hevy MCP
77 · B
Manage your Hevy workout data from AI assistants via MCP.
Firecrawl MCP Server
75 · B
Firecrawl's official MCP server for web search, scraping, and structured extraction for AI agents
BioMCP
75 · B
One binary. One grammar. Evidence from the biomedical sources you already trust.
Compartment
75 · B
Encrypted, fully offline long-term memory for AI agents
Source revision 0ffe4db2b56d Data synced 2026-10-19 Read the FMRS scoring method