Best for
- Security teams wanting persistent memory and structure for threat hunting
- Analysts using Claude Code, GitHub Copilot, or Cursor
- Organizations wiring existing PEAK/TaHiTI processes into AI workflows
A
Agentic Threat Hunting Framework MCP Server
Community
Memory, structure, and agency for your threat hunting program
GitHub source repository ↗
60FMRS · C
ATHF is a MIT-licensed threat hunting framework maintained by Nebulock Inc., created by Sydney Marrone. Its MCP server (since v0.11.0) exposes 17 tools covering hunt management, semantic search, ATT&CK coverage, research, and hypothesis generation. The default stdio transport is the safest; the sse/streamable-http transports are unauthenticated and bound to loopback, with the README explicitly advising caution and an authenticating proxy.
The Agentic Threat Hunting Framework (ATHF) is the memory and automation layer for threat hunting programs. It is a markdown-based framework that documents hunts using the LOCK pattern (Learn → Observe → Check → Keep) and maintains a searchable repository of past investigations, enabling AI assistants to reference your environment and previous work. ATHF works with any SIEM/EDR platform and any hunting methodology (PEAK, TaHiTI, or your own). Since v0.11.0 it ships an MCP server that exposes hunt management, semantic search, ATT&CK coverage, research, investigations, and AI-powered hypothesis generation directly to AI coding assistants.
Setup
- Install MCP dependencies: pip install 'agentic-threat-hunting-framework[mcp]'. 2. Start the MCP server: athf mcp serve --workspace /path/to/hunts. 3. Configure in ~/.claude/mcp-servers.json: {"athf":{"command":"athf-mcp","env":{"ATHF_WORKSPACE":"/path/to/your/hunts"}}}. The standalone athf-mcp entry point auto-detects your workspace from cwd or the ATHF_WORKSPACE env var; use athf mcp serve --workspace /path for explicit paths.
claude_desktop_config.json
{"athf":{"command":"athf-mcp","env":{"ATHF_WORKSPACE":"/path/to/your/hunts"}}}
Fit and risk
Not for
- Enterprises needing an authenticated multi-user remote service out of the box
- Users expecting a replacement for their SIEM/EDR platform
- Environments without local workspace file access
Required permissions
- Read the entire ATHF workspace
- Write/update hunt and research records
- Some tools invoke LLM agents (at your expense)
- Bind a local port when using sse or streamable-http transports
Risks and side effects
- The sse and streamable-http transports bind to 127.0.0.1 and are unauthenticated
- Every tool reads your whole workspace, risking exposure of sensitive hunt data
- Some tools invoke LLM agents at your expense
- A routable interface is bound only when --host is passed, and then an authenticating proxy is required
Troubleshooting
- Confirm the [mcp] optional dependency is installed
- Check that ATHF_WORKSPACE or --workspace points to the correct path
- The default stdio transport opens no socket; for sse/streamable-http verify port binding and proxy setup
- Confirm the athf-mcp executable is on PATH
- If ATT&CK metadata is missing, install 'agentic-threat-hunting-framework[attack]' and run athf attack update
Use cases
Let AI assistants read and recall documented LOCK hunts
Run semantic and full-text search across an existing hunt library
Query MITRE ATT&CK coverage and technique metadata
Generate AI-powered hunting hypotheses from threat intel
Manage research documents and investigations
Supported clients
Claude CodeFull support
GitHub CopilotFull support
CursorFull support