Documentation
¶
Overview ¶
Package bootstrap constructs the MCP server, registers its tools, resources, and prompts, and serves them over the configured transport (stdio or http), including authentication middleware, the TheHive URL allowlist, and the credential validation cache.
Index ¶
- Constants
- Variables
- func AddPermissionsToContext(ctx context.Context, options *types.TheHiveMcpDefaultOptions) (context.Context, error)
- func AddTheHiveClientToContext(ctx context.Context) (context.Context, error)
- func AddTheHiveClientToContextWithCreds(ctx context.Context, creds *TheHiveCredentials) (context.Context, error)
- func AuthMiddleware(creds *TheHiveCredentials, permissionsConfigPath string) server.ToolHandlerMiddleware
- func CreateTheHiveClient(creds *TheHiveCredentials) (*thehive.APIClient, error)
- func CreateTheHiveConfig(creds *TheHiveCredentials) (*thehive.Configuration, error)
- func ExtractBearerToken(authHeader string) string
- func GetHTTPAuthContextFunc(options *types.TheHiveMcpDefaultOptions) func(ctx context.Context, r *http.Request) context.Context
- func GetInprocessServer(creds *TheHiveCredentials, permissionsConfigPath string) *server.MCPServer
- func GetMCPServer() *server.MCPServer
- func GetMCPServerAndRegisterTools() *server.MCPServer
- func LoadPermissions(configPath string) (*permissions.Config, error)
- func RegisterToolsToMCPServer(mcpServer *server.MCPServer)
- func SafeGetEnv(key, defaultValue string) string
- func StartHTTPServer(s *server.MCPServer, options *types.TheHiveMcpDefaultOptions) error
- func StartStdioServer(s *server.MCPServer, options *types.TheHiveMcpDefaultOptions) error
- func ValidateTheHiveClient(ctx context.Context, client *thehive.APIClient) error
- type TheHiveCredentials
- type TheHiveURLAllowlist
Constants ¶
const DefaultAuthValidationCacheTTL = 60 * time.Second
DefaultAuthValidationCacheTTL is how long a successful credential validation is cached when no TTL is configured.
Variables ¶
var ( ErrMissingHiveURL = errors.New("THEHIVE_URL environment variable is required") ErrInvalidHiveURL = errors.New("invalid TheHive URL format") ErrMissingAuthentication = errors.New("either API key or username/password must be provided") ErrInvalidAPIKey = errors.New("API key cannot be empty or 'dummy'") ErrMissingCredentials = errors.New("both username and password are required for basic auth") )
Common errors
Functions ¶
func AddPermissionsToContext ¶
func AddPermissionsToContext(ctx context.Context, options *types.TheHiveMcpDefaultOptions) (context.Context, error)
AddPermissionsToContext loads permissions and adds them to the context
func AddTheHiveClientToContext ¶
AddTheHiveClientToContext adds a TheHive client to the context using environment variables
func AddTheHiveClientToContextWithCreds ¶
func AddTheHiveClientToContextWithCreds(ctx context.Context, creds *TheHiveCredentials) (context.Context, error)
AddTheHiveClientToContextWithCreds adds a TheHive client to the context using provided credentials
func AuthMiddleware ¶
func AuthMiddleware(creds *TheHiveCredentials, permissionsConfigPath string) server.ToolHandlerMiddleware
AuthMiddleware returns a tool-handler middleware for the in-process server that injects a TheHive client built from the given trusted credentials, marks authentication as validated, and loads permissions from the given config path.
func CreateTheHiveClient ¶
func CreateTheHiveClient(creds *TheHiveCredentials) (*thehive.APIClient, error)
CreateTheHiveClient creates a TheHive client from credentials
func CreateTheHiveConfig ¶
func CreateTheHiveConfig(creds *TheHiveCredentials) (*thehive.Configuration, error)
CreateTheHiveConfig creates a TheHive configuration from credentials
func ExtractBearerToken ¶
ExtractBearerToken strips a "Bearer " prefix if present, else returns the header unchanged.
func GetHTTPAuthContextFunc ¶
func GetHTTPAuthContextFunc(options *types.TheHiveMcpDefaultOptions) func(ctx context.Context, r *http.Request) context.Context
GetHTTPAuthContextFunc returns an HTTP context function that extracts TheHive credentials and target URL from request headers (or configured fallbacks), enforces the URL allowlist, validates the credentials upstream (with caching), and stores the resulting client, permissions, and auth outcome in the context.
func GetInprocessServer ¶
func GetInprocessServer(creds *TheHiveCredentials, permissionsConfigPath string) *server.MCPServer
GetInprocessServer builds an MCP server for in-process use, wired with the in-process AuthMiddleware for the given credentials and permissions config.
func GetMCPServer ¶
GetMCPServer builds an MCP server configured with TheHiveMCP's capabilities, logging hooks, elicitation, and authentication middleware, but without any tools registered.
func GetMCPServerAndRegisterTools ¶
GetMCPServerAndRegisterTools builds an MCP server and registers all of TheHiveMCP's tools and resources on it, returning the ready-to-serve server.
func LoadPermissions ¶
func LoadPermissions(configPath string) (*permissions.Config, error)
LoadPermissions loads permissions config. "admin" grants full permissions, "read_only" or "" defaults to read-only; any other value is a file path.
func RegisterToolsToMCPServer ¶
RegisterToolsToMCPServer registers TheHiveMCP's resources and tools (search, manage, resource, and execute-automation) on the given MCP server.
func SafeGetEnv ¶
SafeGetEnv gets an environment variable with optional default value
func StartHTTPServer ¶
func StartHTTPServer(s *server.MCPServer, options *types.TheHiveMcpDefaultOptions) error
StartHTTPServer starts the HTTP server with production-ready configuration
func StartStdioServer ¶
func StartStdioServer(s *server.MCPServer, options *types.TheHiveMcpDefaultOptions) error
StartStdioServer starts the STDIO server with production-ready configuration and error handling
func ValidateTheHiveClient ¶ added in v0.3.1
ValidateTheHiveClient verifies the client's credentials by calling TheHive's current-user endpoint, returning an error if the call fails, the status is not 200, or no user info is returned.
Types ¶
type TheHiveCredentials ¶
type TheHiveCredentials struct {
URL string
APIKey string
Username string
Password string
Organisation string
}
TheHiveCredentials holds authentication information for TheHive
func LoadTheHiveCredentialsFromEnv ¶
func LoadTheHiveCredentialsFromEnv() (*TheHiveCredentials, error)
LoadTheHiveCredentialsFromEnv loads TheHive credentials from environment variables
func (*TheHiveCredentials) Validate ¶
func (c *TheHiveCredentials) Validate() error
Validate requires a valid URL plus either an API key or a username/password pair.
type TheHiveURLAllowlist ¶ added in v1.0.0
type TheHiveURLAllowlist struct {
// contains filtered or unexported fields
}
TheHiveURLAllowlist gates the TheHive base URLs clients may target via the X-TheHive-Url header. Match is exact on normalized scheme/host/port — no suffix or substring matching.
func NewTheHiveURLAllowlist ¶ added in v1.0.0
func NewTheHiveURLAllowlist(entries []string, serverURL string) (*TheHiveURLAllowlist, error)
NewTheHiveURLAllowlist builds an allowlist from entries plus the server's own URL. With neither, every request is denied. Invalid entries are rejected here so misconfiguration fails at startup rather than falling open at request time.
func (*TheHiveURLAllowlist) Allows ¶ added in v1.0.0
func (a *TheHiveURLAllowlist) Allows(rawURL string) bool
Allows reports whether the given TheHive URL exactly matches an allowlist entry. URLs that fail to parse or normalize are rejected.
Source Files