Skip to content

v1.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 08:48
· 3 commits to main since this release
v1.2.0
655c9d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

TheHiveMCP v1.2.0 — answers a model can trust, and a server that holds its ground

This release removes a set of answers that misled models (a "success" for an observable TheHive never created, a cut timeout said nowhere, a 400's cause
pointing at a decoding error), lets a client wait for analyzer jobs in one call, and closes several gaps on the HTTP and permission side: a misspelt permissions
key, a client key replaced by the server's, unbounded requests to and from the server. It is the last release before the harness rework.

⚠️ Read the Breaking changes section before upgrading — a permissions file with an unknown key no longer starts the server, a platforms filter or sort
on pattern is refused, and a non-Bearer Authorization header is no longer read as a TheHive key.

🚀 User-facing changes

  • execute-automation can wait for analyzer jobs: operation wait-for-jobs. It takes up to 20 job-ids and blocks until every one is final or
    timeout-seconds passes (default 45, at most 120, and a capped value is said), then returns each verdict, plus pendingJobIds and per-job jobErrors. Real
    analyzers take minutes; polling get-job-status cost one model turn per poll.
  • Every request to TheHive is bounded (2 minutes by default, THEHIVE_REQUEST_TIMEOUT / --thehive-request-timeout). A TheHive that stopped answering
    used to hold the tool call until the client gave up, with no error. The timeout error warns that an abandoned write may still have been applied.
  • The MITRE ATT&CK catalog is no longer fenced as untrusted data, and platforms is no longer a default pattern column (extra-columns: ["platforms"]
    brings it back).
  • List parameters are advertised as a plain array, not "null or array", which models misread and LiteLLM rejected.

Fixes

  • Creating an observable that TheHive did not create is an error, not "created successfully"; a create TheHive completed in part returns what was made and
    why each other value was refused.
  • An error's cause names TheHive's answer, not the client's decoding error; wait-for-jobs mentions retryable jobs only when there is one.
  • Responders on a task or an observable are reachable (case_task / case_artifact).
  • search-entities no longer rewrites the permission filters in place, which could crash a stdio server on two concurrent searches.
  • MCP_SERVER_ENDPOINT is documented under its real name; the basic Docker Compose file no longer reports the container as unhealthy; the arm64 image is
    built on an arm64 base.

⚠️ Breaking changes (action required)

  • A permissions file with an unknown key no longer starts the server. A typo such as entity_permission: used to be dropped silently, and what it named
    fell back to its most permissive default. The error names the key: fix it.
  • A pattern filter or sort on platforms is refused. TheHive does not index the field and returned zero rows, or ordered nothing. Read it with
    extra-columns: ["platforms"].
  • An explicit null for a list parameter (entity-ids, extra-columns, extra-data, additional-queries) is refused by a gateway that validates
    arguments against the schema. Omit the parameter instead.
  • An Authorization header in another scheme than Bearer is no longer read as a TheHive key. Send the key as Bearer or in X-TheHive-Api-Key.

🔒 Security

  • A responder blocked by name can no longer run by its ID (and an analyzer allowed by name is no longer refused by ID).
  • IDs are checked before they reach a URL path: job IDs, manage-entities IDs, the analyzer catalog's dataType, and run-responder /
    get-action-status entity types and IDs. A dot segment in a job ID reached TheHive's HTTP layer before.
  • The permissions file is parsed strictly and checked at startup (see Breaking changes).
  • With ALLOW_ENV_CREDENTIAL_FALLBACK=true, a client's own TheHive key is no longer replaced by the server's, so its calls no longer run with the service
    account's rights and under its name in the audit trail.
  • The HTTP server bounds slow and large requests: headers within 10 s, the whole request within 30 s, a 4 MiB body cap (413 above it). Long tool calls and
    SSE streams are unaffected.

📊 Evaluation evidence

Five models were evaluated against this build, with the same judge (z-ai/glm-5.3, pinned, temperature 0) and the same tests as v1.1.0: accuracy =
mcp-tools (37 checks) + workflows (3) = 40; security = 15 prompt-injection scenarios, where a pass means the agent both ignored the injection and warned
the analyst. The other candidates keep their v1.1.0 evidence. Full detail in
docs/evaluation/v1.2.0/.

Model Accuracy Security
claude-sonnet-5.5 98% (39/40) 100% (15/15)
glm-5.3-flash 98% (39/40) 100% (15/15)
muse-spark-1.3-contributor 93% (37/40) 100% (15/15)
gemma-4-26b-a4b 93% (37/40) 80% (12/15)
qwen3.8-27b 88% (35/40) 100% (15/15)

muse-spark-1.3-contributor gains 25 points of accuracy and no longer fails to answer: its v1.1.0 misses were loops on list arguments, which are now advertised
as plain arrays.

Full Changelog: v1.1.0...v1.2.0 — details in
CHANGELOG.md.

Assets 26
Loading