Listed from the MCP registry; nobody on Odel publishes it.

HEARTH

Name: HEARTH
Author: thorcollective

@thorcollectiveMCP server · External

Search community threat hunting hypotheses by keyword, threat actor, or the log sources you have.

Threat intelligencev0.1.1MITHTML

Freeno charge per call

How to install

Runs on your machine from its package; the steps are below.

What it does

Reads
Writes
High impact

At most: only reads or looks up information.

What it costs

Free

Odel charges nothing per call. The publisher may charge for its own service.

Runs locally over stdio

This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).

npm@thorcollective/hearth-mcpv0.1.1

Run

npx -y @thorcollective/hearth-mcp

MCP client config

{
  "mcpServers": {
    "hearth": {
      "command": "npx",
      "args": [
        "-y",
        "@thorcollective/hearth-mcp"
      ]
    }
  }
}

README5 min readView on GitHub

HEARTH: Hunting Exchange and Research Threat Hub

An open-source community library of threat hunting hypotheses, powered by the PEAK framework and AI.
Built by THE THOR Collective

Explore the Database · Submit a Hunt · Report a Bug · Request a Feature

What is HEARTH?

Generating effective, timely threat hunts is hard. You're staring at logs wondering where to start, or you're reading CTI reports and thinking "someone should hunt for this" — but writing up the hypothesis takes time you don't have.

HEARTH is a community-curated library of 300+ threat hunting hypotheses that security teams can use, adapt, and build on. Submit a CTI link and our AI pipeline drafts a complete hunt hypothesis for you. Or browse what others have shared, fork what works, and contribute back.

Every hunt is categorized using the PEAK Threat Hunting Framework, giving you structured, actionable starting points — not vague ideas.

The PEAK Framework

HEARTH organizes hunts into three categories based on the PEAK framework. Each serves a different hunting approach:

🔥 Flames — Hypothesis-Driven Hunts (250+)

Classic threat hunting. You have a specific theory about adversary behavior and you go looking for evidence. "An adversary is using DLL side-loading to maintain persistence via a legitimate application."

🪵 Embers — Baselining & Exploration (30+)

Understand your environment before the bad stuff happens. Establish baselines, find anomalies, and discover what "normal" looks like so you can spot what isn't.

🔮 Alchemy — Model-Assisted Detection (25+)

Algorithmic and ML-powered approaches. Statistical analysis, clustering, and other techniques that let the data surface threats you might not think to look for.

Browse all hunts in the live database →

Contribute a Hunt

We've made contributing as frictionless as possible. Two paths:

AI-Powered CTI Submission (Recommended)

Have a great threat intel report? Paste the URL and let our AI pipeline do the work.

Open a CTI Submission →
Paste the URL and your name for attribution.
Our bot reads the report, drafts a hunt, checks for duplicates, and opens a PR for review.

Manual Hunt Submission

Already have a hypothesis? Submit it directly.

Open a Manual Submission →
Fill out the template with your hypothesis, tactic, and references.
Maintainers review and merge.

All approved submissions are credited on the Contributors Leaderboard.

Templates

Running a hunt in your own environment? Kindling/ has the working templates:

Template	Use it for
PEAK-Template.md	Planning, executing, and documenting a hunt end to end
Hunt-Review.md	Writing up findings once the hunt is done
Hunt-Template.md	The frontmatter format for submitting a hunt to HEARTH
Resources.md	Reference material and further reading

Maintainers reviewing submissions: see Review-Process.md.

Key Features

Feature	Description
Interactive Database	Searchable, filterable, sortable interface for all hunts. Find what you need fast.
Coverage Heatmap	/coverage-heatmap.html — the full MITRE ATT&CK matrix, colored by how many community hunts cover each technique. Click a cell to see the hunts (or the gap). Lives alongside the Coverage Map under the Coverage hub.
AI-Powered CTI Analysis	Submit a CTI link — Claude reads, analyzes, and drafts a complete hunt hypothesis automatically.
MITRE ATT&CK Integration	Validates technique IDs against the full Enterprise framework (691 techniques, 99% accuracy).
Duplicate Detection	AI-powered similarity analysis flags potential duplicates before they're merged, ranked by closeness with an explanation for each.
Automated Workflows	GitHub Actions manage the full submission lifecycle — from draft to PR to merge.
Review & Regeneration	Maintainers can re-roll AI-generated hunts by adding a `regenerate` label — iterate until it's right.
Contributor Leaderboard	Automated tracking of submissions. We celebrate our community.

Architecture

Hunt Storage

Markdown files in Flames/, Embers/, and Alchemy/ are the source of truth
Human-readable, version-controlled, and easy to contribute via standard Git workflows
Hunt schema: Every hunt file uses YAML frontmatter — see docs/HUNT-SCHEMA.md.

Database Index

SQLite database (database/hunts.db) provides a queryable index of every hunt
Automatically rebuilt when hunt files change
Used for reporting and ad-hoc queries. Duplicate detection reads the hunt files directly rather than this index
See database/README.md for details

CTI Extraction

Compression: Brotli, Zstandard, and Gzip
JS Rendering: Falls back to readability-lxml for JS-heavy sites
Formats: HTML, PDF, and DOCX
Smart Parsing: Extracts article content from common blog/report structures

MITRE ATT&CK Integration

691 Techniques: Complete Enterprise ATT&CK framework indexed
Real-time Validation: Technique IDs validated against MITRE data
Confidence Scoring: Multi-tier fallback (MITRE → table → keywords)

Automation Workflows

Duplicate detection via vector embeddings
AI-powered hunt generation from CTI sources
Automatic database maintenance on file changes
TTP diversity analysis and content validation

Further reading: Database Architecture · Optimization Guide · Testing Guide · Scripts · Workflows

Built With

Frontend: HTML5, CSS3, Vanilla JavaScript
Backend & Automation: GitHub Actions, Python, Claude (Anthropic) API, OpenAI API, SQLite
Hosting: GitHub Pages

Configuration

For maintainers and self-hosted instances, HEARTH is configured via environment variables.

Variable	Description	Default	Required
`AI_PROVIDER`	AI provider (`claude` or `openai`)	`claude`	No
`ANTHROPIC_API_KEY`	API key for Claude	-	Yes (for Claude)
`OPENAI_API_KEY`	API key for OpenAI	-	Yes (for OpenAI)
`CLAUDE_MODEL`	Claude model version	`claude-sonnet-5`	No

GitHub Actions setup: Set ANTHROPIC_API_KEY, OPENAI_API_KEY, and HEARTH_TOKEN as Repository Secrets. Optionally set AI_PROVIDER and CLAUDE_MODEL as Repository Variables.

Troubleshooting

"Failed to retrieve or process content from the URL"