Connect Huntbase to Claude
The Huntbase connector lets Claude work with your Huntbase organization. From a conversation in claude.ai, Claude Desktop, Cowork or Claude Code you can look up indicators, triage insights, read hunts and endpoint activity, check exposure to known-exploited vulnerabilities and brief stakeholders. For deeper questions, Claude hands the work to Scout, your investigation partner in Huntbase. Scout investigates on your data inside Huntbase, and Claude sees Scout's summary and links.
Claude only proposes changes. A hunt step, a watch list addition or an endpoint response action that Claude suggests lands in Huntbase as a proposal, and a person with the right access approves it there. Claude can't approve anything, and it can't isolate, delete or run commands on endpoints.
This feature is currently rolling out and may not be enabled for your organization.
Before you start
- An organization admin must turn on the connector for your organization. It is off by default. See Turn on the connector.
- You need a Huntbase account in that organization. Claude acts as you: it never sees more than you can see in Huntbase.
Turn on the connector
Org owners and admins only.
- Go to Settings › [Organization] › Claude.
- Turn on Claude connector.
- Optionally turn on Allow TLP:AMBER (see What Claude can see).
Everyone else in the organization can open the page and see whether the connector is on.
Turning the connector off stops Claude from reading your organization's data within about a minute. Proposals Claude already made stay in Huntbase for people to decide.
What Claude can see
Anything a tool returns leaves Huntbase and is processed by Claude. Huntbase applies these rules to every result, whoever asks:
| Content | Returned to Claude? |
|---|---|
| Anything, while the connector is off | No. Claude can only tell you who you are and that the connector is off. |
| TLP:CLEAR and TLP:GREEN | Yes |
| TLP:AMBER | Only when an admin has turned on Allow TLP:AMBER. Otherwise redacted. |
| TLP:AMBER+STRICT and TLP:RED | Never. Always redacted. |
Redacted text is replaced with a marker such as [REDACTED TLP:RED], and the result tells Claude that something was withheld. Claude then tells you to open Huntbase for the full detail. Results are kept short: summaries, counts and links rather than raw telemetry.
Every tool call is recorded in your organization's audit log: who called which tool, when, from which connection, the outcome and what was redacted. The values you asked about are stored only as a fingerprint, not in plain text.
Connect from claude.ai or Claude Desktop
Free, Pro and Max plans
- In Claude, open Settings › Connectors and choose Add custom connector.
- Name it Huntbase and enter the URL
https://app.huntbase.io/api/v1/agents/mcp. - Select Connect. Claude opens Huntbase sign-in. Sign in, and if you belong to more than one organization, pick the one Claude should work in.
- Back in Claude, turn on the Huntbase connector in a conversation from the tools menu.
Team and Enterprise plans
An Owner adds the connector once for the whole Claude organization:
- In Claude, open Admin settings › Connectors and add a custom connector with the URL
https://app.huntbase.io/api/v1/agents/mcp. - Each member then opens Settings › Connectors, finds Huntbase and selects Connect to sign in with their own Huntbase account.
Each person connects with their own account, so each sees only what they can see in Huntbase.
Connect from Claude Code
With the Huntbase plugin
The plugin adds the connector plus skills for common analyst jobs.
claude plugin marketplace add huntbase-io/scout-claude-app
claude plugin install huntbase@huntbase
Run /mcp in Claude Code and sign in to huntbase.
| Skill | Ask something like |
|---|---|
triage-alert | "Triage the new high-severity insights." |
triage-indicator | "Have we seen 203.0.113.7 or these hashes?" |
hunt-from-report | "Here's a vendor advisory. Are we affected? Plan a hunt." |
check-kev-exposure | "Which known-exploited CVEs affect us?" |
summarise-hunt | "Write up the lateral movement hunt for our CISO." |
follow-up-approvals | "What's waiting on me in Huntbase?" |
With a personal API key
If your organization doesn't sign in to Claude with Huntbase yet, use a personal API key.
-
Create a personal key under Settings › [Organization] › API keys (see API keys). Under What it can do, set Claude connector to Use, and give View on the areas Claude should read, for example Hunts, Detections, Intelligence and Telemetry. Service keys can't be used with Claude.
-
Install the API-key plugin and enter the key when asked:
claude plugin marketplace add huntbase-io/scout-claude-app
claude plugin install huntbase-api-key@huntbaseClaude Code keeps the key in your system's credential store.
-
Or add the server yourself without the plugin:
claude mcp add --transport http huntbase https://app.huntbase.io/api/v1/agents/mcp \
--header "Authorization: Bearer hb_pat_…"
A key acts as you, in the one organization it was created in, and never has more access than you. Its levels narrow what Claude can do further: a tool needs the matching level on the key. Revoke the key in Huntbase to cut access at once.
Tools
| Tool | What it does |
|---|---|
huntbase_whoami | Who you are, which organization, and whether the connector is on |
huntbase_check_job | Progress and results of longer work, such as a Scout investigation |
huntbase_search | One search across hunts, insights, entities and saved queries |
huntbase_list_insights, huntbase_get_insight | Recent insights and detections, and one insight in detail |
huntbase_list_hunts, huntbase_get_hunt | Your organization's hunts, and one hunt's hypothesis, steps and findings |
huntbase_get_entity | One host, user, IP, domain or process: profile and timeline summary |
huntbase_search_telemetry | A short telemetry search: at most 7 days and 50 rows, summarised |
huntbase_lookup_indicators | Check up to 50 IPs, domains, URLs or hashes against your intelligence and sightings |
huntbase_search_threats | Threats, actors and campaigns in your intelligence |
huntbase_get_intel_briefing | The latest intelligence briefing and items needing attention, including known-exploited vulnerabilities on your software |
huntbase_find_endpoints, huntbase_get_endpoint | Find endpoints, and one endpoint's health and recent activity |
huntbase_get_endpoint_activity | Recorded process, network and file activity on one endpoint. It never opens a live session. |
huntbase_ask_scout | Hand a question to Scout. Scout's chat appears in Huntbase, and Claude reports its answer. |
huntbase_get_scout_conversation | Summary of a Scout chat |
huntbase_list_pending_approvals | Proposals waiting on you, with links to decide in Huntbase |
huntbase_show_hunt_card | An interactive hunt or verdict card in the conversation |
huntbase_propose_hunt_step | Propose a step in a hunt. It appears as a proposed cell. |
huntbase_propose_watchlist_addition | Propose adding indicators to a watch list |
huntbase_propose_endpoint_action | Propose a response action on an endpoint, as a proposed cell in a hunt |
Scout investigations started from Claude use your organization's AI credits like any other Scout chat.
Approvals stay in Huntbase
Every propose tool creates a proposal and returns a link to it. Nothing runs until a person approves it in Huntbase, with the same checks as a proposal from Scout or a teammate: who may approve, your organization's approval settings and, for endpoints, the fleet's response policy. Open the link, or find the proposal under Needs you. See Approvals and Needs you.
Links from Claude open Huntbase in the right organization.
Troubleshooting
| What you see | What to do |
|---|---|
| Claude says the connector is off for your organization | Ask an org admin to turn on Claude connector in Settings › [Organization] › Claude. |
| Claude asks you to choose an organization | You belong to more than one. Reconnect and pick one, or, with an API key, use a key created in the organization you want. |
| 401 or Claude asks you to sign in again | Your sign-in expired or the key was revoked or expired. Reconnect, or create a new key. |
| 403, insufficient scope | The API key doesn't have Claude connector: Use, or it is a service key. Use a personal key with that level. |
| A tool says you don't have access | The key or your account lacks the level that tool needs, for example Telemetry: View. |
Parts of a result read [REDACTED TLP:…] | That content is TLP:AMBER, AMBER+STRICT or RED. See What Claude can see. |
| That hunt / insight wasn't found | It doesn't exist, or you can't see it. Huntbase doesn't say which. |
| A Scout question takes a while | Scout's work runs as a job. Claude checks back on its own; follow the Scout chat link to watch it in Huntbase. |
| Claude Code shows two Huntbase servers | You installed both plugins. In /mcp, disable the one you don't use. |
Next steps
- Chatting with Scout — what Scout does with the questions Claude hands it
- Approvals and Needs you — deciding the proposals Claude makes
- API keys — creating a key for Claude Code