ThreatLocker MCP

threatlocker-mcp is a Model Context Protocol server that connects AI assistants such as Claude Desktop and Claude Code with the ThreatLocker Portal API. 44 tools — generated directly from the official OpenAPI 3.0 spec — give your AI assistant programmatic access to computers, approvals, action logs, tags, maintenance mode, reports, and more, across single-org and parent/child tenant setups.

Tools

All request bodies are typed Pydantic models (63 generated from the spec), so the AI assistant receives full schema validation and autocomplete. The wire format preserves the original camelCase field names expected by the API.

Related MCP server: mcp-ninjaone

Quick Start

Install

Using uv (recommended)

uv tool install threatlocker-mcp

Using pip

pip install threatlocker-mcp

Configure

Set the required environment variables (or place them in a .env file in the directory where you launch the server):

export THREATLOCKER_API_KEY="your-api-key"
export THREATLOCKER_ORG_ID="your-default-org-guid"
export THREATLOCKER_BASE_URL="https://portalapi.h.threatlocker.com"

Run

threatlocker-mcp

By default the server runs in stdio mode (the transport MCP clients like Claude Desktop expect). For HTTP transport:

threatlocker-mcp --transport http --port 8765

Editor Integration

Claude Desktop with uvx (recommended)

Add the following block to your Claude Desktop configuration file:

• Windows: %APPDATA%\Claude\claude_desktop_config.json

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "threatlocker": {
      "command": "uvx",
      "args": [
        "threatlocker-mcp"
      ],
      "env": {
        "THREATLOCKER_API_KEY": "your-api-key",
        "THREATLOCKER_ORG_ID": "your-default-org-guid",
        "THREATLOCKER_BASE_URL": "https://portalapi.h.threatlocker.com"
      }
    }
  }
}

Fully quit Claude Desktop (tray icon → Quit on Windows; ⌘Q on macOS), then reopen it. uvx resolves and caches the package on first launch; subsequent launches are nearly instant.

Pinning to a specific version

"args": ["threatlocker-mcp@0.2.1"]

Forcing a refresh

"args": ["--refresh", "threatlocker-mcp"]

Multi-Organization Usage

Every tool accepts two optional parameters for targeting specific organizations in a parent/child tenant hierarchy:

• organization_id — overrides the ManagedOrganizationId request header. When omitted, THREATLOCKER_ORG_ID is used.

• override_organization_id — sets the OverrideManagedOrganizationId header for scenarios that require both headers simultaneously.

Finding child org GUIDs: Call list_organizations first — optionally with search_text to filter by display name — to enumerate every org this API key can target. Org GUIDs can also be read from the portal URL while switched into each child org.

Example Prompts

Investigate denied activity:

"Search the action log for any denied executions on hostname SRV-DB-01 in the last 24 hours."

→ Calls action_log_get_by_parameters_v2 with an ActionLogParamsDto.

Review pending approvals:

"Show me all pending approval requests for the Cloud Services org."

→ Calls approval_request_get_by_parameters with organization_id=<cloud-svc-guid>.

Approve a request:

"Approve request abc-123 at computer scope with the note 'verified vendor'."

→ Calls approval_request_permit_application with a PermitApplicationDto.

Schedule maintenance:

"Put workstation WS-FINANCE-04 into maintenance mode for the next two hours."

→ Calls maintenance_mode_insert with a MaintenanceModeInsertDto.

Manage tags:

"Add corporate-vpn.example.com to the existing 'Corporate VPN' network tag."

→ Calls tag_get_dropdown_options_by_organization_id and tag_update.

License

MIT — see LICENSE.