ThreatLocker MCP
Give your coding agent full ThreatLocker Portal API coverage including write paths missing from read-only tooling.
Overview
ThreatLocker MCP is a MCP server for the Ship phase that connects agents to the ThreatLocker Portal API including write operations.
What is this MCP server?
- Covers ThreatLocker Portal API features including write operations beyond read-only tools
- THREATLOCKER_API_KEY required for stdio MCPB server v0.1.0
- Servosity-packaged threatlocker-mcp.mcpb for Claude Code–class hosts
- Suited to policy queries, approvals, and controlled changes via natural language
- Security-focused MCP rather than generic endpoint scripting
- Version 0.1.0 with stdio MCPB distribution
- One required secret environment variable: THREATLOCKER_API_KEY
- Released as threatlocker-mcp.mcpb with published fileSha256
Community signal: 1 GitHub stars.
What problem does it solve?
Read-only ThreatLocker helpers leave you in the portal for policy changes, which is slow and hard to script from your dev environment.
Who is it for?
Operators on ThreatLocker who need agent-assisted policy review and controlled write automation.
Skip if: Indie app developers with no ThreatLocker tenant or anyone seeking passive vulnerability scanning only.
What do I get? / Deliverables
After setup, your agent can invoke full Portal API reads and writes with credentials isolated in MCP env secrets.
- MCP tool surface for ThreatLocker Portal API reads and writes
- Stdio MCP server package v0.1.0 installable via mcpb
- Agent-ready security operations without custom Portal scripts
Recommended MCP Servers
Journey fit
How it compares
ThreatLocker Portal MCP with writes, not a generic malware scanner or passive code-review skill.
Common Questions / FAQ
Who is ThreatLocker MCP for?
It is for admins and small MSPs using ThreatLocker who want MCP-driven Portal API access including changes agents cannot do with read-only tools.
When should I use ThreatLocker MCP?
Use it during security hardening and Ship prep when you must query rings and apply Portal writes from Claude Code or Cursor with audit discipline.
How do I add ThreatLocker MCP to my agent?
Install the ThreatLocker mcpb release, enable stdio, and configure THREATLOCKER_API_KEY as a secret in your MCP host.