ThreatLocker
Connects Claude to the ThreatLocker Portal API for managing zero-trust endpoint security through conversation. You get tools for listing and inspecting computers, handling approval requests, searching audit logs, and managing organizations across your ThreatLocker deployment. The server uses a stateless architecture with domain-based navigation, so you call threatlocker_navigate first to access specific tool sets like computers or approvals. Ships with both stdio mode for single-tenant setups and gateway mode for multi-tenant environments where credentials come through HTTP headers. Reach for this when you want to query computer checkin status, review pending approvals, or pull audit histories without clicking through the ThreatLocker console.
- GitHub stars
- 1
- tools
- 17
- auth
- Secret needed
- transport
- STDIO
- env vars
- 5
- last updated
- Aug 20, 2026
Tools
17 toolsPublic tool metadata for what this MCP can expose to an agent.
threatlocker_navigateNavigate to a domain to see available tools
Navigate to a domain to see available tools
No parameter schema in public metadata yet.
threatlocker_statusCheck API connection status and available domains
Check API connection status and available domains
No parameter schema in public metadata yet.
threatlocker_computers_listList computers with filters (search, group, pagination)
List computers with filters (search, group, pagination)
No parameter schema in public metadata yet.
threatlocker_computers_getGet detailed computer information
Get detailed computer information
No parameter schema in public metadata yet.
threatlocker_computers_get_checkinsGet computer checkin history
Get computer checkin history
No parameter schema in public metadata yet.
threatlocker_computer_groups_listList computer groups with filters
List computer groups with filters
No parameter schema in public metadata yet.
threatlocker_computer_groups_dropdownGet computer groups for dropdown selection
Get computer groups for dropdown selection
No parameter schema in public metadata yet.
threatlocker_approvals_listList approval requests with status filters
List approval requests with status filters
No parameter schema in public metadata yet.
threatlocker_approvals_getGet detailed approval request information
Get detailed approval request information
No parameter schema in public metadata yet.
threatlocker_approvals_pending_countGet count of pending approvals
Get count of pending approvals
No parameter schema in public metadata yet.
threatlocker_approvals_get_permit_applicationGet permit application details
Get permit application details
No parameter schema in public metadata yet.
threatlocker_audit_searchSearch audit log entries with filters
Search audit log entries with filters
No parameter schema in public metadata yet.
threatlocker_audit_getGet one audit log entry by eActionLogId from a search row (deprecated alias: actionLogId)
Get one audit log entry by eActionLogId from a search row (deprecated alias: actionLogId)
No parameter schema in public metadata yet.
threatlocker_audit_file_historyGet audit history for a file. Requires fullPath and either hostname or computerId
Get audit history for a file. Requires fullPath and either hostname or computerId
No parameter schema in public metadata yet.
threatlocker_organizations_list_childrenList child organizations
List child organizations
No parameter schema in public metadata yet.
threatlocker_organizations_get_auth_keyGet organization auth key
Get organization auth key
No parameter schema in public metadata yet.
threatlocker_organizations_for_move_computersGet organizations for computer moves
Get organizations for computer moves
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
THREATLOCKER_API_KEY*secretThreatLocker API key
THREATLOCKER_ORGANIZATION_ID*ThreatLocker organization ID
MCP_TRANSPORTdefault: stdioTransport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
AUTH_MODEdefault: envCredential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
LOG_LEVELdefault: infoLog verbosity: debug, info, warn, error
Readme
ThreatLocker MCP Server
A Model Context Protocol (MCP) server that provides AI assistants with access to the ThreatLocker Portal API. Manage computers, approval requests, audit logs, and organizations through natural language interactions.
Features
- Stateless Architecture: No session state required, fresh connections per request
- Decision-Tree Navigation: Navigate domains with
threatlocker_navigate - Gateway Mode: Multi-tenant support via HTTP headers
- Elicitation Support: Interactive prompts for missing parameters
- Comprehensive Error Handling: Detailed error messages and logging
- Docker Support: Production-ready containerization
Tools
Navigation
threatlocker_navigate- Navigate to a domain to see available toolsthreatlocker_status- Check API connection status and available domains
Computers
threatlocker_computers_list- List computers with filters (search, group, pagination)threatlocker_computers_get- Get detailed computer informationthreatlocker_computers_get_checkins- Get computer checkin history
Details
- Repository
- github.com/wyre-technology/threatlocker-mcp
- Website
- github.com/wyre-technology/threatlocker-mcp
- Package
ghcr.io/wyre-technology/threatlocker-mcp:v1.3.6- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active