Huntress MCP — Claude Code MCP server: what it does, how to install
Connects AI agents to the Huntress security platform and maintains a local SQLite cache. It helps managed service providers audit threats and agent coverage.
Open on GitHubWhat Huntress MCP does
This server links your coding agent to Huntress endpoints. Instead of relying solely on remote queries, it creates a local SQLite mirror on your machine. That allows the model to aggregate fleet-wide incident logs, endpoint coverage status, and billing metrics without sluggish single-item calls.
Under the hood, the server delegates tasks to the companion huntress-cli binary. Keep execution strictly on the stdio transport. Running HTTP mode is dangerous right now because this build lacks request size caps and execution timeouts.
What it helps with
- inspect active fleet incidents using the local SQLite mirror
- check endpoint protection coverage across client environments
- query customer billing metrics through the companion CLI
- investigate security alerts directly inside agent sessions
Example prompts for the agent
- Summarize all active security incidents from the local SQLite database
- Check which hosts lack Huntress protection across my client fleet
- Generate a billing breakdown for protected endpoints
How to install Huntress MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Huntress MCP
How do I install Huntress MCP in Claude Code?
Register the marketplace via /plugin marketplace add Servosity/msp-skills and install the package using /plugin install huntress@msp-skills. You can also run the installer script via bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/huntress/install.sh).
What does Huntress MCP do?
It connects your agent to Huntress API endpoints and mirrors fleet data into a local SQLite database. That enables quick rollups for incidents, coverage audits, and billing.
Why should HTTP transport be avoided?
The HTTP connector currently lacks safeguards for payload sizes and query timeouts. Using the local stdio transport avoids unconstrained remote execution.
