# Huntress MCP

Connects AI agents to the Huntress security platform and maintains a local SQLite cache. It helps managed service providers audit threats and agent coverage.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/huntress
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/huntress-mcp

## What it does

This server links your coding agent to Huntress endpoints. Instead of relying solely on remote queries, it creates a local SQLite mirror on your machine. That allows the model to aggregate fleet-wide incident logs, endpoint coverage status, and billing metrics without sluggish single-item calls.

Under the hood, the server delegates tasks to the companion `huntress-cli` binary. Keep execution strictly on the stdio transport. Running HTTP mode is dangerous right now because this build lacks request size caps and execution timeouts.

## Requirements
- Environment variables: `PRINTING_PRESS_CLIENT_PROFILE`, `HUNTRESS_API_KEY`, `HUNTRESS_API_SECRET`, `HUNTRESS_BASE_URL`, `HUNTRESS_USER_AGENT`, `HUNTRESS_MCP_HTTP_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- inspect active fleet incidents using the local SQLite mirror
- check endpoint protection coverage across client environments
- query customer billing metrics through the companion CLI
- investigate security alerts directly inside agent sessions

## Example prompts
- Summarize all active security incidents from the local SQLite database
- Check which hosts lack Huntress protection across my client fleet
- Generate a billing breakdown for protected endpoints

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md