ThreatDown MCP — Claude Code MCP server: features and setup
Connects your agent to the ThreatDown OneView API to monitor endpoints. Generates license reports and triggers remote scanning or host isolation.
Open on GitHubWhat ThreatDown MCP does
This server connects coding agents directly to ThreatDown OneView. The assistant can query host health across multiple sites, flag inactive machines, and audit seat allocations. In addition to read-only diagnostics, it handles operational tasks such as network isolation, remote malware scans, and quarantine restoration.
The setup script places threatdown-cli and threatdown-mcp into your user binary directory. In Claude Code, you can also load it as a plugin from the Servosity/msp-skills marketplace catalog.
Avoid running the server with --transport http. Current builds lack payload limits and request timeout safeguards. Stick strictly to standard stdio transport, because MCP actions execute changes directly with your OneView credentials.
What it helps with
- audit stale endpoints across managed customer sites
- generate seat allocation and license usage reports
- isolate an infected workstation from the network
- trigger remote malware scans on selected endpoints
Example prompts for the agent
- Check all OneView sites and show endpoints that have been inactive this month
- Isolate the compromised laptop from the network using ThreatDown
- Generate a seat count report across our customer accounts
How to install ThreatDown MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ThreatDown MCP
How do I install ThreatDown MCP in Claude Code?
Register the repository with /plugin marketplace add Servosity/msp-skills, then install the component using /plugin install threatdown@msp-skills. Alternatively, run the installer shell script provided in the repository.
What does ThreatDown MCP do?
It gives your assistant access to the ThreatDown OneView API. It lets the agent inspect workstation health, audit seat licenses, and trigger remedial actions like endpoint isolation or scans.
Why is HTTP transport discouraged for this server?
The HTTP mode checks tokens but currently lacks request size and timeout limits. Until updated builds arrive, the author recommends sticking to the default stdio transport to keep your credentials safe.
