# ThreatDown MCP

Connects your agent to the ThreatDown OneView API to monitor endpoints. Generates license reports and triggers remote scanning or host isolation.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/threatdown
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/threatdown-mcp

## What it does

This server connects coding agents directly to ThreatDown OneView. The assistant can query host health across multiple sites, flag inactive machines, and audit seat allocations. In addition to read-only diagnostics, it handles operational tasks such as network isolation, remote malware scans, and quarantine restoration.

The setup script places `threatdown-cli` and `threatdown-mcp` into your user binary directory. In Claude Code, you can also load it as a plugin from the `Servosity/msp-skills` marketplace catalog.

Avoid running the server with `--transport http`. Current builds lack payload limits and request timeout safeguards. Stick strictly to standard `stdio` transport, because MCP actions execute changes directly with your OneView credentials.

## Requirements
- Environment variables: `THREATDOWN_CLIENT_ID`, `THREATDOWN_CLIENT_SECRET`, `THREATDOWN_OAUTH_SCOPE`, `THREATDOWN_BASE_URL`, `THREATDOWN_TOKEN_URL`, `THREATDOWN_USER_AGENT`, `THREATDOWN_MCP_READ_ONLY`, `THREATDOWN_MCP_HTTP_TOKEN`, `PRINTING_PRESS_CLIENT_PROFILE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- audit stale endpoints across managed customer sites
- generate seat allocation and license usage reports
- isolate an infected workstation from the network
- trigger remote malware scans on selected endpoints

## Example prompts
- Check all OneView sites and show endpoints that have been inactive this month
- Isolate the compromised laptop from the network using ThreatDown
- Generate a seat count report across our customer accounts

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md