ThreatLocker MCP — Claude Code MCP server: portal API access
Gives your agent access to the ThreatLocker portal API, including write operations that read-only tools skip. Useful if you manage several tenants at once.
Open on GitHubWhat ThreatLocker MCP does
ThreatLocker MCP is an unofficial server from Servosity that exposes ThreatLocker portal features to your agent. It handles writes as well as reads, and keeps a cross-tenant offline store that other ThreatLocker tools do not offer. It runs on your laptop and needs no coding.
The installer drops two binaries into your user bin path: threatlocker-cli and threatlocker-mcp. Claude, Codex and Cowork pick up the skill from SKILL.md in that directory. Claude Desktop users can grab the .mcpb bundle and open it through Settings > Extensions. To confirm the install, run threatlocker-cli --version.
One hard limit: do not start HTTP mode (--transport http) in this build, not even on localhost. It has no password, it accepts connections on every network interface, and the MCP tools can change data using your credentials. Stick to the default stdio transport, and tear down any tunnel you set up for a remote agent. That is why ChatGPT, Microsoft 365 Copilot and the Gemini app are on hold — each needs the remote path.
What it helps with
- inspect ThreatLocker portal settings from inside your agent
- push changes through the API when read-only tools fall short
- keep data from several tenants in one offline store
- install an MCP server without hand-editing JSON
- verify that the CLI and server landed correctly
Example prompts for the agent
- Show me what
threatlocker-cli --helpreturns - Check the version with
threatlocker-cli --version
How to install ThreatLocker MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ThreatLocker MCP
How do I install ThreatLocker MCP in Claude Code?
Add the marketplace first, then install the plugin: /plugin marketplace add Servosity/msp-skills, followed by /plugin install threatlocker@msp-skills. It works right away, no directory listing needed.
What does ThreatLocker MCP do?
It exposes ThreatLocker portal API features to your agent, write operations included, and keeps an offline store across tenants. It installs locally and requires no code.
Why is HTTP mode off limits?
In this build it asks for no password and accepts connections on every network interface, while the MCP tools can change data with your credentials. Use stdio instead; remote agents like ChatGPT and Copilot Studio wait for the connector to be reprinted.
