# ThreatLocker MCP

Gives your agent access to the ThreatLocker portal API, including write operations that read-only tools skip. Useful if you manage several tenants at once.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 62
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/threatlocker
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/threatlocker-mcp

## What it does

ThreatLocker MCP is an unofficial server from Servosity that exposes ThreatLocker portal features to your agent. It handles writes as well as reads, and keeps a cross-tenant offline store that other ThreatLocker tools do not offer. It runs on your laptop and needs no coding.

The installer drops two binaries into your user bin path: `threatlocker-cli` and `threatlocker-mcp`. Claude, Codex and Cowork pick up the skill from `SKILL.md` in that directory. Claude Desktop users can grab the `.mcpb` bundle and open it through Settings > Extensions. To confirm the install, run `threatlocker-cli --version`.

One hard limit: do not start HTTP mode (`--transport http`) in this build, not even on localhost. It has no password, it accepts connections on every network interface, and the MCP tools can change data using your credentials. Stick to the default stdio transport, and tear down any tunnel you set up for a remote agent. That is why ChatGPT, Microsoft 365 Copilot and the Gemini app are on hold — each needs the remote path.

## Requirements
- Environment variables: `PRINTING_PRESS_CLIENT_PROFILE`, `THREATLOCKER_API_KEY`, `THREATLOCKER_BASE_URL`, `THREATLOCKER_ORG_ID`, `THREATLOCKER_USER_AGENT` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- inspect ThreatLocker portal settings from inside your agent
- push changes through the API when read-only tools fall short
- keep data from several tenants in one offline store
- install an MCP server without hand-editing JSON
- verify that the CLI and server landed correctly

## Example prompts
- Show me what `threatlocker-cli --help` returns
- Check the version with `threatlocker-cli --version`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 32 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md