Server data from the Official MCP Registry
MCP server for ThreatLocker — zero-trust endpoint protection, allowlisting, and policies.
MCP server for ThreatLocker — zero-trust endpoint protection, allowlisting, and policies.
The ThreatLocker MCP server implements proper credential handling with support for both stdio and HTTP gateway modes. However, there are moderate-severity security concerns around credential injection in gateway mode, missing input validation on user-controlled parameters, and insufficient error handling that could leak sensitive information. The permissions (env_vars, network_http) align appropriately with the server's purpose as a developer tool interfacing with the ThreatLocker API. Supply chain analysis found 5 known vulnerabilities in dependencies (1 critical, 3 high severity).
7 files analyzed · 12 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: THREATLOCKER_API_KEY
Environment variable: THREATLOCKER_ORGANIZATION_ID
Environment variable: MCP_TRANSPORT
Environment variable: AUTH_MODE
Environment variable: LOG_LEVEL
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-wyre-technology-threatlocker-mcp": {
"env": {
"AUTH_MODE": "your-auth-mode-here",
"LOG_LEVEL": "your-log-level-here",
"MCP_TRANSPORT": "your-mcp-transport-here",
"THREATLOCKER_API_KEY": "your-threatlocker-api-key-here",
"THREATLOCKER_ORGANIZATION_ID": "your-threatlocker-organization-id-here"
},
"args": [
"-y",
"threatlocker-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
A Model Context Protocol (MCP) server that provides AI assistants with access to the ThreatLocker Portal API. Manage computers, approval requests, audit logs, and organizations through natural language interactions.
threatlocker_navigatethreatlocker_navigate - Navigate to a domain to see available toolsthreatlocker_status - Check API connection status and available domainsthreatlocker_computers_list - List computers with filters (search, group, pagination)threatlocker_computers_get - Get detailed computer informationthreatlocker_computers_get_checkins - Get computer checkin historythreatlocker_computer_groups_list - List computer groups with filtersthreatlocker_computer_groups_dropdown - Get computer groups for dropdown selectionthreatlocker_approvals_list - List approval requests with status filtersthreatlocker_approvals_get - Get detailed approval request informationthreatlocker_approvals_pending_count - Get count of pending approvalsthreatlocker_approvals_get_permit_application - Get permit application detailsthreatlocker_audit_search - Search audit log entries with filtersthreatlocker_audit_get - Get detailed audit log entrythreatlocker_audit_file_history - Get audit history for specific filethreatlocker_organizations_list_children - List child organizationsthreatlocker_organizations_get_auth_key - Get organization auth keythreatlocker_organizations_for_move_computers - Get organizations for computer movesTHREATLOCKER_API_KEY=your_api_key_here
THREATLOCKER_ORGANIZATION_ID=your_org_id_here
MCP_TRANSPORT=stdio
AUTH_MODE=gateway
MCP_TRANSPORT=http
MCP_HTTP_PORT=8080
MCP_HTTP_HOST=0.0.0.0
When running in gateway mode, include these headers with each request:
X-Threatlocker-Api-Key: Your ThreatLocker API keyX-Threatlocker-Organization-Id: Your organization IDLOG_LEVEL=debug|info|warn|error # Default: info
git clone https://github.com/wyre-technology/threatlocker-mcp.git
cd threatlocker-mcp
npm install
cp .env.example .env
# Edit .env with your ThreatLocker credentials
npm run build
npm start
# Or for development with hot reload:
npm run dev
# Stdio mode
echo '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}' | npm start
# HTTP mode
curl http://localhost:8080/health
# Pull and run latest image
docker compose up -d
# Or build locally
docker compose -f docker-compose.dev.yml up --build
# Gateway mode (recommended)
docker run -d \
--name threatlocker-mcp \
-p 8080:8080 \
-e AUTH_MODE=gateway \
ghcr.io/wyre-technology/threatlocker-mcp:latest
# Stdio mode
docker run -d \
--name threatlocker-mcp \
-e THREATLOCKER_API_KEY=your_key \
-e THREATLOCKER_ORGANIZATION_ID=your_org_id \
-e MCP_TRANSPORT=stdio \
ghcr.io/wyre-technology/threatlocker-mcp:latest
src/
├── domains/ # Domain-specific handlers
│ ├── computers.ts
│ ├── computer_groups.ts
│ ├── approval_requests.ts
│ ├── audit_log.ts
│ ├── organizations.ts
│ ├── navigation.ts
│ └── index.ts
├── utils/ # Utilities
│ ├── client.ts # ThreatLocker API client
│ ├── logger.ts # Structured logging
│ ├── types.ts # TypeScript types
│ ├── server-ref.ts # Server reference for elicitation
│ └── elicitation.ts # Interactive prompts
├── server.ts # MCP server creation
├── index.ts # Stdio transport entry
└── http.ts # HTTP transport entry
getTools() and handleCall()Apache-2.0 - see LICENSE for details.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.