threatlocker-mcp MCP Server

[!IMPORTANT] Unofficial project. This is an independent, community-built MCP server developed against ThreatLocker's published API documentation. It is not an official ThreatLocker product and is…

Local serverstdio

What is the threatlocker-mcp Server?

threatlocker-mcp is an MCP project maintained in the space-c0wboy/threatlocker-mcp repository. The maintainer describes its purpose as “[!IMPORTANT] Unofficial project. This is an independent, community-built MCP server developed against ThreatLocker's published API documentation. It is not an official ThreatLocker product and is…”. Read the project documentation for the complete scope.

Installation

The documented pypi package is threatlocker-mcp. The configuration below comes from the maintainer’s example; adapt its paths and account values to your environment.

Configuration values

The example declares THREATLOCKER_API_KEY, THREATLOCKER_ORG_ID, THREATLOCKER_BASE_URL. Secret-looking values have been replaced with placeholders. Required and optional labels are shown only when the documentation states them.

Source

Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
AreaCount
Computers9
Application5
Tag3
Policy1
Reports1
Organization1

How to install the threatlocker-mcp Server

{
  "mcpServers": {
    "threatlocker": {
      "command": "uvx",
      "args": [
        "threatlocker-mcp"
      ],
      "env": {
        "THREATLOCKER_API_KEY": "YOUR_THREATLOCKER_API_KEY",
        "THREATLOCKER_ORG_ID": "your-default-org-guid",
        "THREATLOCKER_BASE_URL": "https://portalapi.h.threatlocker.com"
      }
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

VariableDescriptionRequired
THREATLOCKER_API_KEYDeclared in the maintainer’s client configuration.Check documentation
THREATLOCKER_ORG_IDDeclared in the maintainer’s client configuration.Check documentation
THREATLOCKER_BASE_URLDeclared in the maintainer’s client configuration.Check documentation