wyre-technology/threatlocker-mcp

ThreatLocker MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to the ThreatLocker Portal API. Manage computers, approval requests, audit logs, and organizations through natural language interactions.

Features

• Stateless Architecture: No session state required, fresh connections per request
• Decision-Tree Navigation: Navigate domains with threatlocker_navigate
• Gateway Mode: Multi-tenant support via HTTP headers
• Elicitation Support: Interactive prompts for missing parameters
• Comprehensive Error Handling: Detailed error messages and logging
• Docker Support: Production-ready containerization

Tools

Navigation

• threatlocker_navigate - Navigate to a domain to see available tools
• threatlocker_status - Check API connection status and available domains

Computers

• threatlocker_computers_list - List computers with filters (search, group, pagination)
• threatlocker_computers_get - Get detailed computer information
• threatlocker_computers_get_checkins - Get computer checkin history

Computer Groups

• threatlocker_computer_groups_list - List computer groups with filters
• threatlocker_computer_groups_dropdown - Get computer groups for dropdown selection

Approval Requests

• threatlocker_approvals_list - List approval requests with status filters
• threatlocker_approvals_get - Get detailed approval request information
• threatlocker_approvals_pending_count - Get count of pending approvals
• threatlocker_approvals_get_permit_application - Get permit application details

Audit Log

• threatlocker_audit_search - Search audit log entries with filters
• threatlocker_audit_get - Get detailed audit log entry
• threatlocker_audit_file_history - Get audit history for specific file

Organizations

• threatlocker_organizations_list_children - List child organizations
• threatlocker_organizations_get_auth_key - Get organization auth key
• `threatlo