Investigating denied executions across the action log is exactly the kind of question an assistant is good at, and generated-from-spec coverage means the whole portal is reachable rather than a handpicked subset. It also disables endpoint protection, approves requests and moves computers between orgs, and the author marks it beta — so point it at a lab tenant with a minimum-permission API key, and leave your client's tool-call approval switched on.
A community-built server generated from ThreatLocker's published OpenAPI 3.0 spec, covering the Portal API across single-org and parent/child tenants. It is not an official ThreatLocker product and is not affiliated with ThreatLocker, Inc.
- Computers — 9 tools: search, get and edit details, enable or disable protection, maintenance mode, baseline rescan, move between orgs
- Approval requests — 11 tools: search, count pending, permit details, approve, reject, ignore, take ownership, storage approvals
- Action log — 4 tools including `action_log_get_by_parameters_v2`, file history and download details
- Maintenance mode — 4 tools: schedule by computer, `maintenance_mode_insert`, end by ID, reschedule the end time
- Applications (5), tags (3), system audit (2), computer groups (2), policy, online devices and reports
- `list_organizations` enumerates every org GUID the API key can target
- Every tool takes `organization_id`, and `override_organization_id` where a tenant needs both headers
- Request bodies are typed Pydantic models — 63 generated from the spec — so arguments are schema-validated
Install with `uv tool install threatlocker-mcp` or pip. Three environment variables are required: `THREATLOCKER_API_KEY` from Portal → Modules → API, `THREATLOCKER_ORG_ID` for the default org GUID, and `THREATLOCKER_BASE_URL` — which must use the same subdomain letter your portal shows. `THREATLOCKER_TIMEOUT` defaults to 30 seconds. Runs on stdio by default; `--transport http --port 8765` binds to `127.0.0.1`, and needs authentication added before it faces anything wider. Version 0.2.2, MIT licensed.
One command plus a key — uv tool install threatlocker-mcp, then supply credentials