action_log_get_all_for_file_history_v2LABSCO SUMMARY
Full portal power, and that includes the destructive half.
Investigating denied executions across the action log is exactly the kind of question an assistant is good at, and generated-from-spec coverage means the whole portal is reachable rather than a handpicked subset. It also disables endpoint protection, approves requests and moves computers between orgs, and the author marks it beta — so point it at a lab tenant with a minimum-permission API key, and leave your client's tool-call approval switched on.
What it is
A community-built server generated from ThreatLocker's published OpenAPI 3.0 spec, covering the Portal API across single-org and parent/child tenants. It is not an official ThreatLocker product and is not affiliated with ThreatLocker, Inc.
What you get
- Computers — 9 tools: search, get and edit details, enable or disable protection, maintenance mode, baseline rescan, move between orgs
- Approval requests — 11 tools: search, count pending, permit details, approve, reject, ignore, take ownership, storage approvals
- Action log — 4 tools including
action_log_get_by_parameters_v2, file history and download details - Maintenance mode — 4 tools: schedule by computer,
maintenance_mode_insert, end by ID, reschedule the end time - Applications (5), tags (3), system audit (2), computer groups (2), policy, online devices and reports
list_organizationsenumerates every org GUID the API key can target- Every tool takes
organization_id, andoverride_organization_idwhere a tenant needs both headers - Request bodies are typed Pydantic models — 63 generated from the spec — so arguments are schema-validated
Requirements
Install with uv tool install threatlocker-mcp or pip. Three environment variables are required: THREATLOCKER_API_KEY from Portal → Modules → API, THREATLOCKER_ORG_ID for the default org GUID, and THREATLOCKER_BASE_URL — which must use the same subdomain letter your portal shows. THREATLOCKER_TIMEOUT defaults to 30 seconds. Runs on stdio by default; --transport http --port 8765 binds to 127.0.0.1, and needs authentication added before it faces anything wider. Version 0.2.2, MIT licensed.
Setup effort
One command plus a key — uv tool install threatlocker-mcp, then supply credentials
USE CASES
01
Investigating what was denied on a machine
Search the action log by hostname and time window, then pull file history for anything suspicious.
02
Working through the approval queue
Count what is pending for an org, read the permit details, then approve or reject with a note.
03
Putting a workstation into maintenance for a change window
Insert a maintenance window on that computer and reschedule or end it when the work finishes.
44 tools
Listed in project docs. Your client may show a different list.
action_log_get_by_id_v2action_log_get_by_parameters_v2action_log_get_file_download_details_by_idapplication_get_by_idapplication_get_for_application_optionsapplication_get_for_maintenance_modeapplication_get_matching_listapplication_get_research_details_by_idapproval_request_get_by_idapproval_request_get_by_parametersapproval_request_get_countapproval_request_get_file_download_details_by_idapproval_request_get_permit_application_by_idapproval_request_get_storage_approval_by_idapproval_request_permit_applicationapproval_request_permit_storage_approvalapproval_request_update_for_ignoreapproval_request_update_for_rejectapproval_request_update_for_take_ownershipcomputer_disable_protectioncomputer_enable_protectioncomputer_get_by_all_parameterscomputer_get_for_edit_by_idcomputer_group_get_dropdown_by_organization_idcomputer_group_get_group_and_computercomputer_move_to_other_organizationcomputer_update_baseline_rescancomputer_update_for_editcomputer_update_maintenance_modecomputer_update_to_finish_maintenance_modelist_organizationsmaintenance_mode_end_by_idmaintenance_mode_get_by_computer_idmaintenance_mode_insertmaintenance_mode_update_end_date_time_for_specific_dateonline_devices_get_by_parameterspolicy_get_by_idreport_get_by_organization_idsystem_audit_get_by_parameterssystem_audit_get_for_health_centertag_get_by_idtag_get_dropdown_options_by_organization_idtag_updateBEFORE YOU INSTALL
What to know first
Tools you get
44 tools named in the project's documentation.
Requires
- uvx on PATH
- THREATLOCKER_API_KEY in your environment
- THREATLOCKER_ORG_ID in your environment
- THREATLOCKER_BASE_URL in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
uv tool install threatlocker-mcpMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"threatlocker": {
"command": "uvx",
"args": [
"threatlocker-mcp"
],
"env": {
"THREATLOCKER_API_KEY": "<YOUR_THREATLOCKER_API_KEY>",
"THREATLOCKER_ORG_ID": "<YOUR_THREATLOCKER_ORG_ID>",
"THREATLOCKER_BASE_URL": "https://portalapi.h.threatlocker.com"
}
}
}
}
