{"server":{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","name":"io.github.Servosity/threatlocker-mcp","description":"Every ThreatLocker Portal API feature, plus the write operations the read-only tools lack and a","title":"ThreatLocker MCP","repository":{"url":"https://github.com/servosity/msp-skills","source":"github","subfolder":"skills/threatlocker"},"version":"0.3.13","icons":[{"src":"https://raw.githubusercontent.com/servosity/msp-skills/main/docs/assets/social/threatlocker/threatlocker-512x512.png","mimeType":"image/png","sizes":["512x512"]}],"packages":[{"registryType":"mcpb","identifier":"https://github.com/Servosity/msp-skills/releases/download/threatlocker-v0.3.13/threatlocker-mcp.mcpb","version":"0.3.13","fileSha256":"00943f07e6404e10a0e990f4a75defb28dec416f713a91dfdd9fbd242c76e8c5","transport":{"type":"stdio"},"environmentVariables":[{"description":"Set the PRINTING_PRESS_CLIENT_PROFILE credential for the ThreatLocker MCP server.","isRequired":true,"isSecret":true,"name":"PRINTING_PRESS_CLIENT_PROFILE"},{"description":"Portal API key (ThreatLocker portal: Settings > API Keys), sent as the Authorization header on every call.","isRequired":true,"isSecret":true,"name":"THREATLOCKER_API_KEY"},{"description":"Base URL for the ThreatLocker API. Leave the prefilled default unless your account uses a different regional or self-hosted host.","default":"https://portalapi.g.threatlocker.com/portalapi","name":"THREATLOCKER_BASE_URL"},{"description":"Tenant GUID sent as ManagedOrganizationId (the --org flag overrides it). Most Portal API data calls answer 401/403 without it, so set it unless you pass --org on every call.","name":"THREATLOCKER_ORG_ID"},{"description":"Overrides the User-Agent the CLI sends on ThreatLocker requests. Leave blank to use the CLI's own built-in User-Agent.","name":"THREATLOCKER_USER_AGENT"},{"description":"Optional. Set to exactly 1 to expose only read-only tools and refuse any state-changing execute call.","name":"THREATLOCKER_MCP_READ_ONLY"},{"description":"Optional. Set to 1 to save no API data locally: sync and audit pull are refused, the response cache is off, and reads go to the API.","name":"THREATLOCKER_NO_LOCAL_DATA"},{"description":"Required only when running the MCP server with --transport http. Not needed for the default local stdio transport.","isSecret":true,"name":"THREATLOCKER_MCP_HTTP_TOKEN"}]}]},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","statusChangedAt":"2026-10-27T14:56:24.405919Z","publishedAt":"2026-10-27T14:56:24.405919Z","updatedAt":"2026-10-27T14:56:24.405919Z","isLatest":true}}}