ThreatDown MCP
An open-source MCP server providing connectors for MSP tools including PSA, RMM, backup, and M365. It features a local SQLite mirror for cross-client queries, supports 84+ connectors, and handles credential management via local keychains.
Package and access
Local package with source-attributed installation metadata. Koskamo does not execute packages during review.
What you can do with it
- Query PSA and RMM tools via natural language
- Access fleet-wide stale-endpoint and health reports
- Retrieve seat reports across all clients
- Run local-first AI agent tasks without data leaving the network
Source and maintenance
Community listingRegistry 0.1.3
- Maintenance checked
Packages and installation
Source-provided package data. Koskamo has not executed or live-probed this package.
https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.3/threatdown-mcp.mcpb 0.1.3
mcpbSHA-256 supplied
https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.3/threatdown-mcp.mcpb package definition
{
"version": "0.1.3",
"transport": "stdio",
"fileSha256": "02e0eac78f571cdc2d44493602ba3d40a7a5602b967e140bea7c6dec46dceabb",
"identifier": "https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.3/threatdown-mcp.mcpb",
"registryType": "mcpb",
"environmentVariables": [
{
"name": "THREATDOWN_CLIENT_ID",
"isRequired": true,
"description": "Set the THREATDOWN_CLIENT_ID credential for the ThreatDown MCP server."
},
{
"name": "THREATDOWN_CLIENT_SECRET",
"isRequired": true,
"description": "Set the THREATDOWN_CLIENT_SECRET credential for the ThreatDown MCP server."
},
{
"name": "THREATDOWN_OAUTH_SCOPE",
"description": "Optional: space-separated OAuth scopes to request; default `execute read write`."
},
{
"name": "THREATDOWN_BASE_URL",
"description": "Optional: override the OneView API base URL (default https://api.threatdown.com/oneview)."
},
{
"name": "THREATDOWN_TOKEN_URL",
"description": "Optional: override the OAuth2 token endpoint."
},
{
"name": "THREATDOWN_USER_AGENT",
"description": "Optional: override the User-Agent the CLI sends on OneView requests."
},
{
"name": "THREATDOWN_MCP_READ_ONLY",
"default": "1",
"description": "Optional: set to 1 to run the MCP server read-only."
},
{
"name": "THREATDOWN_MCP_HTTP_TOKEN",
"description": "Bearer token callers must present when the server runs with --transport http; not used by the stdio transport."
},
{
"name": "PRINTING_PRESS_CLIENT_PROFILE",
"description": "Not enforced by this connector (no tenant-gated profiles); leave unset. It does not limit which sites a call can reach."
}
]
}Tools
Reported by the attributed source; not independently observed by Koskamo.
Let your agent find its tools
Find servers like ThreatDown MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.