ThreatDown MCP

An open-source MCP server providing access to MSP tools including PSA, RMM, backup, and M365 integrations. It features a local SQLite mirror for cross-client queries without rate limits, ensuring data stays local. It supports 107+ connectors and includes credential management via connect-tool.

Package and access

Local package with source-attributed installation metadata. Koskamo does not execute packages during review.

Community listingLocal stdioSource reviewed; not executedPublished by Servosity

Vendor documentation

What you can do with it

Query PSA and RMM tools via natural language
Access backup and M365 data through local SQLite mirror
Manage credentials using connect-tool for Chrome and Keychain

Source and maintenance

Community listingRegistry 0.1.4

mcp-registry: io.github.Servosity/threatdown-mcp@0.1.4 Source repository

Maintenance checked: Nov 7, 2026, 6:36 PM UTC

Packages and installation

Source-provided package data. Koskamo has not executed or live-probed this package.

https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.4/threatdown-mcp.mcpb 0.1.4

mcpbSHA-256 supplied

https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.4/threatdown-mcp.mcpb package definition

{
  "version": "0.1.4",
  "transport": "stdio",
  "fileSha256": "a55786787c334ee6be13229dc3beac529432daa016eb582f86ba5b1de2ca7cb9",
  "identifier": "https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.4/threatdown-mcp.mcpb",
  "registryType": "mcpb",
  "environmentVariables": [
    {
      "name": "THREATDOWN_CLIENT_ID",
      "isRequired": true,
      "description": "Set the THREATDOWN_CLIENT_ID credential for the ThreatDown MCP server."
    },
    {
      "name": "THREATDOWN_CLIENT_SECRET",
      "isRequired": true,
      "description": "Set the THREATDOWN_CLIENT_SECRET credential for the ThreatDown MCP server."
    },
    {
      "name": "THREATDOWN_OAUTH_SCOPE",
      "description": "Optional: space-separated OAuth scopes to request; default `execute read write`."
    },
    {
      "name": "THREATDOWN_BASE_URL",
      "description": "Optional: override the OneView API base URL (default https://api.threatdown.com/oneview)."
    },
    {
      "name": "THREATDOWN_TOKEN_URL",
      "description": "Optional: override the OAuth2 token endpoint."
    },
    {
      "name": "THREATDOWN_USER_AGENT",
      "description": "Optional: override the User-Agent the CLI sends on OneView requests."
    },
    {
      "name": "THREATDOWN_MCP_READ_ONLY",
      "default": "1",
      "description": "Optional: set to 1 to run the MCP server read-only."
    },
    {
      "name": "THREATDOWN_MCP_HTTP_TOKEN",
      "description": "Bearer token callers must present when the server runs with --transport http; not used by the stdio transport."
    },
    {
      "name": "THREATDOWN_NO_LOCAL_DATA",
      "description": "Optional: set to 1 to turn off the response cache and local store (reads go to the API)."
    },
    {
      "name": "PRINTING_PRESS_CLIENT_PROFILE",
      "description": "Not enforced by this connector (no tenant-gated profiles); leave unset. It does not limit which sites a call can reach."
    }
  ]
}

Tools

Reported by the attributed source; not independently observed by Koskamo.

No tool definitions available.

Let your agent find its tools

Find servers like ThreatDown MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows

See all 9,413