ThreatLocker MCP

{
  "version": "0.3.13",
  "transport": "stdio",
  "fileSha256": "00943f07e6404e10a0e990f4a75defb28dec416f713a91dfdd9fbd242c76e8c5",
  "identifier": "https://github.com/Servosity/msp-skills/releases/download/threatlocker-v0.3.13/threatlocker-mcp.mcpb",
  "registryType": "mcpb",
  "environmentVariables": [
    {
      "name": "PRINTING_PRESS_CLIENT_PROFILE",
      "isRequired": true,
      "description": "Set the PRINTING_PRESS_CLIENT_PROFILE credential for the ThreatLocker MCP server."
    },
    {
      "name": "THREATLOCKER_API_KEY",
      "isRequired": true,
      "description": "Portal API key (ThreatLocker portal: Settings > API Keys), sent as the Authorization header on every call."
    },
    {
      "name": "THREATLOCKER_BASE_URL",
      "default": "https://portalapi.g.threatlocker.com/portalapi",
      "description": "Base URL for the ThreatLocker API. Leave the prefilled default unless your account uses a different regional or self-hosted host."
    },
    {
      "name": "THREATLOCKER_ORG_ID",
      "description": "Tenant GUID sent as ManagedOrganizationId (the --org flag overrides it). Most Portal API data calls answer 401/403 without it, so set it unless you pass --org on every call."
    },
    {
      "name": "THREATLOCKER_USER_AGENT",
      "description": "Overrides the User-Agent the CLI sends on ThreatLocker requests. Leave blank to use the CLI's own built-in User-Agent."
    },
    {
      "name": "THREATLOCKER_MCP_READ_ONLY",
      "description": "Optional. Set to exactly 1 to expose only read-only tools and refuse any state-changing execute call."
    },
    {
      "name": "THREATLOCKER_NO_LOCAL_DATA",
      "description": "Optional. Set to 1 to save no API data locally: sync and audit pull are refused, the response cache is off, and reads go to the API."
    },
    {
      "name": "THREATLOCKER_MCP_HTTP_TOKEN",
      "description": "Required only when running the MCP server with --transport http. Not needed for the default local stdio transport."
    }
  ]
}