Skip to content
actionlake
Start free

Connectors · MSP & PSA

ThreatLocker MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to ThreatLocker and the rest of your systems. It gives your agent 94 ThreatLocker actions (60 reads, 25 writes and 9 that wait for a confirmation) and holds the ThreatLocker credential itself, so the agent never does. It paces ThreatLocker's limits and records every call.

Connect ThreatLocker freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "threatlocker.action_logs.list_file_history",  intent: "check which ThreatLocker account is connected"}# List file history entries from the action log · read · 1 upstream call
  • 94actionsin one signed file
  • 60readlook, never change
  • 25writecreate and update
  • 9wait for a yesdestructive, confirmed first

Set up

Connect ThreatLocker in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect ThreatLocker.

    API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_keyThreatLocker API token: in the ThreatLocker portal create an API user (Administrators > API users) and copy its token
    • hostWhere your ThreatLocker lives: your host
    • managed_organization_idYour ThreatLocker managed organization id
    account { op: "connections.requirements", service: "threatlocker" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "threatlocker.action_logs.list_file_history" }# list file history entries from the action log · read · 1 upstream callcheck { action: "threatlocker.computers.update", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

ThreatLocker at a glance

Sign-in
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_key
Setup fields
hostmanaged_organization_id
Limits we pace to
300 calls a minute, per connection
API covered
ThreatLocker Portal API v1 (public Swagger, OpenAPI 3.0.4)portalapi.g.threatlocker.com
Built from
ThreatLocker's documentation, read 23 October 2026portalapi.g.threatlocker.comthreatlocker.kb.help
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
57 of 60 reads, for up to 5 minutes; a write clears what it affects
Shared entities
2, so ask can line ThreatLocker up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in ThreatLocker.

94 actions in 20 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 60readlook, never change
  • 25writecreate and update
  • 9destructivewait for a confirmation

  1. Computers

    19

    7 read · 7 write · 5 destructive

    Search computers · Get a computer · Update a computer · List ThreatLocker agent versions in use

  2. Approval requests

    14

    6 read · 8 write · 0 destructive

    Search approval requests · Authorize an approval request for permitting · Auto-permit the application in an approval request · Count pending approval requests

  3. Action logs

    9

    9 read · 0 write · 0 destructive

    List file history entries from the action log · List file history entries from the action log (v2) · Search the unified audit (action log) · Get an action log entry

  4. Scheduled agent actions

    7

    4 read · 2 write · 1 destructive

    Schedule an agent action · List scheduled agent actions · List targets a scheduled agent action can apply to · Search scheduled agent actions

  5. Applications

    6

    6 read · 0 write · 0 destructive

    List applications available for maintenance mode · List application options for an organization · Find applications matching a file, hash, path or certificate · Get an application

  6. Ringfence policies

    6

    5 read · 1 write · 0 destructive

    Check eligibility for advanced Ringfencing · Convert an application's legacy Ringfencing policy · Get a Ringfencing policy · Get the agent version required for advanced Ringfencing

  7. Computer groups

    4

    4 read · 0 write · 0 destructive

    List computer groups and their computers · List computer groups for an organization (dropdown) · List computer groups for an installer download · List computer groups for permitting an application

  8. Maintenance modes

    4

    1 read · 3 write · 0 destructive

    Create a maintenance mode · List maintenance modes for a computer · End a maintenance mode · Change a maintenance mode's end date

12 more areas · 25 actions
  • Organizations 4
  • Saved searches 3
  • Saved TQL searches 3
  • System audits 3
  • Tags 3
  • Reports 2
  • Upload requests 2
  • Computer checkins 1
  • Online devices 1
  • Policies 1
  • Threatlocker versions 1
  • Vdi hyperv 1

Top actions

The ThreatLocker API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 7 of ThreatLocker's 7 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
threatlocker.computers.searchSearch computersSearch computers.readdevice.endpoint.search8 connectors
threatlocker.computers.getGet a computerGet a computer.readdevice.endpoint.get57 connectors
threatlocker.organizations.search_childrenSearch child organizationsSearch child organizations.readcrm.company.search36 connectors
threatlocker.computers.updateUpdate a computerUpdate a computer.writedevice.endpoint.update23 connectors
threatlocker.reports.listList reportsList reports.readanalytics.report.list37 connectors
threatlocker.policies.getGet a policyGet a policy.readsecurity.policy.get30 connectors
threatlocker.system_audits.searchSearch the system auditSearch the system audit.readidentity.audit_event.search7 connectors
threatlocker.action_logs.searchSearch the unified audit (action log)Search the unified audit (action log).readthis connector
threatlocker.computers.list_versionsList ThreatLocker agent versions in useList ThreatLocker agent versions in use.readthis connector
threatlocker.approval_requests.ignoreIgnore approval requestsIgnore approval requests.writethis connector
threatlocker.approval_requests.permitPermit the application in an approval requestPermit the application in an approval request.writethis connector
threatlocker.computers.restart_serviceRestart the ThreatLocker service on computersRestart the ThreatLocker service on computers.destructivethis connector

Try it

Prompts to paste into Claude.

Each one names the ThreatLocker actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which ThreatLocker devices have not checked in for a week?

    callsthreatlocker.computers.search

  2. Writewrite

    Update a computer in ThreatLocker. Show me exactly what you will send before you save it.

    callsthreatlocker.computers.update

  3. Across systemsread

    Which ThreatLocker companies have invoices in NetSuite, and how many each?

    callsthreatlocker.organizations.search_childrennetsuite.views.invoices

Across your systems

ThreatLocker, joined to the rest of your business.

One ask fetches from ThreatLocker and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

  • Which ThreatLocker companies have invoices in NetSuite, and how many each?

    threatlocker.organizations.search_children + netsuite.views.invoices, on crm.company · NetSuite

  • Which ThreatLocker companies have tickets in HubSpot CRM, and how many each?

    threatlocker.organizations.search_children + hubspot_crm.tickets.list, on crm.company · HubSpot CRM

Also mapped by other connectorscrm.company 227device.endpoint 69
ask
ask {  intent: "which ThreatLocker companies have invoices in NetSuite, and how many each",  steps: [    { action: "threatlocker.organizations.search_children", as: "co", input: {}, limit: 100, max_pages: 5 },    { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 },    { join: {        left: "co",        right: "inv",        on: "crm.company",        group_by: "co.name",        select: ["co.name", "count(inv.id) as invoices"]    } }  ]}
Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for ThreatLocker

Destructive actions wait for a yes.

9 ThreatLocker actions are destructive. These are all of them:

  • Restart the ThreatLocker service on computersthreatlocker.computers.restart_service
  • Disable protection on computers (maintenance mode)threatlocker.computers.disable_protection
  • Move computers to another organizationthreatlocker.computers.move_to_organization
  • Regenerate the organization's install (auth) keythreatlocker.organizations.regenerate_auth_key
  • Restart the ThreatLocker service on an organization's computersthreatlocker.computers.restart_service_for_organization
  • Remove duplicate computersthreatlocker.computers.remove_duplicates
  • Delete a saved searchthreatlocker.saved_searches.delete
  • Delete a saved TQL searchthreatlocker.saved_tql_searches.delete
  • Abort a scheduled agent actionthreatlocker.scheduled_agent_actions.abort

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dothreatlocker.computers.remove_duplicatesconfirm_policy: human

Remove duplicate computers?

intent: the user asked me to remove duplicate computers

run suspended · waiting for a named person · key threatlocker-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "threatlocker-agent",  allowed_actions: ["threatlocker.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "threatlocker.computers.restart_service", approver: "[email protected]" },    { match: "threatlocker.computers.disable_protection", approver: "[email protected]" },    { match: "threatlocker.computers.move_to_organization", approver: "[email protected]" }  ]}
Illustrative. Scoped to ThreatLocker only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What ThreatLocker costs on actionlake.

Every ThreatLocker action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call ThreatLocker refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 94 ThreatLocker actions
  • 94actions pageeach page of a long list is one call
  • 57reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every ThreatLocker action.

94 actions by area: the id your agent calls, what it does, and its effect.

Computers19
  • threatlocker.computers.disable_protectionDisable protection on computers (maintenance mode)destructive
  • threatlocker.computers.enable_protectionEnable protection on computerswrite
  • threatlocker.computers.finish_maintenance_modeFinish maintenance mode on a computerwrite
  • threatlocker.computers.getGet a computerread
  • threatlocker.computers.get_downloadGet agent installer download detailsread
  • threatlocker.computers.get_install_infoGet install details for a new computerread
  • threatlocker.computers.get_os_typesGet operating system types for computersread
  • threatlocker.computers.get_throttle_statusGet throttle status for computersread
  • threatlocker.computers.list_versionsList ThreatLocker agent versions in useread
  • threatlocker.computers.move_to_organizationMove computers to another organizationdestructive
  • threatlocker.computers.remove_duplicatesRemove duplicate computersdestructive
  • threatlocker.computers.rescan_baselineRescan the baseline of computerswrite
  • threatlocker.computers.restart_serviceRestart the ThreatLocker service on computersdestructive
  • threatlocker.computers.restart_service_for_organizationRestart the ThreatLocker service on an organization's computersdestructive
  • threatlocker.computers.searchSearch computersread
  • threatlocker.computers.updateUpdate a computerwrite
  • threatlocker.computers.update_channelUpdate the update channel of computerswrite
  • threatlocker.computers.update_maintenance_modeUpdate a computer's maintenance modewrite
  • threatlocker.computers.update_versionUpdate the ThreatLocker agent version on computerswrite
Approval requests14
  • threatlocker.approval_requests.authorize_for_permitAuthorize an approval request for permittingwrite
  • threatlocker.approval_requests.auto_permitAuto-permit the application in an approval requestwrite
  • threatlocker.approval_requests.countCount pending approval requestsread
  • threatlocker.approval_requests.getGet an approval requestread
  • threatlocker.approval_requests.get_file_download_detailsGet file download details for an approval requestread
  • threatlocker.approval_requests.get_permit_applicationGet the permit-application view of an approval requestread
  • threatlocker.approval_requests.get_storage_approvalGet the storage approval view of an approval requestread
  • threatlocker.approval_requests.ignoreIgnore approval requestswrite
  • threatlocker.approval_requests.permitPermit the application in an approval requestwrite
  • threatlocker.approval_requests.permit_storagePermit a storage (device) approval requestwrite
  • threatlocker.approval_requests.permit_temporarilyTemporarily permit the application in an approval requestwrite
  • threatlocker.approval_requests.rejectReject approval requestswrite
  • threatlocker.approval_requests.searchSearch approval requestsread
  • threatlocker.approval_requests.take_ownershipTake ownership of an approval requestwrite
Action logs9
  • threatlocker.action_logs.getGet an action log entryread
  • threatlocker.action_logs.get_file_download_detailsGet file download details for an action log entryread
  • threatlocker.action_logs.get_policy_conditions_for_permitGet policy conditions to permit an application from an action log entryread
  • threatlocker.action_logs.get_search_stringBuild the search string for action log parametersread
  • threatlocker.action_logs.get_testing_environment_detailsGet testing environment details for an action log entryread
  • threatlocker.action_logs.get_v2Get an action log entry (v2)read
  • threatlocker.action_logs.list_file_historyList file history entries from the action logread
  • threatlocker.action_logs.list_file_history_v2List file history entries from the action log (v2)read
  • threatlocker.action_logs.searchSearch the unified audit (action log)read
Scheduled agent actions7
  • threatlocker.scheduled_agent_actions.abortAbort a scheduled agent actiondestructive
  • threatlocker.scheduled_agent_actions.createSchedule an agent actionwrite
  • threatlocker.scheduled_agent_actions.getGet a scheduled agent actionread
  • threatlocker.scheduled_agent_actions.listList scheduled agent actionsread
  • threatlocker.scheduled_agent_actions.list_applies_toList targets a scheduled agent action can apply toread
  • threatlocker.scheduled_agent_actions.searchSearch scheduled agent actionsread
  • threatlocker.scheduled_agent_actions.updateUpdate a scheduled agent actionwrite
Applications6
  • threatlocker.applications.getGet an applicationread
  • threatlocker.applications.get_for_network_policy_processGet an application for a network policy processread
  • threatlocker.applications.get_research_detailsGet ThreatLocker research details for an applicationread
  • threatlocker.applications.list_for_maintenance_modeList applications available for maintenance moderead
  • threatlocker.applications.list_optionsList application options for an organizationread
  • threatlocker.applications.search_matchingFind applications matching a file, hash, path or certificateread
Ringfence policies6
  • threatlocker.ringfence_policies.check_eligibilityCheck eligibility for advanced Ringfencingread
  • threatlocker.ringfence_policies.convert_legacyConvert an application's legacy Ringfencing policyread
  • threatlocker.ringfence_policies.getGet a Ringfencing policyread
  • threatlocker.ringfence_policies.get_agent_versionGet the agent version required for advanced Ringfencingread
  • threatlocker.ringfence_policies.has_legacyCheck whether applications or policies use legacy Ringfencingread
  • threatlocker.ringfence_policies.opt_inOpt in to advanced Ringfencing policieswrite
Computer groups4
  • threatlocker.computer_groups.listList computer groups and their computersread
  • threatlocker.computer_groups.list_dropdownList computer groups for an organization (dropdown)read
  • threatlocker.computer_groups.list_for_downloadList computer groups for an installer downloadread
  • threatlocker.computer_groups.list_for_permitList computer groups for permitting an applicationread
Maintenance modes4
  • threatlocker.maintenance_modes.createCreate a maintenance modewrite
  • threatlocker.maintenance_modes.endEnd a maintenance modewrite
  • threatlocker.maintenance_modes.listList maintenance modes for a computerread
  • threatlocker.maintenance_modes.update_end_dateChange a maintenance mode's end datewrite
Organizations4
  • threatlocker.organizations.get_auth_keyGet the organization's install (auth) keyread
  • threatlocker.organizations.list_for_move_computersList organizations computers can be moved toread
  • threatlocker.organizations.regenerate_auth_keyRegenerate the organization's install (auth) keydestructive
  • threatlocker.organizations.search_childrenSearch child organizationsread
Saved searches3
  • threatlocker.saved_searches.createSave a searchwrite
  • threatlocker.saved_searches.deleteDelete a saved searchdestructive
  • threatlocker.saved_searches.listList saved searches for a pageread
Saved TQL searches3
  • threatlocker.saved_tql_searches.createSave a TQL searchwrite
  • threatlocker.saved_tql_searches.deleteDelete a saved TQL searchdestructive
  • threatlocker.saved_tql_searches.listList saved TQL searches for a pageread
System audits3
  • threatlocker.system_audits.list_login_attempt_filtersList login attempt filters for the Health Centerread
  • threatlocker.system_audits.searchSearch the system auditread
  • threatlocker.system_audits.search_health_centerSearch login attempts for the Health Centerread
Tags3
  • threatlocker.tags.getGet a tagread
  • threatlocker.tags.listList tags for an organizationread
  • threatlocker.tags.updateUpdate a tagwrite
Reports2
  • threatlocker.reports.get_dataRun a report and get its dataread
  • threatlocker.reports.listList reportsread
Upload requests2
  • threatlocker.upload_requests.createRequest a file upload from a computerwrite
  • threatlocker.upload_requests.getGet a file upload requestread
Computer checkins1
  • threatlocker.computer_checkins.searchSearch a computer's check-insread
Online devices1
  • threatlocker.online_devices.listList online devicesread
Policies1
  • threatlocker.policies.getGet a policyread
Threatlocker versions1
  • threatlocker.threatlocker_versions.listList ThreatLocker agent versionsread
Vdi hyperv1
  • threatlocker.vdi_hyperv.get_testing_environment_detailsGet VDI / Hyper-V testing environment detailsread

Questions

The ThreatLocker MCP server, answered.

Is there a ThreatLocker MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 94 ThreatLocker actions across computers, approval requests, action logs and scheduled agent actions, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by ThreatLocker.

What do I need to connect ThreatLocker?

ThreatLocker API token: in the ThreatLocker portal create an API user (Administrators > API users) and copy its token. Plus your host and your managed organization id. The free call account { op: "connections.requirements", service: "threatlocker" } lists exactly what to paste.

Can an AI agent delete or change things in ThreatLocker?

Only if its key allows it, and only with an explicit confirmation. 9 ThreatLocker actions are destructive, including restart the ThreatLocker service on computers, disable protection on computers (maintenance mode) and move computers to another organization. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my ThreatLocker API limit?

actionlake paces every call to the limits in the ThreatLocker service file: 300 calls a minute per connection. Repeated reads are answered from cache (57 ThreatLocker actions can be), which never reaches ThreatLocker.

What does a ThreatLocker action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (94 ThreatLocker actions page). Cache hits, searches, dry runs and calls ThreatLocker refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which ThreatLocker API does it cover?

The ThreatLocker Portal API v1 (public Swagger, OpenAPI 3.0.4) at portalapi.g.threatlocker.com by default, or the base URL set when you connect. It is built from ThreatLocker's documentation as read on 23 October 2026. 94 actions in 20 areas, each one in the signed service file (version 1.0.0).

Can I combine ThreatLocker with my other systems?

Yes. ask joins ThreatLocker to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. ThreatLocker maps crm.company, which 227 other connectors also map.

Does actionlake keep my ThreatLocker data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your ThreatLocker credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like ThreatLocker

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by ThreatLocker; the name is the vendor's own. Counts are from the ThreatLocker service file, version 1.0.0.

Give your agent ThreatLocker today.

Connect ThreatLocker freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.