ThreatLocker

Connects Claude to the ThreatLocker Portal API for managing zero-trust endpoint security through conversation. You get tools for listing and inspecting computers, handling approval requests, searching audit logs, and managing organizations across your ThreatLocker deployment. The server uses a stateless architecture with domain-based navigation, so you call threatlocker_navigate first to access specific tool sets like computers or approvals. Ships with both stdio mode for single-tenant setups and gateway mode for multi-tenant environments where credentials come through HTTP headers. Reach for this when you want to query computer checkin status, review pending approvals, or pull audit histories without clicking through the ThreatLocker console.