Loading ToolBench
MCP server for ThreatLocker API providing access to endpoint security, application control, maintenance modes, approval requests, and system audit functionality
The server defines 16 tools with comprehensive schemas and descriptions. Most tools follow action-enum patterns and include detailed parameter documentation. However, there are gaps in parameter descriptions, missing output schema documentation, and inconsistent error handling guidance. Tool names are mostly clear (e.g., 'computers', 'approval_requests') but could benefit from verb prefixes for action-oriented clarity. Descriptions range from 140-280 characters, which is within the baseline range (p10=34, p90=392), though several parameter descriptions are sparse. The tool registry pattern is well-structured, and security considerations are partially addressed (API key injection via ThreatLockerClient). Output schema declarations are present but not fully visible in source for all tools.
Query ThreatLocker action log for execution audit history. Search logs by date range, action type, filter by computers/groups/organizations, and group results by various dimensions. Logs all application and device control actions with timestamps, outcomes, and user information.
Query and manage applications in ThreatLocker. Search applications by name/hash, get application details and research information, match files by hash/path/cert, manage application files, and create/update applications. Supports cross-organization management and file rule uploads.
Query and manage ThreatLocker approval requests. List pending/completed requests, get request details, permit/reject requests with custom rules, take ownership, check file download status, and view storage/permit application details. Supports filtering by status and search text.
Query and manage computer groups in ThreatLocker. List groups, get details, retrieve dropdown options, get groups for permit actions, and manage group policies. Returns group configuration, member counts, and policy assignments.
Query and manage computers in ThreatLocker. List computers, get details, manage installation, update tags, install/uninstall agents, and query online status. Supports filtering by name, tag, group, organization, and OS type. Returns computer details including install status, agent version, and policy assignments.
Tool names lack action verb prefixes. 'computers', 'applications', 'policies' are noun-based; should be 'list_computers', 'search_applications', 'get_policies' to signal intent. LLMs infer action intent from verb prefixes, ambiguous names increase selection errors.
Parameter descriptions are often minimal or missing. Many parameters (e.g., 'pageNumber', 'pageSize', 'searchText' across all tools) lack context on valid ranges, constraints, or when to use them. Baseline: 100% of A+ tools have param descriptions; this server has ~60% coverage.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 63 | 2025-06-18+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Query ThreatLocker maintenance mode history for computers. Maintenance mode temporarily changes a computer's protection level. Types include Monitor Only, Installation Mode, Learning Mode, Tamper Protection Disabled, Isolation, and Lockdown. View history, enable mode, end active windows, and extend/shorten duration.
Query and manage ThreatLocker network access control policies. List network policies, get policy details, create/update policies, and manage network policy rules.
Query ThreatLocker online device status. List currently online devices and their connection status.
Query and manage ThreatLocker organizations. List child organizations, get authentication key, retrieve organizations for computer move operations, and view organizational structure and settings.
Query and manage application control policies in ThreatLocker. Get policy details, list policies by level, create/update/clone policies, manage policy items and rules. Supports organization, computer group, and computer level policies.
Query ThreatLocker reports. List available reports including compliance, audit, and operational reports.
Query and manage ThreatLocker scheduled actions. List scheduled actions, search by criteria, get applies-to information, create/update/delete scheduled actions, and manage action schedules.
Query and manage ThreatLocker storage control policies. List storage policies, get policy details, create/update policies, and manage storage policy rules.
Query ThreatLocker system audit logs and health center. Search audit logs by date range, view system health status, configuration changes, administrative actions, and account activity.
Query and manage ThreatLocker tags. List available tags and retrieve tags in dropdown format for filtering and organization.
Query ThreatLocker agent and application versions. List available versions, release notes, and version-specific information.
Output schemas not visible in source code for all tools. Tool definitions reference outputZodSchema or apiResponseOutputSchema, but the actual schema details are not provided in the audit materials. Cannot verify if outputs include all chaining IDs (e.g., computerId for downstream tools) or if results are bounded.
Write operations lack confirmation or dry-run support. Tools like 'install_agent', 'uninstall_agent', 'update_tags', 'delete' (scheduled_actions) modify state without a confirmation step. Agents can cause destructive changes (e.g., uninstall_agent across a group) without review. Pattern: confirmation-request.
Error handling lacks recovery guidance. The server returns 'FORBIDDEN' and other error categories but does not guide the LLM on next steps. E.g., if 'computerId' is invalid, the error should suggest 'Try list_computers() with a searchText filter.' Baseline: 100% of A+ tools include recovery guidance.
Some tools accept enum parameters with unclear semantics. E.g., 'osType' uses numeric codes (1=Windows, 2=macOS, 3=Linux, 5=Windows XP) in applications.ts. LLMs prefer semantic strings (enum: ['windows', 'macos', 'linux']) over magic numbers. Numbers force LLMs to look up codes or guess.
Short descriptions on low-utility tools. 'reports' has description 'Query ThreatLocker reports. List available reports...' (60 chars). 'tags' has 'Query and manage ThreatLocker tags. List available tags...' (60 chars). These are too generic and do not explain when an agent should call them. Should explain e.g. 'Use this after creating a tag filter query to retrieve available tag IDs for filtering.'
Parameter naming inconsistency. Some parameters use camelCase (computerId, computerGroupId, organizationId) while the tool names use snake_case (computer_groups, network_access_policies). This inconsistency can confuse LLMs when generating API calls. Recommendation: standardize all parameter names to snake_case.
No explicit parameter type documentation in descriptions. While JSON Schema includes 'type' fields, the descriptions do not explicitly state constraints. E.g., 'pageNumber' should say 'Must be >= 1' and 'pageSize' should say 'Must be 1-500'. Baseline: 100% of A+ tools state type, range, and format in descriptions.