Huntress

OCI · GHCR.IO/WYRE-TECHNOLOGY/HUNTRESS-MCP:V1.2.19 · SCANNED AUG 22

MCP server for Huntress — accounts, organizations, agents, incidents, and reports.

Available components

oci · ghcr.io/wyre-technology/huntress-mcp:v1.2.19 37

37 37 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security0

Malware scan not yet available for this package.Unverified
Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
Install-script risk not yet assessed.Unverified
Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified

Provenance & Transparency32

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license. See how to fix → Fail
Actively maintained (last published 1 days ago).Pass
Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified

Schema Quality & AI Usability83

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 1644 tokens (~51/item across 32 items; 32 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage90

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
71% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 2 categories

Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the Huntress MCP server?

Huntress runs locally as a container image, launched with docker run --rm -i ghcr.io/wyre-technology/huntress-mcp:v1.2.19. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · ghcr.io/wyre-technology/huntress-mcp:v1.2.19

Claude Cursor VS Code Codex opencode Hermes Netclaw Other

# add to Claude Code

claude mcp add wyre-technology-huntress-mcp -- docker run --rm -i ghcr.io/wyre-technology/huntress-mcp:v1.2.19

// .cursor/mcp.json

{
  "mcpServers": {
    "wyre-technology-huntress-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/huntress-mcp:v1.2.19"
      ]
    }
  }
}

// .vscode/mcp.json

{
  "servers": {
    "wyre-technology-huntress-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/huntress-mcp:v1.2.19"
      ]
    }
  }
}

# add to Codex CLI

codex mcp add wyre-technology-huntress-mcp -- docker run --rm -i ghcr.io/wyre-technology/huntress-mcp:v1.2.19

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wyre-technology-huntress-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/huntress-mcp:v1.2.19"
      ],
      "enabled": true
    }
  }
}

# ~/.hermes/config.yaml

mcp_servers:
  wyre-technology-huntress-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/wyre-technology/huntress-mcp:v1.2.19"]

// ~/.netclaw/config/netclaw.json

{
  "McpServers": {
    "wyre-technology-huntress-mcp": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/huntress-mcp:v1.2.19"
      ]
    }
  }
}

// mcp.json

{
  "mcpServers": {
    "wyre-technology-huntress-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/huntress-mcp:v1.2.19"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

22 Aug 26 0
- Security disclosure: fail → unverified ▼ functional
20 Aug 26 37

First indexed and scored.

Show 1 earlier entry Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 22 Aug 2026 · Analysed oci/ghcr.io/wyre-technology/huntress-mcp:v1.2.19

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	oci
Reason	No attestation published

MCP tools · 32 exposed · ~1,644 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

huntress_accounts_actor ~25

Get the current actor (user/account/reseller) for the API credentials.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

huntress_accounts_get ~22

Get the Huntress account associated with the current API credentials.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

huntress_agents_get ~26

Get a single agent by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Agent ID

No output schema declared.

No examples provided.

huntress_agents_list ~67

List Huntress agents with optional filters.

Input Output Examples

Name	Type	Req	Description
limit	number	–	Max results (1-500, default 10)
organization_id	number	–	Filter by organization ID
page_token	string	–	Pagination token
platform	string	–	Filter by platform

No output schema declared.

No examples provided.

huntress_billing_reports_get ~28

Get billing report by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Billing report ID

No output schema declared.

No examples provided.

huntress_billing_reports_list ~38

List billing reports.

Input Output Examples

Name	Type	Req	Description
limit	number	–	–
page_token	string	–	–
status	string	–	–

No output schema declared.

No examples provided.

huntress_escalations_get ~31

Get escalation by ID (includes entities).

Input Output Examples

Name	Type	Req	Description
id	number	yes	Escalation ID

No output schema declared.

No examples provided.

huntress_escalations_list ~31

List escalations.

Input Output Examples

Name	Type	Req	Description
limit	number	–	–
page_token	string	–	–

No output schema declared.

No examples provided.

huntress_escalations_resolve ~49

Resolve an escalation.

Input Output Examples

Name	Type	Req	Description
determination	string	–	For unwanted access escalations
id	number	yes	Escalation ID
scope	string	–	Rule scope

No output schema declared.

No examples provided.

huntress_incidents_bulk_approve ~36

Bulk approve all remediations for an incident report.

Input Output Examples

Name	Type	Req	Description
incident_report_id	number	yes	Incident report ID

No output schema declared.

No examples provided.

huntress_incidents_bulk_reject ~88

Bulk reject all remediations for an incident report.

Input Output Examples

Name	Type	Req	Description
comment	string	yes	Reason for rejection
email	string	–	Contact email
incident_report_id	number	yes	Incident report ID
name	string	–	Name of rejecting user
phone_number	string	–	Contact phone
useful	boolean	–	Whether the plan was useful

No output schema declared.

No examples provided.

huntress_incidents_get ~27

Get incident report by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Incident report ID

No output schema declared.

No examples provided.

huntress_incidents_list ~95

List incident reports with optional filters.

Input Output Examples

Name	Type	Req	Description
agent_id	number	–	Filter by agent ID
limit	number	–	Max results (1-500)
organization_id	number	–	Filter by org ID
page_token	string	–	Pagination token
platform	string	–	Filter by platform
severity	string	–	Filter by severity
status	string	–	Filter by status

No output schema declared.

No examples provided.

huntress_incidents_remediation_get ~41

Get a specific remediation.

Input Output Examples

Name	Type	Req	Description
incident_report_id	number	yes	Incident report ID
remediation_id	number	yes	Remediation ID

No output schema declared.

No examples provided.

huntress_incidents_remediations ~49

List remediations for an incident report.

Input Output Examples

Name	Type	Req	Description
incident_report_id	number	yes	Incident report ID
limit	number	–	–
page_token	string	–	–

No output schema declared.

No examples provided.

huntress_incidents_resolve ~27

Resolve an incident report.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Incident report ID

No output schema declared.

No examples provided.

huntress_navigate ~118

Discover available Huntress tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite.

Input Output Examples

Name	Type	Req	Description
domain	string	yes	The domain to explore: - accounts: account info, current actor - agents: list/get endpoint agents - organizations: CRUD organizations - incidents: incident reports, escalations, remediations - billin…

No output schema declared.

No examples provided.

huntress_organizations_create ~95

⚠ HIGH-IMPACT. Creates a new organization in Huntress, which provisions tenant scope for agents, users, and security policies. Reversible via delete, but creation is visible to operators and may trigger downstream automations. Confirm with the user before invoking.

Input Output Examples

Name	Type	Req	Description
key	string	yes	Organization key for agent grouping (max 256 chars)
name	string	yes	Organization name (max 256 chars)

No output schema declared.

No examples provided.

huntress_organizations_delete ~62

⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently deletes an organization and all of its associated data, agents, and security settings. This action cannot be undone. Confirm with the user before invoking.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Organization ID

No output schema declared.

No examples provided.

huntress_organizations_get ~25

Get organization by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Organization ID

No output schema declared.

No examples provided.

huntress_organizations_list ~37

List organizations.

Input Output Examples

Name	Type	Req	Description
limit	number	–	Max results (1-500)
page_token	string	–	Pagination token

No output schema declared.

No examples provided.

huntress_organizations_update ~100

⚠ HIGH-IMPACT. Updates an organization's name, key, or report recipients. Changing the key affects agent grouping; changing report recipients alters who receives security reports. Reversible by reverting the fields. Confirm with the user before invoking.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Organization ID
key	string	–	New key
name	string	–	New name
report_recipients	array	–	Email recipients for reports

No output schema declared.

No examples provided.

huntress_signals_get ~25

Get signal by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Signal ID

No output schema declared.

No examples provided.

huntress_signals_list ~86

List security signals.

Input Output Examples

Name	Type	Req	Description
entity_id	string	–	–
entity_type	string	–	–
investigated_at_max	string	–	–
investigated_at_min	string	–	–
limit	number	–	–
organization_id	number	–	–
page_token	string	–	–
statuses	string	–	–
types	string	–	–

No output schema declared.

No examples provided.

huntress_status ~19

Check Huntress API connection status and available domains.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

huntress_summary_reports_get ~27

Get summary report by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Summary report ID

No output schema declared.

No examples provided.

huntress_summary_reports_list ~67

List summary reports.

Input Output Examples

Name	Type	Req	Description
limit	number	–	–
organization_id	number	–	–
page_token	string	–	–
period_max	string	–	Max period filter
period_min	string	–	Min period filter
type	string	–	–

No output schema declared.

No examples provided.

huntress_users_create ~108

⚠ HIGH-IMPACT. Creates a membership (invites a user) and grants them the specified permission level — including potentially Admin or Security Engineer privileges. Reversible by deleting the membership. Confirm with the user before invoking.

Input Output Examples

Name	Type	Req	Description
email	string	yes	User email
first_name	string	yes	First name
last_name	string	yes	Last name
organization_id	number	–	Invite to org instead of account
permissions	string	yes	Permission level

No output schema declared.

No examples provided.

huntress_users_delete ~57

⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently deletes a user membership and removes their access to the organization. This action cannot be undone. Confirm with the user before invoking.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Membership ID

No output schema declared.

No examples provided.

huntress_users_get ~24

Get membership by ID.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Membership ID

No output schema declared.

No examples provided.

huntress_users_list ~42

List memberships (users).

Input Output Examples

Name	Type	Req	Description
limit	number	–	–
organization_id	number	–	Filter by organization ID
page_token	string	–	–

No output schema declared.

No examples provided.

huntress_users_update ~72

⚠ HIGH-IMPACT. Updates a membership's permission level, which can grant or revoke Admin, Security Engineer, or other privileged roles. Reversible by setting permissions back. Confirm with the user before invoking.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Membership ID
permissions	string	yes	New permission level

No output schema declared.

No examples provided.

Common questions

What is the Huntress MCP server?

Huntress is an MCP server listed in the public MCP registry as io.github.wyre-technology/huntress-mcp. MCP server for Huntress, accounts, organizations, agents, incidents, and reports. This page covers its container image (ghcr.io/wyre-technology/huntress-mcp:v1.2.19).

Is the Huntress MCP server safe to use?

Huntress scores 37 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Huntress MCP server expose?

Huntress exposes 32 tools: huntress_navigate, huntress_status, huntress_accounts_get, huntress_accounts_actor, huntress_agents_list, and 27 more. Their descriptions and schemas cost roughly 1,644 tokens of context every time the server is loaded.

Is the Huntress MCP server still maintained?

Huntress is still listed as active in the MCP registry. We last reached this channel on 22 August 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Huntress MCP server under?

Huntress declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

20 Aug 22 Aug