# Mcp Server Ntm

> The official MCP server for Threat Manager.

- **Type:** MCP server
- **Install:** `agentstack add mcp-netwrix-mcp-server-ntm`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [netwrix](https://agentstack.voostack.com/s/netwrix)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [netwrix](https://github.com/netwrix)
- **Source:** https://github.com/netwrix/mcp-server-ntm

## Install

```sh
agentstack add mcp-netwrix-mcp-server-ntm
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Netwrix Threat Manager MCP Server

This [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server enables AI assistants to interface directly with Netwrix Threat Manager (NTM), enhancing your organization's threat management capabilities.

## Use Cases
- **Threat Monitoring:** View the most recent threats or those within a specified time frame.
- **Filtering:** Filter threats by one or more perpetrators or by threat types.
- **Details and Events:** Dive into the details and get the events that triggered a given threat.
- **Searching:** Find objects and users, search by name or tag, and list tags.
- **Links:** Usable links back to NTM (login required).
- **Complex Queries:** Ask more complex questions that combine tools intelligently for a more targetted answer.

## Example Usages
Here are some example prompts, and which tools are invoked, and how the LLM may respond. See below for tool details.

- "Show me the most recent threats."
    - `get_recent_threats`, no threat IDs, no perp IDs, default `skip` and `take` values.
    - _The LLM may ask if you want to see more threats once this is complete, which will set the `skip` and `take` params accordingly._

- "Find any users with the surname Hunter."
    - `find_users_by_name`: using the string "Hunter" as `name_search`.
    - _The tool will find any user with Hunter in their name, so it would also find those with a first name of Hunter. The LLM in this case will probably differentiate between those with the surname "Hunter" and those with it as a first name._

- "I want to know which objects are stale."
    - `get_all_tags`: the LLM will consider using get_objects_with_tag but then realises it needs to call this tool first.
    - `get_objects_with_tag`: set `tag_id` parameter using tag ID for "stale" as found in previous tool.

- "Find me all threats for last Wednesday by users tagged as stale."
    - `get_all_tags`: to fetch all tag IDs, then find the one for "stale".
    - `get_users_with_tag`: to fetch all users tagged as stale.
    - `get_threats_within_time_range`: using the user IDs found, will fetch the 20 most recent threats from "last Wednesday".
    - _The LLM may repeat calls to the last tool to get all threats. For example if the first call returns 20, a safe assumption to make is that there is more, less than 20 means there is no point skipping and taking more._

## Tools

### Threat Discovery and Details

- **get_threat_types** - View all types of threats, their level, and if they are enabled.

- **get_recent_threats** - Gets the most recent threats, optionally filtered by threat type, and optionally filtered by perpetrator.
    - `threat_type_ids`: Filter on threat types, obtained by get_threat_types tool. Empty list assumes all threats. (array, required)
    - `perp_ids`: Filter on perpetrators, obtained by get_threat_types tool. Empty list assumes all perpetrators. (array, required)
    - `skip`: Skip a number of records. Defaults to 0.
    - `take`: Take a number of records. Defaults to 20, maximum of 20.

- **get_threats_within_time_range** - Gets threats within the given date and time range, optionally filtered by threat type, and optionally filtered by perpetrator.
    - `start_time` start date and time to search from. (datetime, required)
    - `end_time` end date and time to search until. (datetime, required)
    - `threat_type_ids`: Filter on threat types, obtained by get_threat_types tool. Empty list assumes all threats. (array, required)
    - `perp_ids`: Filter on perpetrators, obtained by get_threat_types tool. Empty list assumes all perpetrators. (array, required)
    - `skip`: Skip a number of records. Defaults to 0.
    - `take`: Take a number of records. Defaults to 20, maximum of 20.

- **get_details_for_threat** - Gets details for the given threat.
    - `threat_id`: Threat ID, obtained by get_recent_threats and get_threats_within_time_range tools. (GUID, required)

- **get_recent_events_for_threat** - Gets threats within the given date and time range, optionally filtered by threat type, and optionally filtered by perpetrator.
    - `threat_id`: Threat ID, obtained by get_recent_threats and get_threats_within_time_range tools. (GUID, required)
    - `skip`: Skip a number of records. Defaults to 0.
    - `take`: Take a number of records. Defaults to 20, maximum of 20.

### User and Object Searching

- **find_users_by_name** - Finds all users by name. Partial matches will also be returned.
    - `name_search`: Partial or full name of user to search for, case is ignored. (string, required)

- **get_all_tags** - Get tags available in NTM.
    - `skip`: Skip a number of records. Defaults to 0.
    - `take`: Take a number of records. Defaults to 20, maximum of 20.

- **get_objects_with_tag** - Get all objects with the given tag ID.
    - `tag_id`: The tag ID to filter objects by. (integer, required)

- **get_users_with_tag** - Get all users with the given tag ID.
    - `tag_id`: The tag ID to filter objects by, from get_all_tags tool. (integer, required)

### Version
- **get_ntm_version** - Get the version of your Netwrix Threat Manager server.

## Installation

Prequisites:

- Install [uv](https://docs.astral.sh/uv/getting-started/installation/), a Python project manager

- Clone the repository (or download it as a zip)

To clone the repository:
```bash
git clone https://github.com/netwrix/mcp-server-ntm.git
```

### Install in Claude Desktop via Desktop Extensions (Recommended)

#### Option 1: One-click Installation

- Download the latest `mcp_server_ntm.dxt` file from [releases](https://github.com/netwrix/mcp-server-ntm/releases)

- Double-click to open with Claude Desktop (may have to find Claude Desktop to "Open with...")

- Click "Install"

#### Option 2: Upload Desktop Extension File Manually

- Download the latest `mcp_server_ntm.dxt` file from [releases](https://github.com/netwrix/mcp-server-ntm/releases)
- Navigate to `File -> Settings -> Extensions -> Advanced settings -> Install Extension...`
- Fill out the required fields, select Install and Enable

### Install in Claude Desktop via Configuration File

- Navigate to `File -> Settings -> Developer -> Edit Config`

Open the `claude_desktop_config.json` file and add the following:

```json
{
  "mcpServers": {
    "mcp-server-ntm": {
    "command": "uv",
    "args": [
        "run",
        "path/to/src/mcp_server_ntm/server.py"
    ],
      "env": {
        "NTM_URL": "https://example.com",
        "NTM_USERNAME": "your_ntm_username",
        "NTM_PASSWORD": "your_ntm_password"
      }
    }
  }
}
```

Then, restart Claude Desktop.

## Configuration
Once installed, you will be presented with the following configuration screen. All fields are required.
- NTM Server URL
- Username (must be at least Reviewers level)
- Password

Passwords are stored in the secure area of the local OS, see Claude Desktop for more details.

## License

This project is licensed under the terms of the MIT open source license. Please refer to [MIT](./LICENSE) for the full terms.

## Connect with Us

If you need help using this MCP server, want to better understand your results, or would like to share feedback, visit the [Netwrix Community](https://community.netwrix.com/) - we’re here to help and eager to hear about your experience!

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [netwrix](https://github.com/netwrix)
- **Source:** [netwrix/mcp-server-ntm](https://github.com/netwrix/mcp-server-ntm)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-netwrix-mcp-server-ntm
- Seller: https://agentstack.voostack.com/s/netwrix
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.