Ntm MCP Server
Netwrix Threat Manager data access enables AI-driven threat monitoring and user analysis.
Data last scanned today · Reviewed today
Overview
Ntm MCP Server provides a direct interface between AI assistants and Netwrix Threat Manager (NTM). This allows users to perform threat monitoring by querying recent threats, filtering by specific perpetrators or threat types, and retrieving detailed event logs for individual security incidents. Beyond monitoring, the server supports administrative tasks like searching for users and objects by name or tag. It is designed to handle complex multi-step queries, such as identifying stale users and cross-referencing them against recent security threat reports.
Our verdict
The Ntm MCP Server is a high-risk tool with a security score of 24/100. The repository has not been editorially reviewed, and because it is community-maintained rather than official vendor software, users should exercise significant caution. The lack of an authentication review and the fact that the project has not been updated in over 300 days further contribute to this risk assessment.
- Uses zero direct dependencies for a reduced supply-chain surface
- Provides documented tools for threat monitoring and user searches
- Uses the permissive MIT license for open-source flexibility
- Security score is 24/100, categorized as high risk
- Community-maintained project lacking official vendor support
- Last commit occurred over 300 days ago
- Authentication methods have not been independently reviewed
Tools
| Tool | Description | Risk |
|---|---|---|
| get_threat_types | View all types of threats, their level, and if they are enabled. | low |
| get_recent_threats | Gets the most recent threats, optionally filtered by threat type, and optionally filtered by perpetrator. | low |
| get_threats_within_time_range | Gets threats within the given date and time range, optionally filtered by threat type, and optionally filtered by perpetrator. | low |
| get_details_for_threat | Gets details for the given threat. | low |
| get_recent_events_for_threat | Gets threats within the given date and time range, optionally filtered by threat type, and optionally filtered by perpetrator. | low |
| find_users_by_name | Finds all users by name. Partial matches will also be returned. | low |
| get_all_tags | Get tags available in NTM. | low |
| get_objects_with_tag | Get all objects with the given tag ID. | low |
| get_users_with_tag | Get all users with the given tag ID. | low |
| get_ntm_version | Get the version of your Netwrix Threat Manager server. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the installation prerequisites for the Ntm MCP Server?
You must have the Python project manager uv installed on your system to work with the repository.
›How many records can I retrieve at once using tools like get_recent_threats?
The server defaults to returning 20 records per request, which is also the maximum limit allowed.
›Does the user search tool support partial name matches?
Yes, the find_users_by_name tool returns results for both partial and full names and is case-insensitive.
›Can I view the underlying events that caused a specific threat?
Yes, you can use the get_recent_events_for_threat tool by providing a specific threat ID obtained from your threat searches.
Alternatives
Changelog
- ImprovedRelease v0.1.0
2025-08-13
Badge
Maintain this server? Add the live badge to your README.