Security 🧪 Community ✓ Claude Code ✓ Claude Desktop Standalone • Huntress
Huntress
Huntress - managed threat detection, incident response, endpoint agent management, escalations, and billing reports
Installation
Install this plugin individually:
/plugin marketplace add wyre-technology/msp-claude-plugins --plugin huntress Or install all MSP plugins at once:
/plugin marketplace add wyre-technology/msp-claude-plugins Features
- Agent Monitoring
- Billing
- Escalations
- Incident Management
- Organization Management
- Signals
Skills
This plugin provides 7 skills that teach Claude about Huntress:
| Skill | Description |
|---|---|
agents | Huntress endpoint agents: the agent lifecycle, organization and platform filters, health signals such as `last_seen_at` and version, fleet-audit workflows, and the errors returned for missing or empty agent results. |
billing | Huntress billing and summary reports: what each report type contains, the list/get tools for both, and the monthly reconciliation, QBR security summary, and cost-analysis workflows an MSP builds from them. |
escalations | Huntress SOC escalations: how an escalation differs from an incident, escalation priority levels, the list/get/resolve tools, escalation-to-incident correlation, and the already-resolved and not-found error cases. |
incidents | Huntress incidents and the remediation lifecycle: querying incidents by organization and status, SOC-recommended remediation details, individual and bulk approve/reject, remediation execution status, and the ordering constraint that incidents resolve only after all remediations are processed. |
organizations | Huntress organizations as the multi-tenant boundary: org structure, the organization key used for agent deployment, full CRUD operations, client onboarding and offboarding workflows, and the duplicate-key and active-agent deletion errors. |
signals | Huntress security signals: how signals differ from incidents, the signal types, listing and filtering by organization, and the threat-hunting and pattern-analysis workflows built on signal data. |
api-patterns | Huntress MCP fundamentals: HTTP Basic Auth via API key/secret headers, the full MCP tool catalog, token-based pagination, the 60 req/min rate limit, and the common HTTP error codes with their causes. |
Agents
This plugin provides 2 agents for autonomous task execution:
| Agent | Description |
|---|---|
client-onboarding-validator | Use this agent when validating a newly onboarded client in Huntress — checking that agents are deployed and reporting, confirming SOC coverage is active, identifying any endpoints missing agents, and surfacing initial detections that fired during or after deployment. |
incident-responder | Use this agent when triaging Huntress incidents, reviewing SOC escalations, approving or rejecting endpoint remediations, investigating security signals, or managing the Huntress agent fleet across MSP client organizations. |
Commands
Available slash commands:
| Command | Description |
|---|---|
/agent-inventory | List and filter Huntress agents across organizations |
/billing-report | Generate a Huntress billing summary for a period |
/incident-triage | Triage open Huntress incidents by severity |
/investigate-incident | Deep dive investigation into a specific Huntress incident with remediations |
/org-health | Organization health check covering agents, incidents, and escalations |
/resolve-escalation | Review and resolve a Huntress escalation |
API Reference
| Base URL | |
| Authentication | |
| Rate Limit | |
| Documentation |
Example Usage
List and filter Huntress agents across organizations
/agent-inventoryGenerate a Huntress billing summary for a period
/billing-reportTriage open Huntress incidents by severity
/incident-triageDeep dive investigation into a specific Huntress incident with remediations
/investigate-incidentOrganization health check covering agents, incidents, and escalations
/org-healthReview and resolve a Huntress escalation
/resolve-escalationUsing Skills
/skill huntress:agents
Huntress endpoint agents: the agent lifecycle, organization and platform filters, health signals such as `last_seen_at` and version, fleet-audit workflows, and the errors returned for missing or empty agent results.