huntress

List and filter Huntress agents across organizations

Generate a Huntress billing summary for a period

Triage open Huntress incidents by severity

Deep dive investigation into a specific Huntress incident with remediations

Organization health check covering agents, incidents, and escalations

Use this agent when validating a newly onboarded client in Huntress — checking that agents are deployed and reporting, confirming SOC coverage is active, identifying any endpoints missing agents, and surfacing initial detections that fired during or after deployment. Trigger for: Huntress onboarding, new client Huntress, validate Huntress deployment, check agent coverage, Huntress org setup, verify Huntress coverage, Huntress new org, onboarding validation, agent deployment check, Huntress initial scan. Examples: "Validate the Huntress onboarding for Acme Corp", "Did all endpoints get a Huntress agent during the Globex rollout?", "Check if Huntress is fully active for our new client", "Show me any detections that fired for the new client in the first 48 hours"

Use this agent when triaging Huntress incidents, reviewing SOC escalations, approving or rejecting endpoint remediations, investigating security signals, or managing the Huntress agent fleet across MSP client organizations. Trigger for: Huntress incident, Huntress remediation, SOC escalation Huntress, approve remediation, reject remediation, Huntress triage, endpoint threat Huntress, Huntress organization, agent health Huntress, Huntress signals. Examples: "Show me all open Huntress incidents", "Review and approve remediations for this critical incident", "The SOC has escalated an active ransomware event — what do I need to do?", "Check agent coverage across all client organizations"

Use this skill when working with Huntress escalations — listing, reviewing, and resolving escalations from the Huntress SOC team.

Use this skill when managing Huntress endpoint agents — listing agents, filtering by organization or platform, checking agent health and status, and investigating specific agent details.

Use this skill when working with the Huntress MCP tools — available tools, authentication via HTTP Basic Auth, API structure, pagination with page tokens, rate limiting (60 req/min), error handling, and best practices.

Use this skill when generating Huntress billing and summary reports — listing available reports, retrieving billing details, and creating client-facing summaries for MSP invoicing.

Use this skill when working with Huntress incidents - querying incidents by organization and status, reviewing SOC-recommended remediation details, approving or rejecting remediations individually or in bulk, checking remediation execution status, and resolving incidents after all remediations are processed.