Connect Huntress to Conduit

This walkthrough connects Huntress (managed EDR) to Conduit. You create an API credential pair in the Huntress portal, then add it as a connection in Conduit. Once connected, any MCP client your organization uses can call Huntress tools — incidents, agents, organizations, signals, reports — through Conduit’s gateway.

Menu labels can change

The Huntress-portal steps below reflect Huntress’s API-credential flow at time of writing; menu labels can shift between releases. If a label differs, look for the nearest equivalent, or see Huntress’s API documentation.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization (or connect at the personal scope).
• A Huntress account login with permission to generate API credentials. The credential pair acts with account-level access, so treat it like an admin secret.

Step 1 — Create API credentials in Huntress

1. Sign in to your Huntress portal (https://<your-subdomain>.huntress.io).
2. Click your account name (top right) and open API Credentials. Expected: the API credentials page.
3. Click Setup / Generate to create a credential pair. Expected: an API Key and an API Secret. The secret is shown once.
4. Copy both values immediately. If you lose the secret, regenerate the pair — the old pair stops working.

Caution

Copy both values now and store them safely. Don’t paste them into chat, email, or a shared document — the next step moves them directly into Conduit, which encrypts them at rest. If you accidentally expose the pair, regenerate it in Huntress; the exposed pair becomes useless immediately.

Step 2 — Connect Huntress in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Huntress in the catalog (under Security) and click Connect. Expected: a credential form with API Key and API Secret fields.
3. Paste both values from Step 1.
4. Click Connect. Expected: Conduit validates the pair against the Huntress API immediately and shows Connected. A bad pair is rejected here, not on the first tool call.

Verify it worked

Connect an MCP client to Conduit (see Connecting an AI client) and ask it to run a read-only Huntress tool — listing organizations or open incident reports is a good first call. You should get real data back, and the call appears in your audit log with vendor huntress and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails immediately (“Invalid Huntress API credentials”)	Key or secret copied incompletely, or the pair was regenerated in Huntress after you copied it. Regenerate and reconnect with the fresh pair.
Tool calls return “No Huntress API credentials configured”	Huntress isn’t connected at a scope this user can resolve — connect at the organization scope, or the user connects personally. If it persists right after connecting, disconnect and reconnect to refresh the stored credential.
Tool calls return 401 from Huntress	The credential pair was revoked or regenerated in Huntress since it was stored. Reconnect with the current pair.
Data looks scoped wrong (missing organizations)	Huntress API credentials see the account they were created in. For an MSP parent account, create the pair at the parent level to see all child organizations.
Need to rotate the pair	Regenerate in Huntress, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves stored credentials.