Abnormal MCP Server

io.github.GregDogPublished by GitHub account GregDogv1.1.0Updated Oct 24, 2026

Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.

VerifiedSTDIODesktop onlyCommunication & CollaborationSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant query Abnormal Security threat, message, employee, ATO case, and vendor data, with optional remediation and evidence download tools.

What you can do
An MCP server for Abnormal Security that exposes 27 always-on read tools covering the threat log, message search, mailbox campaigns, employee identity and logins, ATO cases, vendor compromise cases, Detection 360 reports, URL rewrite clicks, and audit logs. Optional opt-in tool sets add response actions (search remediation, threat remediate/unremediate, case status update, Detection 360 report submit) and evidence download (message EML and attachments). It runs as a local process over stdio by default, with opt-in Streamable HTTP.
When to use it
Use it when an assistant needs to investigate email threats, business email compromise, account takeover cases, or vendor risk from Abnormal Security, and when read-only access is enough. Enable the response or evidence gates only if you actually need remediation or message/attachment retrieval.
Requirements
A local runtime (native Go binary or the Docker image ghcr.io/gregdog/mcp-server-abnormal). ABNORMAL_API_TOKEN is required; ABNORMAL_BASE_URL selects the US, EU, or FedRAMP endpoint. Optional gates: ABNORMAL_ALLOW_RESPONSE, ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD, ABNORMAL_MAX_EVIDENCE_BYTES. Network access to the Abnormal REST API.
Before you install
The server has no built-in authentication or RBAC and is intended for local use only; do not expose its HTTP endpoint on a network without your own access controls. ABNORMAL_API_TOKEN is a bearer credential granting access to your Abnormal tenant. Response tools can delete or move messages, remediate threats, change case status, and submit reports, and evidence download retrieves message content and attachments; both are off by default and gated behind confirm previews.

Installation

In SourceWeft

  1. Open Abnormal MCP Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Abnormal MCP Server

[CI] [Go] [License]

A secure, open-source Model Context Protocol server for Abnormal Security.

This project is not an official Abnormal product and is not endorsed by Abnormal AI.

Overview

abnormal-mcp lets MCP clients such as Cursor and Claude Desktop query Abnormal Security over stdio (default) or Streamable HTTP. It uses a lightweight handwritten client against the Abnormal Security Client API.

text
MCP Client    → Abnormal MCP Server (stdio or HTTP)        → Abnormal REST API

The server is read-only by default. Response and evidence download tools are opt-in and independent. Abnormal authorization still applies to every request.

Features

Read (always on)

  • Threat list and get from the Threat Log
  • Threat links and attachment metadata
  • Threat action status poll (abnormal_threat_action_get)
  • Message search with ergonomic filters (since, sender, sender_domain, recipient, subject, url, attachment, sender_ip, judgement)
  • Search activity list and status
  • Message remediation history
  • AI Security Mailbox (formerly Abuse Mailbox) campaigns and unanalyzed reports
  • Employee profile, identity (Genome), and recent logins
  • ATO case list, detail, and analysis
  • Vendor list, detail, activity, and vendor compromise cases
  • Detection 360 report list (false positives and missed attacks)
  • US, EU, and FedRAMP base URLs (configurable)

Response (opt-in: ABNORMAL_ALLOW_RESPONSE=true)

  • Search remediation (delete, move_to_inbox) with confirm: true preview gate
  • Threat remediate / unremediate with confirm: true preview gate
  • ATO case status update with confirm: true preview gate
  • Detection 360 report submit (false positive, missed attack/spam/graymail) with confirm: true preview gate

Evidence download (opt-in: ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD=true)

  • Message EML download (by ABX message ID or search cloud_message_id)

  • Attachment analysis signals and attachment download

  • Metadata + bounded preview by default; optional base64 embed (max 1 MiB in tool output)

  • stdio transport (default) and opt-in Streamable HTTP

  • Native Go binary and Docker image

  • MCP Registry listing on tagged releases (io.github.GregDog/mcp-server-abnormal)

Quick Start

Create an Abnormal REST API token in the Abnormal portal under Integrations → Abnormal REST API.

bash
export ABNORMAL_API_TOKEN="your-token"abnormal-mcp serve

Installation

From source

bash
git clone https://github.com/GregDog/mcp-server-abnormal.gitcd mcp-server-abnormalmake build

Docker

bash
docker run --rm -i \  -e ABNORMAL_API_TOKEN \  ghcr.io/gregdog/mcp-server-abnormal serve

Client configuration

Cursor (stdio)

See examples/cursor.mcp.json.

Claude Desktop

See examples/claude-desktop.json.

Tools

27 read tools are always registered. With ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD=true, five evidence tools are added (32 total). With ABNORMAL_ALLOW_RESPONSE=true, four response tools are added (31 total, or 36 with both gates enabled).

AreaTools
Threatsabnormal_threats_list, abnormal_threat_get, abnormal_threat_action_get, abnormal_threat_links_list, abnormal_threat_attachments_list
Searchabnormal_search_messages, abnormal_search_activities_list, abnormal_search_activity_get
Messagesabnormal_message_remediation_history
Mailboxabnormal_mailbox_campaigns_list, abnormal_mailbox_campaign_get, abnormal_mailbox_unanalyzed_list
Employeesabnormal_employee_get, abnormal_employee_identity_get, abnormal_employee_logins_list
ATO casesabnormal_cases_list, abnormal_case_get, abnormal_case_analysis_get, abnormal_case_action_get
Vendorsabnormal_vendors_list, abnormal_vendor_get, abnormal_vendor_activity_list, abnormal_vendor_cases_list, abnormal_vendor_case_get
Detection 360abnormal_detection360_reports_list
URL rewriteabnormal_url_rewrite_clicks_list
Audit logsabnormal_audit_logs_list
Evidence (opt-in)abnormal_message_eml_get, abnormal_search_message_eml_get, abnormal_message_attachment_get, abnormal_message_attachment_download, abnormal_search_attachment_download
Response (opt-in)abnormal_search_remediate, abnormal_threat_remediate, abnormal_case_update, abnormal_detection360_report_submit

See docs/tools.md for parameters.

Configuration

VariableDefaultPurpose
ABNORMAL_API_TOKEN(required)Bearer token
ABNORMAL_BASE_URLhttps://api.abnormalplatform.com/v1API base URL
ABNORMAL_ALLOW_RESPONSEfalseEnable response tools (Phase 2+)
ABNORMAL_ALLOW_EVIDENCE_DOWNLOADfalseEnable evidence download (Phase 5+)
ABNORMAL_MCP_TRANSPORTstdiostdio or http

Full list: docs/configuration.md.

Security

Read tools are always on. Response and evidence tools require explicit opt-in.

Local use only: this server has no built-in authentication or RBAC. Use stdio (default) or loopback HTTP on the same machine. Do not expose the HTTP endpoint on a network without your own access controls.

See docs/security.md and SECURITY.md.

Development

bash
make checkmake test-access    # optional live API smoke testmake test-phase34   # Phase 3/4 live smoke testmake test-phase5    # Phase 5 evidence smoke test (requires ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD)

See docs/development.md.

License

Apache-2.0. See LICENSE.

Source: README.md at commit 4f7bfce

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v1.1.0LatestSep 17, 2026
  2. v1.0.1Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts