Ironscales

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.2.1Updated Oct 24, 2026

MCP server for Ironscales phishing incident management — incidents, mailboxes, and reporting.

VerifiedSTDIODesktop onlyCommunication & CollaborationSecurity & Monitoring

Overview

AI-generated overview

Connects an AI assistant to Ironscales email security so it can investigate phishing incidents, manage email classification, run remediations and view stats.

What you can do
  • Investigate and triage phishing incidents, including an interactive incident card in MCP Apps hosts
  • Investigate and classify email, and manage allowlists and blocklists
  • Execute email remediations and quarantine actions
  • View security statistics and reporting
When to use it
Useful for security or managed-service teams that run Ironscales and want an assistant to triage phishing incidents, check email classification and carry out remediation from the chat instead of the Ironscales console.
Requirements
Runs as a local process (npm package or Docker image) over stdio, or as an HTTP container for gateway hosting. Needs an Ironscales API key in IRONSCALES_API_KEY and a company identifier in IRONSCALES_COMPANY_ID; AUTH_MODE selects local env credentials or gateway header injection.
Before you install
Requires an Ironscales API key, which grants access to your tenant's email security data. The server can execute remediations and quarantine emails, which changes mailbox state, so review actions before approving them. Incident data is sent to the Ironscales API and rendered in the assistant host.

Installation

In SourceWeft

  1. Open Ironscales in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Ironscales MCP Server

[License] [Node.js]

A Model Context Protocol (MCP) server for Ironscales email security. Enables AI assistants to investigate phishing incidents, manage email classification, execute remediations, and view security statistics.

This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Ironscales environment.

Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.

Interactive Incident Card (MCP Apps)

ironscales_incidents_get renders as an interactive card in MCP Apps hosts (Claude Desktop/web) showing the phishing incident's subject, status, severity, sender, affected recipients, and threat indicators; plain-JSON behavior is unchanged in other hosts. The card is read-only — remediation stays with the model-driven remediation tools. It is neutral by default and brandable via window.__BRAND__ injection or MCP_BRAND_* env vars (MCP_BRAND_NAME, MCP_BRAND_LOGO_URL, MCP_BRAND_PRIMARY_COLOR, MCP_BRAND_ACCENT_COLOR, MCP_BRAND_BG, MCP_BRAND_TEXT) — no rebuild needed.

Installation

bash
npm install @wyre-ai/ironscales-mcp

Configuration

Set the following environment variables:

VariableRequiredDescription
IRONSCALES_API_KEYYesYour Ironscales API key
IRONSCALES_COMPANY_IDYesYour Ironscales company ID
MCP_TRANSPORTNoTransport mode: stdio (default) or http

Usage

Running with Claude Desktop

Add to your Claude Desktop claude_desktop_config.json:

json
{  "mcpServers": {    "ironscales-mcp": {      "command": "npx",      "args": ["@wyre-ai/ironscales-mcp"],      "env": {        "IRONSCALES_API_KEY": "your-ironscales-api-key"        "IRONSCALES_COMPANY_ID": "your-ironscales-company-id"      }    }  }}

Running with Claude Code (CLI)

bash
claude mcp add ironscales-mcp \  -e IRONSCALES_API_KEY=your-value \  -e IRONSCALES_COMPANY_ID=your-value \  -- npx -y @wyre-ai/ironscales-mcp

Docker

bash
docker build -t ironscales-mcp .docker run \  -e IRONSCALES_API_KEY=your-value \  -e IRONSCALES_COMPANY_ID=your-value \  -p 8080:8080 ironscales-mcp

Available Domains

Allowlist

Manage email allowlists and blocklists

Email

Email investigation and classification

Incidents

Phishing incident management and triage

Remediation

Execute email remediations and quarantine

Stats

Security statistics and reporting

Development

bash
# Clone the repositorygit clone https://github.com/WYRE-AI/ironscales-mcp.gitcd ironscales-mcp
# Install dependenciesnpm install
# Buildnpm run build
# Run testsnpm test

Contributing

Contributions are welcome! Please see CONTRIBUTING.md if present, or open an issue to discuss changes.

License

Licensed under the Apache License, Version 2.0. See LICENSE for details.

Source: README.md at commit 62a7fe7

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts