Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
One-click editor setup isn’t available for this listing yet — we don’t have a confirmed install command, and we’d rather show nothing than point your editor at the wrong package or host. Follow the project’s own setup instructions, linked above.
Manual Client & Custom JSON ConfigExpand JSON ▾
No confirmed setup config for this listing yet. We only publish a config block when the install details come from the project itself — its README, its docs, or a verified owner. We haven’t found those for Abnormal MCP Server, and we’d rather show nothing than a guess you’d paste into your client. Follow the project’s own setup instructions for the current steps.
Documentation Overview
Abnormal MCP Server
A secure, open-source Model Context Protocol server for Abnormal Security.
This project is not an official Abnormal product and is not endorsed by Abnormal AI.
Overview
abnormal-mcp lets MCP clients such as Cursor and Claude Desktop query Abnormal Security over stdio (default) or Streamable HTTP. It uses a lightweight handwritten client against the Abnormal Security Client API.
The server is read-only by default. Response and evidence download tools are opt-in and independent. Abnormal authorization still applies to every request.
Features
Read (always on)
- Threat list and get from the Threat Log
- Threat links and attachment metadata
- Threat action status poll (
abnormal_threat_action_get) - Message search with ergonomic filters (
since,sender,sender_domain,recipient,subject,url,attachment,sender_ip,judgement) - Search activity list and status
- Message remediation history
- AI Security Mailbox (formerly Abuse Mailbox) campaigns and unanalyzed reports
- Employee profile, identity (Genome), and recent logins
- ATO case list, detail, and analysis
- Vendor list, detail, activity, and vendor compromise cases
- Detection 360 report list (false positives and missed attacks)
- US, EU, and FedRAMP base URLs (configurable)
Response (opt-in: ABNORMAL_ALLOW_RESPONSE=true)
- Search remediation (
delete,move_to_inbox) withconfirm: truepreview gate - Threat remediate / unremediate with
confirm: truepreview gate - ATO case status update with
confirm: truepreview gate - Detection 360 report submit (false positive, missed attack/spam/graymail) with
confirm: truepreview gate
Evidence download (opt-in: ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD=true)
-
Message EML download (by ABX message ID or search
cloud_message_id) -
Attachment analysis signals and attachment download
-
Metadata + bounded preview by default; optional base64 embed (max 1 MiB in tool output)
-
stdio transport (default) and opt-in Streamable HTTP
-
Native Go binary and Docker image
-
MCP Registry listing on tagged releases (
io.github.GregDog/mcp-server-abnormal)
Quick Start
Create an Abnormal REST API token in the Abnormal portal under Integrations → Abnormal REST API.
Installation
From source
Docker
Client configuration
Cursor (stdio)
Claude Desktop
See examples/claude-desktop.json.
Tools
27 read tools are always registered. With ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD=true, five evidence tools are added (32 total). With ABNORMAL_ALLOW_RESPONSE=true, four response tools are added (31 total, or 36 with both gates enabled).
| Area | Tools |
|---|---|
| Threats | abnormal_threats_list, abnormal_threat_get, abnormal_threat_action_get, abnormal_threat_links_list, abnormal_threat_attachments_list |
| Search | abnormal_search_messages, abnormal_search_activities_list, abnormal_search_activity_get |
| Messages | abnormal_message_remediation_history |
| Mailbox | abnormal_mailbox_campaigns_list, abnormal_mailbox_campaign_get, abnormal_mailbox_unanalyzed_list |
| Employees | abnormal_employee_get, abnormal_employee_identity_get, abnormal_employee_logins_list |
| ATO cases | abnormal_cases_list, abnormal_case_get, abnormal_case_analysis_get, abnormal_case_action_get |
| Vendors | abnormal_vendors_list, abnormal_vendor_get, abnormal_vendor_activity_list, abnormal_vendor_cases_list, abnormal_vendor_case_get |
| Detection 360 | abnormal_detection360_reports_list |
| URL rewrite | abnormal_url_rewrite_clicks_list |
| Audit logs | abnormal_audit_logs_list |
| Evidence (opt-in) | abnormal_message_eml_get, abnormal_search_message_eml_get, abnormal_message_attachment_get, abnormal_message_attachment_download, abnormal_search_attachment_download |
| Response (opt-in) | abnormal_search_remediate, abnormal_threat_remediate, abnormal_case_update, abnormal_detection360_report_submit |
See docs/tools.md for parameters.
Configuration
| Variable | Default | Purpose |
|---|---|---|
ABNORMAL_API_TOKEN | (required) | Bearer token |
ABNORMAL_BASE_URL | https://api.abnormalplatform.com/v1 | API base URL |
ABNORMAL_ALLOW_RESPONSE | false | Enable response tools (Phase 2+) |
ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD | false | Enable evidence download (Phase 5+) |
ABNORMAL_MCP_TRANSPORT | stdio | stdio or http |
Full list: docs/configuration.md.
Security
Read tools are always on. Response and evidence tools require explicit opt-in.
Local use only: this server has no built-in authentication or RBAC. Use stdio (default) or loopback HTTP on the same machine. Do not expose the HTTP endpoint on a network without your own access controls.
See docs/security.md and SECURITY.md.
Development
See docs/development.md.
License
Apache-2.0. See LICENSE.
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Abnormal MCP Server
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/abnormal-mcp-server)HTML Embed
<a href="https://allmcps.com/mcp/abnormal-mcp-server"><img src="https://allmcps.com/api/badge/abnormal-mcp-server?style=directory" alt="Abnormal MCP Server on AllMCPs" /></a>Technical Specs & Signals
CategoryDeveloper Tools
27Quality signal: Emerging · 27/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership8/20
Documentation & tools11/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.