Abnormal Security
Connects Claude to Abnormal Security's threat detection platform via their REST API. You get tools to query detected threats, inspect individual messages with AI analysis breakdowns, trigger email remediation actions, review abuse mailbox reports, and manage security investigation cases. Uses a decision tree pattern where you call abnormal_navigate first to pick a domain (threats, messages, remediation, abuse, or cases), then access domain-specific operations. Supports both standalone mode with direct API token auth and gateway mode for hosted deployments. Reach for this when you need Claude to triage email security incidents, investigate phishing campaigns, or automate response workflows against Abnormal's threat intelligence.
- tools
- 10
- auth
- Secret needed
- transport
- STDIO
- env vars
- 4
- last updated
- Aug 20, 2026
Tools
10 toolsPublic tool metadata for what this MCP can expose to an agent.
abnormal_navigateNavigate to a domain (threats, messages, remediation, abuse, cases)
Navigate to a domain (threats, messages, remediation, abuse, cases)
No parameter schema in public metadata yet.
abnormal_backReturn to domain selection
Return to domain selection
No parameter schema in public metadata yet.
abnormal_threats_listList detected threat cases (paginated)
List detected threat cases (paginated)
No parameter schema in public metadata yet.
abnormal_threats_getGet full details of a specific threat by ID
Get full details of a specific threat by ID
No parameter schema in public metadata yet.
abnormal_messages_listList messages within a threat case
List messages within a threat case
No parameter schema in public metadata yet.
abnormal_messages_getGet detailed message analysis (headers, URLs, attachments, AI analysis)
Get detailed message analysis (headers, URLs, attachments, AI analysis)
No parameter schema in public metadata yet.
abnormal_remediation_manageTrigger or check remediation actions for a message
Trigger or check remediation actions for a message
No parameter schema in public metadata yet.
abnormal_abuse_listList phishing emails reported via the Abuse Mailbox
List phishing emails reported via the Abuse Mailbox
No parameter schema in public metadata yet.
abnormal_cases_listList active security investigation cases
List active security investigation cases
No parameter schema in public metadata yet.
abnormal_cases_getGet details of a specific case
Get details of a specific case
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
ABNORMAL_API_TOKEN*secretAbnormal Security API token (Bearer credential)
MCP_TRANSPORTdefault: stdioTransport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
AUTH_MODEdefault: envCredential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
LOG_LEVELdefault: infoLog verbosity: debug, info, warn, error
Readme
abnormal-mcp
MCP server for Abnormal Security — AI-powered threat detection, case management, and email remediation.
Tools
This server uses a decision-tree architecture. Start by calling abnormal_navigate to select a domain, then use the domain-specific tools.
Navigation
| Tool | Description |
|---|---|
abnormal_navigate | Navigate to a domain (threats, messages, remediation, abuse, cases) |
abnormal_back | Return to domain selection |
Threats domain
| Tool | Description |
|---|---|
abnormal_threats_list | List detected threat cases (paginated) |
abnormal_threats_get | Get full details of a specific threat by ID |
Messages domain
| Tool | Description |
|---|---|
abnormal_messages_list | List messages within a threat case |
abnormal_messages_get | Get detailed message analysis (headers, URLs, attachments, AI analysis) |
Remediation domain
| Tool | Description |
|---|---|
abnormal_remediation_manage | Trigger or check remediation actions for a message |
Abuse domain
Details
- Repository
- github.com/wyre-technology/abnormal-mcp
- Website
- github.com/wyre-technology/abnormal-mcp
- Categories
- Communication & Messaging, Security & Pentesting
- Package
ghcr.io/wyre-technology/abnormal-mcp:v1.2.5- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
More from wyre-technology
Related Communication & Messaging MCP servers
View all
multi-mailyybd/multi-mail-mcpSeveral Gmail accounts: search, read, draft, send, labels and Google Calendar. Own OAuth client.0stars
Microsoft 365 Teamsmindstone/mcp-serversMicrosoft 365 Teams via Graph: list chats, read/send messages, list teams/channels, presence.0stars
Outlook Emailmintmcp/serversA MCP server for Outlook email that lets you search, read, and draft emails and replies.0stars
Resend Email MCPhelbertparanhos/resend-email-mcpComplete Resend email MCP: full API coverage + debug layer (deliverability, DNS, bounces).1stars
Email Mcpmarlinjai/email-mcpUnified email MCP server for Gmail, Outlook, iCloud, and IMAP with batch operations13stars
HTML Email Playbookosamahassouna/docs-hubTeaches AI to write HTML email that renders in Outlook, Gmail, and Apple Mail. 21 rules, 6 comps.0stars