Abnormal Security MCP — Claude Code MCP server: install
Connects Abnormal Security API tools to coding agents for email threat triage, remediation, and reporting. Helpful for security analysts running SOC workflows from the terminal.
Open on GitHubWhat Abnormal Security MCP does
This integration exposes the Abnormal Security platform to your local development environment. It includes a persistent local threat cache, prioritized SOC incident sorting, automated remediation controls, and one-pass client summary generation. The server interacts directly with the abnormal-cli companion binary to execute requests against the vendor API.
Running the server with the --transport http flag exposes your machine to severe security risks. In this build, HTTP mode binds to every network interface without authentication and lacks DNS rebinding protection. Any malicious web page opened in your browser can execute actions using your saved API credentials. Use standard stdio transport exclusively.
For setup in Claude Code, install it via the community marketplace. Other environments can fetch prebuilt binaries with Bash or PowerShell scripts. When using standalone desktop extensions that lack the bundled companion, configure the ABNORMAL_CLI_PATH environment variable pointing to your manual CLI installation.
What it helps with
- prioritize email security incidents during SOC triage
- trigger remediation blocks for detected email threats
- generate client-ready incident summaries in one turn
- query Abnormal Security endpoints using local stdio transport
Example prompts for the agent
- List all high-priority email threats detected by Abnormal Security today
- Generate a remediation report for recent suspicious mailbox activities
- Check incident details for the latest phishing case and isolate the sender
How to install Abnormal Security MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Abnormal Security MCP
How do I install Abnormal Security MCP in Claude Code?
Run /plugin marketplace add Servosity/msp-skills first, then run /plugin install abnormal@msp-skills to complete the installation.
What features does Abnormal Security MCP provide?
It provides tools to inspect email security incidents, manage automated remediation, and build client reports directly inside your agent sessions.
Why should I avoid the HTTP transport flag?
The --transport http parameter binds unauthenticated services across all local network interfaces without origin protections. Using stdio transport prevents untrusted browser tabs from executing privileged security commands on your machine.
