# Abnormal Security MCP

Connects Abnormal Security API tools to coding agents for email threat triage, remediation, and reporting. Helpful for security analysts running SOC workflows from the terminal.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/abnormal
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/abnormal-security-mcp

## What it does

This integration exposes the Abnormal Security platform to your local development environment. It includes a persistent local threat cache, prioritized SOC incident sorting, automated remediation controls, and one-pass client summary generation. The server interacts directly with the `abnormal-cli` companion binary to execute requests against the vendor API.

Running the server with the `--transport http` flag exposes your machine to severe security risks. In this build, HTTP mode binds to every network interface without authentication and lacks DNS rebinding protection. Any malicious web page opened in your browser can execute actions using your saved API credentials. Use standard `stdio` transport exclusively.

For setup in Claude Code, install it via the community marketplace. Other environments can fetch prebuilt binaries with Bash or PowerShell scripts. When using standalone desktop extensions that lack the bundled companion, configure the `ABNORMAL_CLI_PATH` environment variable pointing to your manual CLI installation.

## Requirements
- Environment variables: `ABNORMAL_API_TOKEN`, `ABNORMAL_BASE_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- prioritize email security incidents during SOC triage
- trigger remediation blocks for detected email threats
- generate client-ready incident summaries in one turn
- query Abnormal Security endpoints using local stdio transport

## Example prompts
- List all high-priority email threats detected by Abnormal Security today
- Generate a remediation report for recent suspicious mailbox activities
- Check incident details for the latest phishing case and isolate the sender

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md