Proofpoint — Claude Code MCP server: what it does, how to install
Connects AI assistants to Proofpoint TAP APIs for threat forensics, quarantine reviews, and URL defense operations.
claude mcp add --env PROOFPOINT_SERVICE_PRINCIPAL=<PROOFPOINT_SERVICE_PRINCIPAL> --env PROOFPOINT_SERVICE_SECRET=<PROOFPOINT_SERVICE_SECRET> --env PROOFPOINT_BASE_URL=<PROOFPOINT_BASE_URL> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env AUTH_MODE=<AUTH_MODE> --transport stdio proofpoint -- docker run -i --rm -e PROOFPOINT_SERVICE_PRINCIPAL -e PROOFPOINT_SERVICE_SECRET -e PROOFPOINT_BASE_URL -e MCP_TRANSPORT -e AUTH_MODE ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6What Proofpoint does
This server connects Proofpoint threat intelligence with AI assistants via the Model Context Protocol. Connected models can inspect Targeted Attack Protection records, evaluate DLP policy violations, trace emails, and view Very Attacked People metrics. The proofpoint_threat_get_by_id tool returns visual interactive cards showing campaign names and malware families in compatible hosts.
Deployments run via standard input/output or over HTTP. In HTTP transport mode, the process enforces HMAC verification through CONDUIT_S2S_SECRET and exits immediately if placeholder passwords are detected. Setting valid TAP API credentials is mandatory for fetching threat data.
What it helps with
- retrieve threat telemetry and actor details by threat ID
- inspect rewritten links using URL Defense
- search recent email message events across domains
- track targeted accounts in Very Attacked People reports
- audit items held inside the mail quarantine
Example prompts for the agent
- Inspect threat details for ID using proofpoint_threat_get_by_id
- List recently quarantined emails for domain test.com
- Fetch security reports for targeted users from the VAP list
How to install Proofpoint
Platform CLI
claude mcp add --env PROOFPOINT_SERVICE_PRINCIPAL=<PROOFPOINT_SERVICE_PRINCIPAL> --env PROOFPOINT_SERVICE_SECRET=<PROOFPOINT_SERVICE_SECRET> --env PROOFPOINT_BASE_URL=<PROOFPOINT_BASE_URL> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env AUTH_MODE=<AUTH_MODE> --transport stdio proofpoint -- docker run -i --rm -e PROOFPOINT_SERVICE_PRINCIPAL -e PROOFPOINT_SERVICE_SECRET -e PROOFPOINT_BASE_URL -e MCP_TRANSPORT -e AUTH_MODE ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6Replace <…> with your own values. 1 more environment variable is in the server README
Platform CLI
codex mcp add proofpoint --env PROOFPOINT_SERVICE_PRINCIPAL=<PROOFPOINT_SERVICE_PRINCIPAL> --env PROOFPOINT_SERVICE_SECRET=<PROOFPOINT_SERVICE_SECRET> --env PROOFPOINT_BASE_URL=<PROOFPOINT_BASE_URL> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env AUTH_MODE=<AUTH_MODE> -- docker run -i --rm -e PROOFPOINT_SERVICE_PRINCIPAL -e PROOFPOINT_SERVICE_SECRET -e PROOFPOINT_BASE_URL -e MCP_TRANSPORT -e AUTH_MODE ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6Replace <…> with your own values. 1 more environment variable is in the server README
Config file
{
"mcpServers": {
"proofpoint": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"PROOFPOINT_SERVICE_PRINCIPAL",
"-e",
"PROOFPOINT_SERVICE_SECRET",
"-e",
"PROOFPOINT_BASE_URL",
"-e",
"MCP_TRANSPORT",
"-e",
"AUTH_MODE",
"ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6"
],
"env": {
"PROOFPOINT_SERVICE_PRINCIPAL": "<PROOFPOINT_SERVICE_PRINCIPAL>",
"PROOFPOINT_SERVICE_SECRET": "<PROOFPOINT_SERVICE_SECRET>",
"PROOFPOINT_BASE_URL": "<PROOFPOINT_BASE_URL>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"AUTH_MODE": "<AUTH_MODE>"
}
}
}
}Replace <…> with your own values. 1 more environment variable is in the server README
Config file
{
"servers": {
"proofpoint": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"PROOFPOINT_SERVICE_PRINCIPAL",
"-e",
"PROOFPOINT_SERVICE_SECRET",
"-e",
"PROOFPOINT_BASE_URL",
"-e",
"MCP_TRANSPORT",
"-e",
"AUTH_MODE",
"ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6"
],
"env": {
"PROOFPOINT_SERVICE_PRINCIPAL": "<PROOFPOINT_SERVICE_PRINCIPAL>",
"PROOFPOINT_SERVICE_SECRET": "<PROOFPOINT_SERVICE_SECRET>",
"PROOFPOINT_BASE_URL": "<PROOFPOINT_BASE_URL>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"AUTH_MODE": "<AUTH_MODE>"
}
}
}
}Replace <…> with your own values. 1 more environment variable is in the server README
Platform CLI
gemini mcp add -e PROOFPOINT_SERVICE_PRINCIPAL=<PROOFPOINT_SERVICE_PRINCIPAL> -e PROOFPOINT_SERVICE_SECRET=<PROOFPOINT_SERVICE_SECRET> -e PROOFPOINT_BASE_URL=<PROOFPOINT_BASE_URL> -e MCP_TRANSPORT=<MCP_TRANSPORT> -e AUTH_MODE=<AUTH_MODE> proofpoint docker run -i --rm -e PROOFPOINT_SERVICE_PRINCIPAL -e PROOFPOINT_SERVICE_SECRET -e PROOFPOINT_BASE_URL -e MCP_TRANSPORT -e AUTH_MODE ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6Replace <…> with your own values. 1 more environment variable is in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Proofpoint
How do I install Proofpoint in Claude Code?
Register the container using the command: `claude mcp add --env PROOFPOINT_SERVICE_PRINCIPAL=<PROOFPOINT_SERVICE_PRINCIPAL> --env PROOFPOINT_SERVICE_SECRET=<PROOFPOINT_SERVICE_SECRET> --env PROOFPOINT_BASE_URL=<PROOFPOINT_BASE_URL> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env AUTH_MODE=<AUTH_MODE> --transport stdio proofpoint -- docker run -i --rm -e PROOFPOINT_SERVICE_PRINCIPAL -e PROOFPOINT_SERVICE_SECRET -e PROOFPOINT_BASE_URL -e MCP_TRANSPORT -e AUTH_MODE ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6`.
What does the Proofpoint MCP server do?
It gives LLMs direct access to Proofpoint TAP and Essentials data. The assistant can evaluate threats, inspect quarantine messages, and review URL security logs.
What credentials are needed to run the server?
The default stdio transport expects PROOFPOINT_SERVICE_PRINCIPAL and PROOFPOINT_SERVICE_SECRET. Running the HTTP server also requires generating a secret for CONDUIT_S2S_SECRET.
