Proofpoint MCP — Claude Code MCP server: features and setup
Connects coding agents to Proofpoint TAP for threat lookups and incident triage. A local threat store caches events to prevent wasting daily API quotas.
Open on GitHubWhat Proofpoint MCP does
The integration bridges coding assistants with the Proofpoint Targeted Attack Protection (TAP) Threat Insight API. It lets agents inspect indicators of compromise (IOCs), malicious clicks, and very attacked persons (VAPs) during security investigations.
Under the hood, the project pairs the proofpoint-cli binary with the proofpoint-mcp executable. Its internal threat store correlates records across multiple endpoints locally, finding which targets both received attacks and clicked links. This design keeps repetitive questions off your daily API limit.
Running in --transport http mode leaves the server exposed without authentication across all network interfaces, so the maintainers require using the default stdio transport instead.
What it helps with
- track which targeted users clicked on malicious links
- inspect Proofpoint TAP indicators of compromise from the terminal
- correlate security events without draining the daily API quota
- pull very attacked persons data into agent conversations
Example prompts for the agent
- Check if user
[email protected]has any recorded clicks in the local Proofpoint store. - List all very attacked persons who clicked on a malicious URL today.
- Fetch the latest IOCs associated with recent TAP alerts.
How to install Proofpoint MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Proofpoint MCP
How do I install Proofpoint MCP in Claude Code?
Add the marketplace by running /plugin marketplace add Servosity/msp-skills and install the tool using /plugin install proofpoint@msp-skills. You can also run the shell script bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/proofpoint/install.sh).
What does Proofpoint MCP do?
It exposes Proofpoint TAP endpoints to your agent and stores threat data locally. This lets you ask cross-endpoint questions about threats and users without consuming API requests.
Why should you avoid HTTP transport mode?
The current --transport http implementation lacks authentication and binds to all network interfaces. You should stick with the standard stdio transport until an updated build addresses this.
