# Proofpoint MCP

Connects coding agents to Proofpoint TAP for threat lookups and incident triage. A local threat store caches events to prevent wasting daily API quotas.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/proofpoint
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/proofpoint-mcp

## What it does

The integration bridges coding assistants with the Proofpoint Targeted Attack Protection (TAP) Threat Insight API. It lets agents inspect indicators of compromise (IOCs), malicious clicks, and very attacked persons (VAPs) during security investigations.

Under the hood, the project pairs the `proofpoint-cli` binary with the `proofpoint-mcp` executable. Its internal threat store correlates records across multiple endpoints locally, finding which targets both received attacks and clicked links. This design keeps repetitive questions off your daily API limit.

Running in `--transport http` mode leaves the server exposed without authentication across all network interfaces, so the maintainers require using the default `stdio` transport instead.

## Requirements
- Environment variables: `PROOFPOINT_API_SECRET`, `PROOFPOINT_BASE_URL`, `PROOFPOINT_SERVICE_PRINCIPAL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- track which targeted users clicked on malicious links
- inspect Proofpoint TAP indicators of compromise from the terminal
- correlate security events without draining the daily API quota
- pull very attacked persons data into agent conversations

## Example prompts
- Check if user `analyst@example.com` has any recorded clicks in the local Proofpoint store.
- List all very attacked persons who clicked on a malicious URL today.
- Fetch the latest IOCs associated with recent TAP alerts.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md