Abnormal MCP Server

Abnormal MCP Server

A secure, open-source Model Context Protocol server for Abnormal Security.

This project is not an official Abnormal product and is not endorsed by Abnormal AI.

Overview

abnormal-mcp lets MCP clients such as Cursor and Claude Desktop query Abnormal Security over stdio (default) or Streamable HTTP. It uses a lightweight handwritten client against the Abnormal Security Client API.

MCP Client
    → Abnormal MCP Server (stdio or HTTP)
        → Abnormal REST API

The server is read-only by default. Response and evidence download tools are opt-in and independent. Abnormal authorization still applies to every request.

Features

Read (always on)

• Threat list and get from the Threat Log
• Threat links and attachment metadata
• Threat action status poll (abnormalthreataction_get)
• Message search with ergonomic filters (since, sender, senderdomain, recipient, subject, url, attachment, senderip, judgement)
• Search activity list and status
• Message remediation history
• AI Security Mailbox (formerly Abuse Mailbox) campaigns and unanalyzed reports
• Employee profile, identity (Genome), and recent logins
• ATO case list, detail, and analysis
• Vendor list, detail, activity, and vendor compromise cases
• Detection 360 report list (false positives and missed attacks)
• US, EU, and FedRAMP base URLs (configurable)

Response (opt-in: ABNORMALALLOWRESPONSE=true)

• Search remediation (delete, movetoinbox) with confirm: true preview gate
• Threat remediate / unremediate with confirm: true preview gate
• ATO case status update with confirm: true preview gate
• Detection 360 report submit (false positive, missed attack/spam/graymail) with confirm: true preview gate

Evidence download (opt-in: ABNORMALALLOWEVIDENCEDOWNLOAD=true)**

• Message EML download (by ABX message ID or search cloudmessageid)
• Attachment analysis signals and attachment download
• Metadata + bounded preview by default; optional base64 embed (max 1 MiB in tool output)

• stdio transport (default) and opt-in Streamable HTTP
• Native Go binary and Docker image
• MCP Registry listing on tagged releases (io.github.GregDog/mcp-server-abnormal)

Quick Start

Create an Abnormal REST API token in the Abnormal portal under Integrations → Abnormal REST API.

export ABNORMAL_API_TOKEN="your-token"
abnormal-mcp serve

Installation

From source

git clone https://github.com/GregDog/mcp-server-abnormal.git
cd mcp-server-abnormal
make build

Docker

docker run --rm -i \
  -e ABNORMAL_API_TOKEN \
  ghcr.io/gregdog/mcp-server-abnormal serve

Client configuration

Cursor (stdio)

See examples/cursor.mcp.json.

Claude Desktop

See examples/claude-desktop.json.

Tools

27 read tools are always registered. With ABNORMALALLOWEVIDENCEDOWNLOAD=true, five evidence tools are added (32 total). With ABNORMALALLOW_RESPONSE=true, four response tools are added (31 total, or 36 with both gates enabled).

Shortened. The full README is on GitHub.