{"id":50735394,"url":"https://github.com/wyre-technology/abnormal-mcp","last_synced_at":"2026-06-10T13:01:22.365Z","repository":{"id":354581370,"uuid":"1171071158","full_name":"wyre-technology/abnormal-mcp","owner":"wyre-technology","description":"MCP server for Abnormal Security — AI-powered threat detection, case management, and email remediation","archived":false,"fork":false,"pushed_at":"2026-05-19T15:26:48.000Z","size":122,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-19T18:51:00.734Z","etag":null,"topics":["abnormal-security","email-security","mcp-server","msp","msp-mcp","typescript","wyre-technology"],"latest_commit_sha":null,"homepage":"https://mcp.wyretechnology.com/mcp-servers/abnormal/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wyre-technology.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-02T20:58:50.000Z","updated_at":"2026-05-19T15:36:30.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/wyre-technology/abnormal-mcp","commit_stats":null,"previous_names":["wyre-technology/abnormal-mcp"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/wyre-technology/abnormal-mcp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wyre-technology%2Fabnormal-mcp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wyre-technology%2Fabnormal-mcp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wyre-technology%2Fabnormal-mcp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wyre-technology%2Fabnormal-mcp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wyre-technology","download_url":"https://codeload.github.com/wyre-technology/abnormal-mcp/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wyre-technology%2Fabnormal-mcp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34153483,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-10T02:00:07.152Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["abnormal-security","email-security","mcp-server","msp","msp-mcp","typescript","wyre-technology"],"created_at":"2026-06-10T13:01:21.204Z","updated_at":"2026-06-10T13:01:22.344Z","avatar_url":"https://github.com/wyre-technology.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# abnormal-mcp\n\nMCP server for [Abnormal Security](https://abnormalsecurity.com/) — AI-powered threat detection, case management, and email remediation.\n\n## Tools\n\nThis server uses a decision-tree architecture. Start by calling `abnormal_navigate` to select a domain, then use the domain-specific tools.\n\n### Navigation\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_navigate` | Navigate to a domain (threats, messages, remediation, abuse, cases) |\n| `abnormal_back` | Return to domain selection |\n\n### Threats domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_threats_list` | List detected threat cases (paginated) |\n| `abnormal_threats_get` | Get full details of a specific threat by ID |\n\n### Messages domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_messages_list` | List messages within a threat case |\n| `abnormal_messages_get` | Get detailed message analysis (headers, URLs, attachments, AI analysis) |\n\n### Remediation domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_remediation_manage` | Trigger or check remediation actions for a message |\n\n### Abuse domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_abuse_list` | List phishing emails reported via the Abuse Mailbox |\n\n### Cases domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_cases_list` | List active security investigation cases |\n| `abnormal_cases_get` | Get details of a specific case |\n\n## Authentication\n\nAbnormal Security uses Bearer token authentication.\n\n### Standalone (env mode)\n\n```bash\nexport ABNORMAL_API_TOKEN=your-api-token\nnode dist/index.js\n```\n\nGenerate your token in the Abnormal portal under **Settings \u003e Integrations \u003e API**.\n\n### Gateway mode\n\nWhen deployed behind the MCP gateway, set `AUTH_MODE=gateway`. The gateway injects the `Authorization: Bearer {token}` header automatically on each request.\n\n## Running\n\n### stdio (for Claude Desktop)\n\n```bash\nnpm install\nnpm run build\nnode dist/index.js\n```\n\n### HTTP Streamable (for hosted/gateway deployment)\n\n```bash\nMCP_TRANSPORT=http AUTH_MODE=gateway node dist/index.js\n```\n\n### Docker\n\n```bash\ndocker compose up\n```\n\n## Development\n\n```bash\nnpm install\nnpm run dev          # watch mode\nnpm test             # run tests\nnpm run typecheck    # TypeScript type check\n```\n\n## License\n\nApache-2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwyre-technology%2Fabnormal-mcp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwyre-technology%2Fabnormal-mcp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwyre-technology%2Fabnormal-mcp/lists"}