https://github.com/wyre-technology/proofpoint-mcp
MCP server for Proofpoint TAP and Essentials APIs — threat intelligence, email tracing, and MSP org management
https://github.com/wyre-technology/proofpoint-mcp
email-security mcp-server msp msp-mcp proofpoint typescript wyre-technology
Last synced: 2 days ago
JSON representation
MCP server for Proofpoint TAP and Essentials APIs — threat intelligence, email tracing, and MSP org management
- Host: GitHub
- URL: https://github.com/wyre-technology/proofpoint-mcp
- Owner: wyre-technology
- License: apache-2.0
- Created: 2026-03-02T21:01:51.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-05-30T13:38:05.000Z (13 days ago)
- Last Synced: 2026-05-30T15:14:59.542Z (13 days ago)
- Topics: email-security, mcp-server, msp, msp-mcp, proofpoint, typescript, wyre-technology
- Language: TypeScript
- Homepage: https://mcp.wyretechnology.com/mcp-servers/proofpoint/
- Size: 179 KB
- Stars: 0
- Watchers: 0
- Forks: 1
- Open Issues: 12
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# Proofpoint MCP Server
[](https://opensource.org/licenses/Apache-2.0)
[](https://nodejs.org/)
A Model Context Protocol (MCP) server for Proofpoint TAP and Essentials APIs. Enables AI assistants to investigate threats, trace emails, manage quarantine, access threat intelligence, and perform URL defense operations.
This is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that connects Claude (or any MCP-compatible AI) to your Proofpoint environment.
> **Part of the [MSP Claude Plugins](https://github.com/wyre-technology) ecosystem** — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.
## Installation
```bash
npm install @wyre-technology/proofpoint-mcp
```
## Configuration
Set the following environment variables:
| Variable | Required | Description |
|----------|----------|-------------|
| `PROOFPOINT_SERVICE_PRINCIPAL` | Yes | Your Proofpoint TAP service principal |
| `PROOFPOINT_SERVICE_SECRET` | Yes | Your Proofpoint TAP service secret |
| `PROOFPOINT_BASE_URL` | No | Custom base URL (default: tap-api-v2.proofpoint.com) |
| `MCP_TRANSPORT` | No | Transport mode: stdio (default) or http |
## Usage
### Running with Claude Desktop
Add to your Claude Desktop `claude_desktop_config.json`:
```json
{
"mcpServers": {
"proofpoint-mcp": {
"command": "npx",
"args": ["@wyre-technology/proofpoint-mcp"],
"env": {
"PROOFPOINT_SERVICE_PRINCIPAL": "your-proofpoint-service-principal"
"PROOFPOINT_SERVICE_SECRET": "your-proofpoint-service-secret"
}
}
}
}
```
### Running with Claude Code (CLI)
```bash
claude mcp add proofpoint-mcp \
-e PROOFPOINT_SERVICE_PRINCIPAL=your-value \
-e PROOFPOINT_SERVICE_SECRET=your-value \
-- npx -y @wyre-technology/proofpoint-mcp
```
### Docker
```bash
docker build -t proofpoint-mcp .
docker run \
-e PROOFPOINT_SERVICE_PRINCIPAL=your-value \
-e PROOFPOINT_SERVICE_SECRET=your-value \
-p 8080:8080 proofpoint-mcp
```
## Available Domains
### Dlp
Data loss prevention policies
### Events
Security event stream and SIEM export
### Forensics
Forensic analysis of threats
### People
Very Attacked People (VAP) reporting
### Policy
Email policy management
### Quarantine
Email quarantine management
### Reports
Security reports and summaries
### Smart Search
Advanced email search
### Tap
Targeted Attack Protection events and campaigns
### Threat Intel
Threat intelligence and indicators of compromise
### Url Defense
URL rewriting and click defense
## Development
```bash
# Clone the repository
git clone https://github.com/wyre-technology/proofpoint-mcp.git
cd proofpoint-mcp
# Install dependencies
npm install
# Build
npm run build
# Run tests
npm test
```
## Contributing
Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) if present, or open an issue to discuss changes.
## License
Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.