{
  "markdown": "# abnormal-mcp\n\nMCP server for [Abnormal Security](https://abnormalsecurity.com/) — AI-powered threat detection, case management, and email remediation.\n\n## Tools\n\nThis server uses a decision-tree architecture. Start by calling `abnormal_navigate` to select a domain, then use the domain-specific tools.\n\n### Navigation\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_navigate` | Navigate to a domain (threats, messages, remediation, abuse, cases) |\n| `abnormal_back` | Return to domain selection |\n\n### Threats domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_threats_list` | List detected threat cases (paginated) |\n| `abnormal_threats_get` | Get full details of a specific threat by ID |\n\n### Messages domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_messages_list` | List messages within a threat case |\n| `abnormal_messages_get` | Get detailed message analysis (headers, URLs, attachments, AI analysis) |\n\n### Remediation domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_remediation_manage` | Trigger or check remediation actions for a message |\n\n### Abuse domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_abuse_list` | List phishing emails reported via the Abuse Mailbox |\n\n### Cases domain\n\n| Tool | Description |\n|------|-------------|\n| `abnormal_cases_list` | List active security investigation cases |\n| `abnormal_cases_get` | Get details of a specific case |\n\n### Interactive Threat Card (MCP Apps)\n\n- `abnormal_threats_get` renders as an interactive threat card in MCP Apps\n  hosts (Claude Desktop/web): subject, sender, attack classification,\n  remediation status, and the messages in the threat. The card is read-only —\n  remediation stays a deliberate, model-mediated action. Plain-JSON behavior\n  is unchanged in other hosts. Neutral by default, brandable via\n  `window.__BRAND__` injection or `MCP_BRAND_*` env vars (`MCP_BRAND_NAME`,\n  `MCP_BRAND_LOGO_URL`, `MCP_BRAND_PRIMARY_COLOR`, `MCP_BRAND_ACCENT_COLOR`,\n  `MCP_BRAND_BG`, `MCP_BRAND_TEXT`) — no rebuild needed.\n\n## Authentication\n\nAbnormal Security uses Bearer token authentication.\n\n### Standalone (env mode)\n\n```bash\nexport ABNORMAL_API_TOKEN=your-api-token\nnode dist/index.js\n```\n\nGenerate your token in the Abnormal portal under **Settings > Integrations > API**.\n\n### Gateway mode\n\nWhen deployed behind the MCP gateway, set `AUTH_MODE=gateway`. The gateway injects the `Authorization: Bearer {token}` header automatically on each request.\n\n## Running\n\n### stdio (for Claude Desktop)\n\n```bash\nnpm install\nnpm run build\nnode dist/index.js\n```\n\n### HTTP Streamable (for hosted/gateway deployment)\n\n```bash\nMCP_TRANSPORT=http AUTH_MODE=gateway node dist/index.js\n```\n\n### Docker\n\n```bash\ndocker compose up\n```\n\n## Development\n\n```bash\nnpm install\nnpm run dev          # watch mode\nnpm test             # run tests\nnpm run typecheck    # TypeScript type check\nnpm run build:ui     # rebuild the MCP Apps card bundle (only needed when ui/ changes)\n```\n\n## License\n\nApache-2.0\n",
  "bytes": 3030,
  "sha": "f7f8921862db169c25bc2948ea1caf38aac711945315c8ac31b811b3c03a31bd",
  "repo_slug": "wyre-ai/abnormal-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_wyre_ai_abnormal_mcp_653a9040/readme"
}