abnormal-mcp
Related Servers
Alternatives to abnormal-mcp
No user-submitted related servers found.
Related Servers
- AlicenseNot gradedqualityAmaintenanceAn MCP server for Blackpoint Cyber MDR platform, enabling management of security monitoring, threat detection, and incident response through Blackpoint's API.Apache 2.0
- AlicenseAqualityAmaintenanceMCP server for Checkpoint Harmony Email & Collaboration (Avanan). Enables AI assistants to manage email security, anti-phishing, anti-malware, and threat detection via the Avanan API.131Apache 2.0
- AlicenseNot gradedqualityAmaintenanceEnables MCP clients to query Abnormal Security for threats, message search, remediation history, ATO cases, vendor/BEC data, and opt-in evidence download and response actions.Apache 2.0
- AlicenseBqualityAmaintenanceMCP server for Proofpoint Email Protection - email security, threat intelligence, TAP (Targeted Attack Protection), and email filtering API integration403Apache 2.0
- FlicenseNot gradedqualityAmaintenanceAn MCP server for Blumira SIEM platform, enabling management of security event detection, alerts, and threat response through Blumira's API.-
- AlicenseNot gradedqualityDmaintenanceAn MCP server that integrates ThreatBook's threat intelligence API, offering 15 specialized tools for security analysis. It enables AI models to perform IP reputation checks, domain investigations, file sandbox analysis, and vulnerability intelligence lookups.51MIT
TDQS
Scored across 10 tools
Each tool targets a distinct resource-action pair, but cases and threats can be slightly confused since both have get-by-ID tools. The descriptions clarify that cases group related threats, so agents should mostly select correctly, though the boundary could be clearer.
The pattern abnormal_<resource>_<verb> is mostly consistent (list/get for cases, threats, messages), but abnormal_navigate and abnormal_status break the pattern, and remediation_manage uses a vaguer verb. Overall, the convention is clear and predictable with only minor exceptions.
10 tools is well within the sweet spot for a security-focused MCP server. The count covers the major domains (cases, threats, messages, remediation, abuse reporting) without unnecessary bloat.
The core read-heavy workflows are well covered: list/get cases, threats, messages, plus remediation and abuse reports. Notable gaps include the lack of an update-case or update-threat operation, and abuse reports only support listing without a get-detail tool, but these are minor for a typical analyst workflow.