abnormal-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AUTH_MODE | No | Authentication mode. Set to 'gateway' when deployed behind MCP gateway. Default is standalone. | |
| MCP_TRANSPORT | No | Transport mode for the server. Set to 'http' for HTTP Streamable deployment. | |
| ABNORMAL_API_TOKEN | No | Your Abnormal Security API token. Generate in Abnormal portal under Settings > Integrations > API. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| abnormal_navigateA | Discover available Abnormal Security tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite. |
| abnormal_statusC | Show connection status and available domains |
| abnormal_threats_listB | List detected threats and cases from Abnormal Security. Returns a paginated list of threat IDs with summary information. |
| abnormal_threats_getA | Get detailed information about a specific threat case by ID. Returns threat details including classification, severity, and related message IDs. |
| abnormal_messages_listB | List messages contained within a specific threat case. Returns message IDs and summary data for all emails associated with the threat. |
| abnormal_messages_getA | Get detailed analysis of a specific message within a threat case. Returns full message metadata, headers, URLs, attachments, and AI-based threat analysis. |
| abnormal_remediation_manageA | Trigger or check the status of a remediation action for a specific threat message. Supports requesting remediation (removal from mailboxes) or checking current remediation status. |
| abnormal_abuse_listA | List phishing emails reported by users via the Abuse Mailbox. Returns user-submitted reports with analysis results indicating whether Abnormal confirmed the threat. |
| abnormal_cases_listB | List all active security investigation cases in Abnormal Security. Cases group related threats for analyst review and workflow management. |
| abnormal_cases_getA | Get detailed information about a specific security case by ID. Returns case status, analyst notes, associated threats, and timeline. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Abnormal Security Threat Card | Interactive MCP Apps card rendering an Abnormal Security threat (read-only) |
TDQS
Scored across 10 tools
Each tool targets a distinct resource-action pair, but cases and threats can be slightly confused since both have get-by-ID tools. The descriptions clarify that cases group related threats, so agents should mostly select correctly, though the boundary could be clearer.
The pattern abnormal_<resource>_<verb> is mostly consistent (list/get for cases, threats, messages), but abnormal_navigate and abnormal_status break the pattern, and remediation_manage uses a vaguer verb. Overall, the convention is clear and predictable with only minor exceptions.
10 tools is well within the sweet spot for a security-focused MCP server. The count covers the major domains (cases, threats, messages, remediation, abuse reporting) without unnecessary bloat.
The core read-heavy workflows are well covered: list/get cases, threats, messages, plus remediation and abuse reports. Notable gaps include the lack of an update-case or update-threat operation, and abuse reports only support listing without a get-detail tool, but these are minor for a typical analyst workflow.