avanan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_TRANSPORT | No | Transport mode: stdio (default) or http | stdio |
| CHECKPOINT_REGION | No | API region (default: us) | us |
| CHECKPOINT_CLIENT_ID | Yes | Your Checkpoint/Avanan OAuth2 client ID | |
| CHECKPOINT_CLIENT_SECRET | Yes | Your Checkpoint/Avanan OAuth2 client secret |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hec_query_eventsB | Query Checkpoint Harmony Email security events (phishing, malware, DLP, anomaly, shadow IT, etc.). Supports filtering by type, state, severity, date range, and SaaS platform. Returns events with available remediation actions. |
| hec_get_eventB | Get full details for a specific security event by ID. |
| hec_search_emailsB | Search email and SaaS entities in Checkpoint Harmony Email. Filter by sender, recipient, subject, SaaS platform, and date range. Use extended filters for precise attribute matching (contains, startsWith, isEmpty, etc.). |
| hec_get_emailA | Get full details for a specific email entity by its entity ID. |
| hec_quarantine_eventsA | ⚠ HIGH-IMPACT. Quarantine one or more security events by event ID. Quarantining is reversible via restore but affects user access to events. Returns task IDs to track progress. Confirm with the user before invoking. |
| hec_restore_eventsA | Restore one or more previously quarantined events by event ID. Returns task IDs to track progress. |
| hec_quarantine_emailsA | ⚠ HIGH-IMPACT. Quarantine specific email entities by entity ID. Quarantining is reversible via restore but affects user access to emails. Returns task IDs to track progress. Confirm with the user before invoking. |
| hec_restore_emailsB | Restore specific quarantined email entities by entity ID. |
| hec_get_task_statusA | Check the status of an action task (quarantine/restore). Use the taskId returned by quarantine or restore tools. |
| hec_list_exceptionsB | List whitelist or blacklist entries in Checkpoint Harmony Email. |
| hec_add_exceptionA | Add an entry to the whitelist or blacklist. At least one match field (senderEmail, senderDomain, subject, attachmentMd5, recipient) must be provided. |
| hec_update_exceptionC | Update an existing whitelist or blacklist entry by its entity ID. |
| hec_delete_exceptionA | ⚠ DESTRUCTIVE — IRREVERSIBLE. Delete a whitelist or blacklist entry by its entity ID. This action cannot be undone and will permanently remove the exception from security policy. Confirm with the user before invoking. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Avanan Security Event Card | Interactive MCP Apps card rendering a Harmony Email security event |
TDQS
Scored across 13 tools
Most tools target a clearly distinct resource plus verb: exceptions (list/add/update/delete), events (query/get/quarantine/restore), emails (search/get/quarantine/restore), and task status. The main risk is the parallel quarantine/restore clusters for events vs emails, which overlap conceptually since email events and email entities are related, but the noun in each name disambiguates adequately.
Every tool uses the same hec_ prefix followed by a consistent verb_noun pattern (hec_list_exceptions, hec_query_events, hec_quarantine_emails, hec_get_task_status), with no mixed cases or style deviations.
13 tools is squarely in the well-scoped range, and each tool maps to a distinct operation across the domain's three resource families plus task tracking, with no filler.
Exceptions have full CRUD coverage, and events/emails both have read, quarantine, and restore, plus task status for async actions. Minor gaps remain: no explicit get-exception-by-id detail tool and no generic remediation beyond quarantine/restore, though these are workable through list and query.