avanan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_TRANSPORT | No | Transport mode: stdio (default) or http | stdio |
| CHECKPOINT_REGION | No | API region (default: us) | us |
| CHECKPOINT_CLIENT_ID | Yes | Your Checkpoint/Avanan OAuth2 client ID | |
| CHECKPOINT_CLIENT_SECRET | Yes | Your Checkpoint/Avanan OAuth2 client secret |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hec_query_eventsA | Query Checkpoint Harmony Email security events (phishing, malware, DLP, anomaly, shadow IT, etc.). Supports filtering by type, state, severity, date range, and SaaS platform. Returns events with available remediation actions. |
| hec_get_eventB | Get full details for a specific security event by ID. |
| hec_search_emailsB | Search email and SaaS entities in Checkpoint Harmony Email. Filter by sender, recipient, subject, SaaS platform, and date range. Use extended filters for precise attribute matching (contains, startsWith, isEmpty, etc.). |
| hec_get_emailA | Get full details for a specific email entity by its entity ID. |
| hec_quarantine_eventsA | ⚠ HIGH-IMPACT. Quarantine one or more security events by event ID. Quarantining is reversible via restore but affects user access to events. Returns task IDs to track progress. Confirm with the user before invoking. |
| hec_restore_eventsA | Restore one or more previously quarantined events by event ID. Returns task IDs to track progress. |
| hec_quarantine_emailsA | ⚠ HIGH-IMPACT. Quarantine specific email entities by entity ID. Quarantining is reversible via restore but affects user access to emails. Returns task IDs to track progress. Confirm with the user before invoking. |
| hec_restore_emailsB | Restore specific quarantined email entities by entity ID. |
| hec_get_task_statusA | Check the status of an action task (quarantine/restore). Use the taskId returned by quarantine or restore tools. |
| hec_list_exceptionsB | List whitelist or blacklist entries in Checkpoint Harmony Email. |
| hec_add_exceptionA | Add an entry to the whitelist or blacklist. At least one match field (senderEmail, senderDomain, subject, attachmentMd5, recipient) must be provided. |
| hec_update_exceptionC | Update an existing whitelist or blacklist entry by its entity ID. |
| hec_delete_exceptionA | ⚠ DESTRUCTIVE — IRREVERSIBLE. Delete a whitelist or blacklist entry by its entity ID. This action cannot be undone and will permanently remove the exception from security policy. Confirm with the user before invoking. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Avanan Security Event Card | Interactive MCP Apps card rendering a Harmony Email security event |
TDQS
Scored across 13 tools
Each tool targets a distinct resource and action: events vs emails vs exceptions, with separate query/get, quarantine/restore, and CRUD operations. There is no ambiguity between tools, as their purposes are clearly differentiated.
All tools follow a consistent 'hec_verb_noun' snake_case pattern. Verbs like query/get/search, quarantine/restore, and list/add/update/delete are used predictably across the tool set.
With 13 tools, the set is well-scoped for a security email management server. It covers events, emails, quarantine actions, task tracking, and exception management without being overloaded or too sparse.
The tool surface covers querying, retrieving, quarantining, and restoring events and emails, plus full CRUD for exceptions. A minor gap is the lack of tools to update event properties (e.g., severity), but the core workflows are complete.