ironscales-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_TRANSPORT | No | Transport mode: stdio (default) or http | stdio |
| IRONSCALES_API_KEY | Yes | Your Ironscales API key | |
| IRONSCALES_COMPANY_ID | Yes | Your Ironscales company ID |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| ironscales_navigateA | Navigate to a domain to see its available tools. Domains: incidents (phishing incidents), email (email classification), remediation (incident remediation), stats (company statistics), allowlist (sender allowlist management). |
| ironscales_statusA | Check Ironscales API connection status and available domains. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Ironscales Incident Card | Interactive MCP Apps card rendering an Ironscales phishing incident |
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: one navigates to specific domains to view their tools, and the other checks API connection status. No ambiguity.
Both tools share the consistent 'ironscales_' prefix and use snake_case. However, one is a verb ('navigate') and the other is a noun ('status'), which is a minor inconsistency.
With only 2 tools for a server that claims to cover multiple domains (incidents, email, remediation, stats, allowlist), the count is far too low to be useful.
The server lacks any tools for actual operations on the listed domains, such as viewing incidents, classifying emails, or managing remediation. It only has navigation and status checks, leaving massive gaps.