Related Servers

Tools are grouped by domain with detailed descriptions, but overlap exists between threat and forensics tools (e.g., threat_get_campaign vs forensics_get_campaign), between TAP all-threats and message/click-specific retrievals, and between multiple report/event summary tools. The sheer number of similarly-shaped list/get/report tools leaves room for misselection without careful reading.

Nearly all tools follow a proofpoint_<domain>_<action/object> snake_case pattern, with clear domain prefixes making navigation predictable. Minor inconsistencies include report tools using noun phrases like reports_threat_summary instead of action verbs, and standalone tools like proofpoint_navigate and proofpoint_status that don't follow the domain-action pattern.

With 40 tools, the surface is heavy and exceeds the typical well-scoped range for an agent toolkit. While Proofpoint is a broad platform and each domain has only a few tools, exposing all of them under one server creates a large, potentially unwieldy namespace. It isn't extreme enough for a 1, but is clearly in the 'too many' range.

The server covers major Proofpoint domains well: quarantine lifecycle, TAP events, DLP incidents, forensic search and pull, smart search, reporting, policy read access, URL handling, and detection events. However, the policy and threat-response surfaces are read-mostly, with no create/update/delete policy, no blocklist/sender remediation, and limited actions beyond forensics pull. This leaves notable admin and response gaps.