██████╗ ██╗  ██╗██╗███████╗██╗  ██╗███████╗ ██████╗ ██████╗ ████████╗
██╔══██╗██║  ██║██║██╔════╝██║  ██║██╔════╝██╔═══██╗██╔══██╗╚══██╔══╝
██████╔╝███████║██║███████╗███████║█████╗  ██║   ██║██████╔╝   ██║
██╔═══╝ ██╔══██║██║╚════██║██╔══██║██╔══╝  ██║   ██║██╔══██╗   ██║
██║     ██║  ██║██║███████║██║  ██║██║     ╚██████╔╝██║  ██║   ██║
╚═╝     ╚═╝  ╚═╝╚═╝╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚═╝  ╚═╝   ╚═╝

                         ███╗   ███╗ ██████╗██████╗
                         ████╗ ████║██╔════╝██╔══██╗
                         ██╔████╔██║██║     ██████╔╝
                         ██║╚██╔╝██║██║     ██╔═══╝
                         ██║ ╚═╝ ██║╚██████╗██║
                         ╚═╝     ╚═╝ ╚═════╝╚═╝

        MCP server + paired agent skill for PhishFort workflows
        approval-gated writes | secret-safe defaults | no URL fetching

phishfort-mcp

A security-first MCP server and paired agent skill for the PhishFort Unified Client API.

Security-reviewed and hardened — 2026-07-29. Approval-gated writes · secret-safe by default · no incident-URL fetching · every security claim verified against the code.

Bring PhishFort incident review, reporting, attachments, comments, and webhook management into your MCP client, then give your agent the workflow playbook for using those tools safely.

Paired skill | Official PhishFort API docs | Security review | Local reference

Unofficial project. Not affiliated with, endorsed by, or maintained by PhishFort.

Security, reviewed in the open

This is a security tool, so the security work is the headline — not a disclaimer at the bottom. Every control is implemented in code, covered by tests, and was put through a review-and-harden pass whose results are public.

• 2026-06-02 — v0.1.0. Local stdio MCP server and paired agent skill, security-first by default: approval-gated writes, API host pinning, redirects disabled, and no fetching of incident URLs.

• 2026-06-05 — Posture mapped to evidence. Every security feature documented against MCP, OpenAI, and Anthropic guidance, each row tied to the exact code and test behind it.

• 2026-06-10 — Review and hardening pass. A security review conducted by Claude Fable 5 Ultracode (initial pass), Opus 4.8 xhigh, rubber-ducked with Codex 5.5 xhigh via plugin drove a hardening pass:

  • destructive confirmation is now enforced on incident-action requests — the annotation and the approval gate agree,

  • secret-named fields are scrubbed recursively, and one-time webhook secrets are written through O_NOFOLLOW 0600 files,

  • reads retry bounded transport failures; writes retry only proven pre-send connection/pool failures; secret-named fields are redacted from errors,

  • the approval salt is random and process-stable, and the retry count is bounded,

  • the webhook URL preflight rejects legacy numeric-IP encodings,

  • the final attachment descriptor is held through upload, narrowing the validate→upload replacement window.

  The same pass reworded every security claim to match what the code enforces — the approval gate is described as in-process integrity and confirmation, not independent authorization, and the webhook URL check as a pre-submit sanity check. Tests went from 26 to 36.

• 2026-07-30 — v0.1.1. Packages reference resources into wheels, adds current Users, Clients, Documents, and total-count reads, distinguishes safe read retries from mutation outcomes needing manual review, binds immutable attachment snapshots to approval, validates webhook timestamp freshness, requires file-backed verifier secrets, hardens one-time secret persistence beneath an owned 0700 root, and uses documented attachment MIME types. Distribution uses a versioned Git tag and GitHub Release assets; this project is not published to PyPI.

The table below is the evidence: each control maps to the code and the test that backs it.

Related MCP server: Security Copilot MCP Server

Standards-Backed Security Posture

This server was designed against the Official Model Context Protocol security guidance, Anthropic connector guidance, OpenAI MCP guidance, OpenAI agent safety guidance, and PhishFort's official API docs. The table below lists only security features that are implemented in code, with local evidence.

Local evidence:

• MCP security review

• PhishFort API reference

• Source manifest

About

phishfort-mcp is a public, unofficial MCP integration for teams and operators who want PhishFort incident workflows available inside agentic tools without giving up basic operational control. The MCP server provides live API access; the paired skill gives compatible agents the workflow memory needed to use that access consistently.

It is built for local-first use, explicit approvals, and careful handling of phishing data. The goal is not to make incident response fully autonomous. The goal is to make the repetitive parts faster while keeping sensitive actions, secrets, and untrusted content under control.

Why This Exists

PhishFort has a focused REST API for phishing incident workflows. MCP makes that API usable from agentic tools, and the paired skill teaches those agents the operating procedure: what to read first, how to plan writes, what data is untrusted, and when to stop for explicit approval.

That pairing matters because security workflows are not just API calls. Incident data can contain hostile text, URLs should not be fetched casually, and takedown or webhook operations should not happen from a loose prompt.

phishfort-mcp ships two pieces that work together:

• a local stdio MCP server for live PhishFort API access

• an agent-agnostic skill that turns raw tool access into repeatable, safer workflows

• approval-gated writes for reporting, actions, evidence, comments, and webhooks

• secret-safe handling for API keys and one-time webhook secrets

• untrusted-data guardrails for incident text, URLs, and webhook payloads

What You Can Do

The server also exposes MCP resources for the distilled API reference, source manifest, and security review:

• phishfort://reference/summary

• phishfort://reference/limits

• phishfort://reference/source-manifest

• phishfort://reference/security-review

Paired Skill

This repo ships an agent-agnostic skill in skills/phishfort-mcp/SKILL.md. Use it with any skill-capable MCP host to teach the agent the safe operating pattern for this server: read before write, treat all remote API data as untrusted, never fetch returned URLs by default, and use phishfort_plan_change before mutating calls.

The skill keeps detailed workflows in references/workflows.md, exact tool parameters in references/tool-map.md, and points agents to phishfort_get_limits before workflows where limits change the right next step.

The GitHub Release wheel installs the MCP server and its embedded reference resources. The paired skill is a repository asset; download it from the matching Git tag when your host supports skills. This project is not published to PyPI.

Safety Built In

The standards-backed table above is the detailed proof. Operationally, the server stays local-first, keeps credentials out of tool arguments, treats PhishFort data as untrusted, gates writes through phishfort_plan_change, stores webhook secrets outside tool output, and constrains attachments, webhook URLs, limits, and retries.

See MCP security review for the reasoning behind these choices.

Quick Start

uvx --from git+https://github.com/mychaelconnolly/phishfort-mcp.git@v0.1.1 phishfort-mcp --help

For source development or the paired skill:

git clone --branch v0.1.1 --depth 1 https://github.com/mychaelconnolly/phishfort-mcp.git
cd phishfort-mcp
uv sync --frozen --extra dev
uv run phishfort-mcp --help

Create a local key file:

mkdir -p ~/.config/phishfort-mcp
chmod 700 ~/.config/phishfort-mcp
$EDITOR ~/.config/phishfort-mcp/phishfort-api-key.txt
chmod 600 ~/.config/phishfort-mcp/phishfort-api-key.txt

Codex MCP Registration

codex mcp add phishfort \
  --env PHISHFORT_API_KEY_FILE=$HOME/.config/phishfort-mcp/phishfort-api-key.txt \
  -- uvx --from git+https://github.com/mychaelconnolly/phishfort-mcp.git@v0.1.1 phishfort-mcp

Then verify:

codex mcp list

A fresh Codex session may be required before new MCP tools are discoverable.

Configuration

phishfort_verify_webhook_signature accepts secret_file only. The file must remain beneath PHISHFORT_SECRET_DIR; the root and any subdirectories must be owned by the effective user with mode 0700. Symlinked components, root rebinding, and platforms without required descriptor-relative no-follow primitives fail closed.

Approval-Gated Writes

Read tools can be called directly. Writes are two-step on purpose:

1. Call phishfort_plan_change with operation and exact params.

2. Review warnings, risk, request_digest, and approval_phrase.

3. Call the intended mutating tool with the same params plus approval_id, approval_phrase, expires_at, and request_digest.

If anything changes, rerun phishfort_plan_change.

This gate is in-process integrity and confirmation: it proves the executed params match the planned params (tamper-evident digest), enforces expiry, and requires destructive_confirmed=true for destructive operations. It is not an independent authorization boundary — the same agent can plan and confirm. The human-in-the-loop checkpoint is the MCP host's own tool-confirmation UI, driven by the destructive annotations the server sets.

Mutating API calls are not automatically replayed after HTTP status responses or ambiguous read/protocol failures. PhishFort documents no idempotency key for incident reports. A report 409 means duplicate. Any 2xx with a nonempty incident id confirms creation, even when dashboard url is null or absent; a 2xx without a nonempty id stops for manual review with no automatic retry.

Verification

uv run ruff check .
uv run pytest

Optional live smoke when a valid key exists:

• phishfort_whoami

• phishfort_list_incidents(limit=1)

Do not run live mutating smoke unless you intend to change PhishFort state.

Document signed URLs are short-lived download grants. Treat them as sensitive, untrusted API output: do not persist or share them, and do not fetch them automatically.

API Reference

Official PhishFort docs:

• Introduction

• Authentication

• Limits

• Incident Lifecycle

• Official Docs MCP

• List Incidents

• Single Incident

• Report Incident

• Request Incident Action

• Add Attachments

• Add Comment

• List Users

• List Clients

• Documents

• Webhooks

• Zendesk Integration

• Data Structures

• OpenAPI Reference

PhishFort's docs MCP serves documentation, not account API operations. This project remains the local account-workflow MCP server.

This repo includes a distilled reference in docs/reference/phishfort-unified-client-api.md and a source URL manifest in docs/reference/source-manifest.json. Fetched raw PhishFort docs are intentionally not tracked.

License

MIT. See LICENSE.