The Proofpoint MCP Server connects AI assistants to Proofpoint TAP and Essentials APIs for comprehensive email security management, threat investigation, and intelligence operations.

• Targeted Attack Protection (TAP): Retrieve all threats, delivered/blocked messages, and permitted/blocked clicks with time window and status filters; look up specific threats or campaigns by ID.

• Quarantine Management: List, search, release, or permanently delete quarantined messages by folder, sender, recipient, subject, and date.

• Threat Intelligence: Get campaign details, threat details by ID, list known threat families, and retrieve indicators of compromise (IOCs) such as URLs, IPs, domains, and file hashes.

• DLP (Data Loss Prevention): List and filter DLP incidents by status/severity, view incident details, and track encrypted messages.

• People & User Risk: Retrieve Very Attacked People (VAP) reports, top URL clickers, and individual user risk scores.

• Forensics & Threat Response: Get forensic evidence for threats/campaigns (behavioral analysis, network activity, file modifications), search messages across mailboxes, and perform auto-pull (search & destroy) operations.

• Smart Search / Message Tracing: Trace messages through mail flow by sender, recipient, subject, or message ID; retrieve full message headers and processing logs.

• Policy Management: List and view email security policies (inbound/outbound/internal) and email routing rules.

• URL Defense: Decode Proofpoint-rewritten URLs back to their originals and analyze URLs for threat classification and risk scores.

• Security Event Monitoring: List spam, phishing, and malware detection events, get event details, and view detection statistics over time.

• Reports & Analytics: Generate organization security summaries, threat summaries, mail flow reports, and executive summaries with configurable time windows.

• Discovery & Status: Use proofpoint_navigate to explore available tools by domain and proofpoint_status to check credentials and available domains.