Abnormal Security

Overview

Abnormal Security is an MCP server that brings AI-powered email threat detection, case management, and remediation into your AI assistant. It connects Claude, Cursor, VS Code, and other MCP clients directly to Abnormal Security's threat intelligence and response workflows, eliminating manual context-switching between tools.

The server runs locally via Docker image ghcr.io/wyre-ai/abnormal-mcp:v1.2.6, communicating over stdio. You'll need an ABNORMAL_API_TOKEN environment variable to authenticate with your Abnormal Security account. Version v1.2.6 is released under the Apache-2.0 license with source code at WYRE-AI/abnormal-mcp on GitHub.

AbNormal Security is listed in the Security category on mcp.site. It works with MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others. If you maintain this server for WYRE-AI, claim this listing to verify ownership and keep information current.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "abnormal_security": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/abnormal-mcp:v1.2.6"
      ],
      "env": {
        "ABNORMAL_API_TOKEN": "<abnormal-api-token>"
      }
    }
  }
}

Requires ABNORMAL_API_TOKEN