mcpField
I
Ironscales

Ironscales

Local
github.comSecurity0Updated 2w ago
RepositoryVisit website

About Ironscales

An MCP server that connects AI assistants to Ironscales email security for phishing investigation, remediation, classification, and reporting. It includes an interactive incident card in MCP Apps hosts.

Key features

  1. 01Phishing incident investigation
  2. 02Email classification and remediation
  3. 03Allowlist and blocklist management
  4. 04Quarantine actions
  5. 05Security statistics and reporting
  6. 06Interactive incident card

Use cases

  1. 01Triage phishing incidents and review threat indicators
  2. 02Classify suspicious email and carry out remediation
  3. 03Manage email allowlists and blocklists
  4. 04Review security statistics

MCP support

Connects MCP-compatible AI assistants to an Ironscales environment, exposing tools for email, incidents, remediation, allowlists, and statistics. The incident detail tool can render an interactive read-only card in MCP Apps hosts.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "wyre-ai-ironscales": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "IRONSCALES_API_KEY",
        "-e",
        "IRONSCALES_COMPANY_ID",
        "-e",
        "MCP_TRANSPORT",
        "-e",
        "AUTH_MODE",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-ai/ironscales-mcp:v1.2.3"
      ],
      "env": {
        "IRONSCALES_API_KEY": "<IRONSCALES_API_KEY>",
        "IRONSCALES_COMPANY_ID": "<IRONSCALES_COMPANY_ID>",
        "MCP_TRANSPORT": "<MCP_TRANSPORT>",
        "AUTH_MODE": "<AUTH_MODE>",
        "LOG_LEVEL": "<LOG_LEVEL>"
      }
    }
  }
}
Run commanddocker run -i --rm -e IRONSCALES_API_KEY -e IRONSCALES_COMPANY_ID -e MCP_TRANSPORT -e AUTH_MODE -e LOG_LEVEL ghcr.io/wyre-ai/ironscales-mcp:v1.2.3
Environment variables to set
IRONSCALES_API_KEYSecretIronscales API key
IRONSCALES_COMPANY_IDIronscales company (tenant) identifier
MCP_TRANSPORTTransport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
AUTH_MODESecretCredential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
LOG_LEVELLog verbosity: debug, info, warn, error

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocighcr.io/wyre-ai/ironscales-mcp:v1.2.3

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Ironscales MCP Server

License Node.js

A Model Context Protocol (MCP) server for Ironscales email security. Enables AI assistants to investigate phishing incidents, manage email classification, execute remediations, and view security statistics.

This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Ironscales environment.

Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.

Interactive Incident Card (MCP Apps)

ironscales_incidents_get renders as an interactive card in MCP Apps hosts (Claude Desktop/web) showing the phishing incident's subject, status, severity, sender, affected recipients, and threat indicators; plain-JSON behavior is unchanged in other hosts. The card is read-only — remediation stays with the model-driven remediation tools. It is neutral by default and brandable via window.__BRAND__ injection or MCP_BRAND_* env vars (MCP_BRAND_NAME, MCP_BRAND_LOGO_URL, MCP_BRAND_PRIMARY_COLOR, MCP_BRAND_ACCENT_COLOR, MCP_BRAND_BG, MCP_BRAND_TEXT) — no rebuild needed.

Installation

npm install @wyre-ai/ironscales-mcp

Configuration

Set the following environment variables:

VariableRequiredDescription
IRONSCALES_API_KEYYesYour Ironscales API key
IRONSCALES_COMPANY_IDYesYour Ironscales company ID
MCP_TRANSPORTNoTransport mode: stdio (default) or http

Usage

Running with Claude Desktop

Add to your Claude Desktop claude_desktop_config.json:

{
  "mcpServers": {
    "ironscales-mcp": {
      "command": "npx",
      "args": ["@wyre-ai/ironscales-mcp"],
      "env": {
        "IRONSCALES_API_KEY": "your-ironscales-api-key"
        "IRONSCALES_COMPANY_ID": "your-ironscales-company-id"
      }
    }
  }
}
Running with Claude Code (CLI)
claude mcp add ironscales-mcp \
  -e IRONSCALES_API_KEY=your-value \
  -e IRONSCALES_COMPANY_ID=your-value \
  -- npx -y @wyre-ai/ironscales-mcp
Docker
docker build -t ironscales-mcp .
docker run \
  -e IRONSCALES_API_KEY=your-value \
  -e IRONSCALES_COMPANY_ID=your-value \
  -p 8080:8080 ironscales-mcp

Available Domains

Allowlist

Manage email allowlists and blocklists

Email

Email investigation and classification

Incidents

Phishing incident management and triage

Remediation

Execute email remediations and quarantine

Stats

Security statistics and reporting

Development

# Clone the repository
git clone https://github.com/WYRE-AI/ironscales-mcp.git
cd ironscales-mcp

# Install dependencies
npm install

# Build
npm run build

# Run tests
npm test

Contributing

Contributions are welcome! Please see CONTRIBUTING.md if present, or open an issue to discuss changes.

License

Licensed under the Apache License, Version 2.0. See LICENSE for details.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.