Security MCP Server 🐳 Docker

Ironscales MCP

MCP server for Ironscales — phishing incident management, email classification, allowlist management, and automated remediation.

🔗 Companion Plugin

Pair this MCP server with the Ironscales plugin for skills, commands, and API knowledge alongside direct API access.

Installation

Run the MCP server with npx:

npx @wyre-technology/ironscales-mcp

Or install the package:

npm install @wyre-technology/ironscales-mcp

MCPB Bundle (Claude Desktop)

Download the .mcpb bundle from GitHub Releases for a zero-config Claude Desktop install. No Node.js or terminal required — just open the bundle in Claude Desktop via Settings → MCP Servers → Install from file. Requires Claude Desktop 0.10+.

Claude Desktop Configuration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "ironscales": {
      "command": "npx",
      "args": [
        "@wyre-technology/ironscales-mcp"
      ],
      "env": {
        "IRONSCALES_API_KEY": "your-ironscales-api-key",
        "IRONSCALES_COMPANY_ID": "your-ironscales-company-id"
      }
    }
  }
}

Authentication

Variable	Required	Description
`IRONSCALES_API_KEY`	Yes	Ironscales API key (generate in the Ironscales partner portal)
`IRONSCALES_COMPANY_ID`	Yes	Ironscales company / tenant identifier

Architecture

Decision-tree MCP server with per-domain handlers and Streamable HTTP transport for hosted deployments.

Available Tools (9)

Tools are organized into 5 domains:

Incidents

Phishing incident lifecycle — list, classify, resolve.

Tool	Description
`ironscales_incidents_list`	List incidents with filters
`ironscales_incidents_get`	Get incident details
`ironscales_incidents_classify`	Classify an incident (phishing / safe / spam)

Allowlist

Manage sender / domain allowlist entries.

Tool	Description
`ironscales_allowlist_list`	List allowlist entries
`ironscales_allowlist_add`	Add a sender or domain to the allowlist
`ironscales_allowlist_remove`	Remove an allowlist entry

Email

Per-email metadata and analysis.

Tool	Description
`ironscales_email_get`	Get email metadata and analysis

Remediation

Mailbox-wide remediation actions.

Tool	Description
`ironscales_remediation_apply`	Apply remediation action across affected mailboxes

Stats

Tenant-level phishing statistics and reporting.

Tool	Description
`ironscales_stats_summary`	Get tenant-level phishing statistics summary