🧪 Community ✓ Claude Code ✓ Claude Desktop 🔌 Requires MCP Server • Ironscales
Ironscales
Claude plugins for IRONSCALES - AI-powered anti-phishing, incident triage, email classification, and crowdsourced threat intelligence
🔌 Recommended MCP Server
Pair this plugin with the Ironscales MCP for direct API access alongside skills and commands.
Installation
Install this plugin individually:
/plugin marketplace add wyre-technology/msp-claude-plugins --plugin ironscales Or install all MSP plugins at once:
/plugin marketplace add wyre-technology/msp-claude-plugins Features
- Incident Management
Skills
This plugin provides 2 skills that teach Claude about Ironscales:
| Skill | Description |
|---|---|
incidents | Use this skill when working with Ironscales phishing incidents — listing and triaging incidents, classifying emails as phishing/spam/legitimate, taking remediation actions, managing sender allowlists, and viewing company statistics. |
api-patterns | Use this skill when working with Ironscales MCP tools — available tools, API key and company ID authentication, pagination, rate limiting, and error handling. |
Agents
This plugin provides 2 agents for autonomous task execution:
| Agent | Description |
|---|---|
crowdsourced-intel-harvester | Use this agent when harvesting and analyzing crowdsourced threat intelligence from IRONSCALES' global network — identifying trending attack types, surfacing indicators seeing increased reports, comparing client threat profiles to industry peers, and generating intelligence briefings from the collective signal. |
phishing-responder | Use this agent when responding to user-reported phishing emails in IRONSCALES, triaging the incident queue, classifying emails, coordinating quarantine and remediation, or reviewing security statistics for MSP clients. |
Commands
Available slash commands:
| Command | Description |
|---|---|
/classify-email | Classify a specific Ironscales incident email as phishing, spam, or legitimate |
/triage-incidents | Triage open Ironscales phishing incidents — list by status, classify, and remediate |
API Reference
| Base URL | |
| Authentication | |
| Rate Limit | |
| Documentation |
Example Usage
Classify a specific Ironscales incident email as phishing, spam, or legitimate
/classify-emailTriage open Ironscales phishing incidents — list by status, classify, and remediate
/triage-incidentsUsing Skills
/skill ironscales:incidents
Use this skill when working with Ironscales phishing incidents — listing and triaging incidents, classifying emails as phishing/spam/legitimate, taking remediation actions, managing sender allowlists, and viewing company statistics.