Ironscales
MCP server for Ironscales phishing incident management — incidents, mailboxes, and reporting.
Runs on your machine from its package; the steps are below.
What it does
- Reads
- Writes
- High impact
At most: moves money, runs code or commands, deletes data, or sends messages for you.
What it costs
FreeOdel charges nothing per call. The publisher may charge for its own service.
Runs locally over stdio
This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).
Run
docker run -i --rm ghcr.io/wyre-ai/ironscales-mcp:v1.2.3
MCP client config
{
"mcpServers": {
"ironscales": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/wyre-ai/ironscales-mcp:v1.2.3"
]
}
}
}Ironscales MCP Server
A Model Context Protocol (MCP) server for Ironscales email security. Enables AI assistants to investigate phishing incidents, manage email classification, execute remediations, and view security statistics.
This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Ironscales environment.
Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.
Interactive Incident Card (MCP Apps)
ironscales_incidents_get renders as an interactive card in MCP Apps hosts
(Claude Desktop/web) showing the phishing incident's subject, status, severity,
sender, affected recipients, and threat indicators; plain-JSON behavior is
unchanged in other hosts. The card is read-only — remediation stays with the
model-driven remediation tools. It is neutral by default and brandable via
window.__BRAND__ injection or MCP_BRAND_* env vars (MCP_BRAND_NAME,
MCP_BRAND_LOGO_URL, MCP_BRAND_PRIMARY_COLOR, MCP_BRAND_ACCENT_COLOR,
MCP_BRAND_BG, MCP_BRAND_TEXT) — no rebuild needed.
Installation
npm install @wyre-ai/ironscales-mcp
Configuration
Set the following environment variables:
| Variable | Required | Description |
|---|---|---|
IRONSCALES_API_KEY | Yes | Your Ironscales API key |
IRONSCALES_COMPANY_ID | Yes | Your Ironscales company ID |
MCP_TRANSPORT | No | Transport mode: stdio (default) or http |
Usage
Running with Claude Desktop
Add to your Claude Desktop claude_desktop_config.json:
{
"mcpServers": {
"ironscales-mcp": {
"command": "npx",
"args": ["@wyre-ai/ironscales-mcp"],
"env": {
"IRONSCALES_API_KEY": "your-ironscales-api-key"
"IRONSCALES_COMPANY_ID": "your-ironscales-company-id"
}
}
}
}
Running with Claude Code (CLI)
claude mcp add ironscales-mcp \
-e IRONSCALES_API_KEY=your-value \
-e IRONSCALES_COMPANY_ID=your-value \
-- npx -y @wyre-ai/ironscales-mcp
Docker
docker build -t ironscales-mcp .
docker run \
-e IRONSCALES_API_KEY=your-value \
-e IRONSCALES_COMPANY_ID=your-value \
-p 8080:8080 ironscales-mcp
Available Domains
Allowlist
Manage email allowlists and blocklists
Email investigation and classification
Incidents
Phishing incident management and triage
Remediation
Execute email remediations and quarantine
Stats
Security statistics and reporting
Development
# Clone the repository
git clone https://github.com/WYRE-AI/ironscales-mcp.git
cd ironscales-mcp
# Install dependencies
npm install
# Build
npm run build
# Run tests
npm test
Contributing
Contributions are welcome! Please see CONTRIBUTING.md if present, or open an issue to discuss changes.
License
Licensed under the Apache License, Version 2.0. See LICENSE for details.
