NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

Abnormal MCP Server

io.github.GregDog/mcp-server-abnormal ยท v1.1.0

Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.

Website Source code Set it up

Connect Runs on your machine

Terminal
claude mcp add mcp-server-abnormal -e ABNORMAL_API_TOKEN=<ABNORMAL_API_TOKEN> -e ABNORMAL_BASE_URL=<ABNORMAL_BASE_URL> -e ABNORMAL_ALLOW_RESPONSE=<ABNORMAL_ALLOW_RESPONSE> -e ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD=<ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD> -e ABNORMAL_MAX_EVIDENCE_BYTES=<ABNORMAL_MAX_EVIDENCE_BYTES> -- docker run -i --rm ghcr.io/gregdog/mcp-server-abnormal:v1.1.0
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-server-abnormal": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/gregdog/mcp-server-abnormal:v1.1.0"
      ],
      "env": {
        "ABNORMAL_API_TOKEN": "<ABNORMAL_API_TOKEN>",
        "ABNORMAL_BASE_URL": "<ABNORMAL_BASE_URL>",
        "ABNORMAL_ALLOW_RESPONSE": "<ABNORMAL_ALLOW_RESPONSE>",
        "ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD": "<ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD>",
        "ABNORMAL_MAX_EVIDENCE_BYTES": "<ABNORMAL_MAX_EVIDENCE_BYTES>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "mcp-server-abnormal": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/gregdog/mcp-server-abnormal:v1.1.0"
      ],
      "env": {
        "ABNORMAL_API_TOKEN": "<ABNORMAL_API_TOKEN>",
        "ABNORMAL_BASE_URL": "<ABNORMAL_BASE_URL>",
        "ABNORMAL_ALLOW_RESPONSE": "<ABNORMAL_ALLOW_RESPONSE>",
        "ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD": "<ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD>",
        "ABNORMAL_MAX_EVIDENCE_BYTES": "<ABNORMAL_MAX_EVIDENCE_BYTES>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "mcp-server-abnormal": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/gregdog/mcp-server-abnormal:v1.1.0"
      ],
      "env": {
        "ABNORMAL_API_TOKEN": "<ABNORMAL_API_TOKEN>",
        "ABNORMAL_BASE_URL": "<ABNORMAL_BASE_URL>",
        "ABNORMAL_ALLOW_RESPONSE": "<ABNORMAL_ALLOW_RESPONSE>",
        "ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD": "<ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD>",
        "ABNORMAL_MAX_EVIDENCE_BYTES": "<ABNORMAL_MAX_EVIDENCE_BYTES>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
ABNORMAL_API_TOKEN
Required, secret		Abnormal REST API bearer token
ABNORMAL_BASE_URL
Optional		Abnormal API base URL
ABNORMAL_ALLOW_RESPONSE
Optional		Enable response MCP tools (remediation)
ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD
Optional		Enable evidence download MCP tools (EML and attachments)
ABNORMAL_MAX_EVIDENCE_BYTES
Optional		Max bytes per evidence download from Abnormal

Details

Packageghcr.io/gregdog/mcp-server-abnormal:v1.1.0 (OCI, stdio)
First published17 Sep 2026
Last updated17 Sep 2026
Registry nameio.github.GregDog/mcp-server-abnormal

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.