Abnormal Security MCP

Execute one abnormal API endpoint by its endpoint_id (from abnormal_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Search the abnormal API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Get identity for employee

Get logins for employee

Use this command to assemble one account-takeover risk picture for an employee: profile, Genome identity analysis, a 30-day login summary, and recent cases naming them. Do NOT use it for vendor compromise; use 'vendor-risk'. Do NOT use it for the raw login CSV alone; the generated employee logins endpoint returns that. Case matching scans recent cases and matches affectedEmployee against the email or its local part; scanned_cases reports how many were examined.

Export paginated API data to a local file. Supports JSONL (one JSON object per line, streaming-friendly) and JSON (array). JSONL is recommended for large datasets as it has no memory pressure.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

Use this command to remediate a threat or case and block until the action reaches a terminal state ('done' or 'error'), returning a typed exit code and the final receipt. Do NOT use it for a bare submit; use the generated 'threats create' / 'cases create' manage commands. Do NOT use it for triage ranking; use 'triage'. Threat actions: remediate (default), unremediate. Case actions: action_required, acknowledge_resolved, acknowledge_in_progress, acknowledge_not_an_attack (--action is required for cases).

Use this command for a client-ready reporting snapshot across multiple live dashboard endpoints (attack frequency, attacks stopped, VIP and non-VIP impersonation, sender impersonation breakdown, trending attacks). Do NOT use it for one metric; the generated 'aggregations' endpoint commands return one each. Failed sections are excluded from output and reported in fetch_failures so a partial snapshot is never silently presented as complete.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Probes a set of read endpoints with Abnormal's 'Mock-Data: True' request header, which returns vendor-supplied test payloads instead of tenant data. A passing run proves the token, the configured base URL (US or EU), and the IP allowlist are all working — without touching real threat data. Run this first when onboarding a tenant or rotating a token. For a config-only check that needs no token at all, use 'doctor --dry-run'.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Use this command for the daily ranked "what to work on first" backlog from local SQLite. Do NOT use it for raw filtered listing; use the generated 'threats' list. Do NOT use it to confirm a remediation finished; use 'remediate-watch'. Ranking combines recency, Abnormal attack-type severity, and impersonation signals; threats whose messages are all remediated are suppressed unless --include-remediated is set. Run 'sync --resources threats' first.

Use this command to assemble one vendor-email-compromise picture for a vendor domain: vendor details, recent activity, and vendor cases naming the domain. Do NOT use it for an account-takeover picture; use 'employee-risk'. Vendor-case matching scans recent vendor cases for the domain; scanned_vendor_cases reports how many were examined.

Get activity for vendors

Get details for vendors

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources