# Proofpoint (oci · ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4)

MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

- Trust score: 46/100 (low)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-22

## Components

- oci · `ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4`: 46/100 (this document), [markdown](https://verifymcp.io/servers/wyre-technology-proofpoint-mcp/ghcr-io-wyre-technology-proofpoint-mcp-v1-1-4.md), [page](https://verifymcp.io/servers/wyre-technology-proofpoint-mcp/ghcr-io-wyre-technology-proofpoint-mcp-v1-1-4)

## Channel facts

- Registry: `oci`
- Package: `ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-22.

- **Supply Chain Security**: 0/100
  - Malware scan not yet available for this package.
  - Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 9 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 87/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 3401 tokens (~82/item across 41 items; 40 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add wyre-technology-proofpoint-mcp -- docker run --rm -i ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4
```

### Codex

```bash
codex mcp add wyre-technology-proofpoint-mcp -- docker run --rm -i ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wyre-technology-proofpoint-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  wyre-technology-proofpoint-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4"]
```

### Other

```json
{
  "mcpServers": {
    "wyre-technology-proofpoint-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-22 (score 46, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-20 (score 45, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-13 (score 41)

First indexed and scored.

## MCP tools (40)

### `proofpoint_navigate` (~259 tokens)

Discover available Proofpoint tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite.

Input parameters:

- `domain` (string, required): The domain to explore: - tap: Targeted Attack Protection (TAP) - SIEM API for threats, clicks, messages, and attack intelligence - quarantine: Quarantine management - list, release, delete, and searc…

### `proofpoint_status` (~16 tokens)

Show credentials status and available domains

### `proofpoint_tap_get_all_threats` (~173 tokens)

Get all threats (messages and clicks) from the TAP SIEM API for a given time window. Returns both delivered/blocked messages and permitted/blocked clicks.

Input parameters:

- `format` (string): Response format (default: json)
- `interval` (string): Predefined time interval: "PT30M" (30 min) or "PT1H" (1 hour). Mutually exclusive with sinceSeconds/sinceTime.
- `sinceSeconds` (number): Number of seconds ago to fetch threats from (max 3600). Mutually exclusive with sinceTime/interval.
- `sinceTime` (string): ISO 8601 date/time to fetch threats since. Mutually exclusive with sinceSeconds/interval.
- `threatStatus` (string): Filter by threat status (default: active)

### `proofpoint_tap_get_messages_delivered` (~101 tokens)

Get messages delivered containing threats. These are messages that reached the recipient's mailbox despite containing identified threats.

Input parameters:

- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceSeconds` (number): Number of seconds ago (max 3600)
- `sinceTime` (string): ISO 8601 date/time to fetch since
- `threatStatus` (string): Filter by threat status

### `proofpoint_tap_get_messages_blocked` (~100 tokens)

Get messages blocked that contained threats. These are messages quarantined or rejected before reaching the recipient.

Input parameters:

- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceSeconds` (number): Number of seconds ago (max 3600)
- `sinceTime` (string): ISO 8601 date/time to fetch since
- `threatStatus` (string): Filter by threat status

### `proofpoint_tap_get_clicks_permitted` (~100 tokens)

Get permitted clicks on threat URLs. These are clicks that were allowed through to the destination.

Input parameters:

- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceSeconds` (number): Number of seconds ago (max 3600)
- `sinceTime` (string): ISO 8601 date/time to fetch since
- `threatStatus` (string): Filter by threat status

### `proofpoint_tap_get_clicks_blocked` (~101 tokens)

Get blocked clicks on threat URLs. These are clicks that were prevented from reaching the malicious destination.

Input parameters:

- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceSeconds` (number): Number of seconds ago (max 3600)
- `sinceTime` (string): ISO 8601 date/time to fetch since
- `threatStatus` (string): Filter by threat status

### `proofpoint_quarantine_list` (~147 tokens)

List quarantined messages. Returns messages held in quarantine with sender, recipient, subject, and reason.

Input parameters:

- `endDate` (string): End date in ISO 8601 format
- `folder` (string): Filter by quarantine folder/reason
- `page` (number): Page number for pagination (default: 1)
- `per_page` (number): Number of results per page (default: 50)
- `recipient` (string): Filter by recipient email address
- `sender` (string): Filter by sender email address
- `startDate` (string): Start date in ISO 8601 format
- `subject` (string): Filter by subject (partial match)

### `proofpoint_quarantine_search` (~104 tokens)

Search quarantine by keyword across sender, recipient, and subject fields.

Input parameters:

- `endDate` (string): End date in ISO 8601 format
- `page` (number): Page number (default: 1)
- `per_page` (number): Results per page (default: 50)
- `query` (string, required): Search keyword to find in sender, recipient, or subject
- `startDate` (string): Start date in ISO 8601 format

### `proofpoint_quarantine_release` (~70 tokens)

⚠ HIGH-IMPACT. Release a quarantined message, delivering it to the intended recipient. Irreversible delivery but message itself is preserved. Can deliver malicious mail to user. Confirm with the user before invoking.

Input parameters:

- `message_id` (string, required): The quarantined message ID to release

### `proofpoint_quarantine_delete` (~66 tokens)

⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently delete a quarantined message. This action cannot be undone and will remove the message from quarantine storage. Confirm with the user before invoking.

Input parameters:

- `message_id` (string, required): The quarantined message ID to delete

### `proofpoint_threat_get_campaign` (~50 tokens)

Get details of a specific threat campaign by campaign ID. Returns campaign actors, malware families, techniques, and associated messages.

Input parameters:

- `campaign_id` (string, required): The campaign ID to look up

### `proofpoint_threat_get_by_id` (~55 tokens)

Get detailed information about a specific threat by its threat ID. Returns threat type, classification, and associated indicators.

Input parameters:

- `threat_id` (string, required): The threat ID (SHA256 hash or Proofpoint threat ID)

### `proofpoint_threat_list_families` (~74 tokens)

List known threat families tracked by Proofpoint. Returns malware family names, descriptions, and associated campaigns.

Input parameters:

- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceTime` (string): ISO 8601 date/time to list families active since

### `proofpoint_threat_get_iocs` (~110 tokens)

Get indicators of compromise (IOCs) for a specific campaign or time range. Returns URLs, IPs, domains, file hashes associated with threats.

Input parameters:

- `campaign_id` (string): Campaign ID to get IOCs for
- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceTime` (string): ISO 8601 date/time to fetch IOCs since
- `threat_type` (string): Filter by threat type

### `proofpoint_dlp_list_incidents` (~119 tokens)

List DLP incidents. Returns messages that triggered DLP rules, including policy violations and sensitive data detections.

Input parameters:

- `endDate` (string): End date in ISO 8601 format
- `page` (number): Page number (default: 1)
- `per_page` (number): Results per page (default: 50)
- `severity` (string): Filter by severity level
- `startDate` (string): Start date in ISO 8601 format
- `status` (string): Filter by incident status

### `proofpoint_dlp_get_incident` (~48 tokens)

Get detailed information about a specific DLP incident, including matched rules, sensitive data types, and message metadata.

Input parameters:

- `incident_id` (string, required): The DLP incident ID

### `proofpoint_dlp_list_encrypted` (~118 tokens)

List messages that were encrypted by Proofpoint Email Encryption. Shows encrypted message status and recipient access.

Input parameters:

- `endDate` (string): End date in ISO 8601 format
- `page` (number): Page number (default: 1)
- `per_page` (number): Results per page (default: 50)
- `recipient` (string): Filter by recipient email address
- `sender` (string): Filter by sender email address
- `startDate` (string): Start date in ISO 8601 format

### `proofpoint_people_get_vap` (~100 tokens)

Get the Very Attacked People (VAP) report. Returns users who received the most attacks, ranked by attack index. Useful for identifying high-risk users.

Input parameters:

- `page` (number): Page number (default: 1)
- `size` (number): Results per page (default: 1000)
- `window` (number): Time window in days: 14, 30, or 90 (default: 30)

### `proofpoint_people_get_top_clickers` (~94 tokens)

Get top clickers report. Returns users who clicked on the most threat URLs, indicating users who may need additional security training.

Input parameters:

- `page` (number): Page number (default: 1)
- `size` (number): Results per page (default: 1000)
- `window` (number): Time window in days: 14, 30, or 90 (default: 30)

### `proofpoint_people_get_user_risk` (~57 tokens)

Get the risk score and attack details for a specific user by email address.

Input parameters:

- `email` (string, required): User email address to look up
- `window` (number): Time window in days (default: 30)

### `proofpoint_forensics_get_threat` (~73 tokens)

Get forensic evidence for a specific threat. Returns behavioral analysis, network activity, file modifications, and other forensic indicators.

Input parameters:

- `includeCampaignForensics` (boolean): Include forensics for the entire campaign (default: false)
- `threat_id` (string, required): The threat ID to get forensics for

### `proofpoint_forensics_get_campaign` (~47 tokens)

Get forensic evidence for all threats in a campaign. Returns aggregated behavioral analysis across all associated threats.

Input parameters:

- `campaign_id` (string, required): The campaign ID to get forensics for

### `proofpoint_forensics_search_messages` (~129 tokens)

Search for messages across mailboxes for threat response. Used for search & destroy / auto-pull operations to find and remediate delivered threats.

Input parameters:

- `endDate` (string): End date in ISO 8601 format
- `message_id` (string): Internet message ID to search for
- `sender` (string): Sender email address to search for
- `startDate` (string): Start date in ISO 8601 format
- `subject` (string): Subject line to search for (partial match)
- `threat_id` (string): Threat ID associated with messages to find

### `proofpoint_forensics_pull_messages` (~71 tokens)

Auto-pull (search & destroy) messages from mailboxes. This is a destructive operation that removes delivered messages from user mailboxes.

Input parameters:

- `message_ids` (array, required): Array of message IDs to pull from mailboxes
- `reason` (string): Reason for pulling messages (for audit trail)

### `proofpoint_smart_search_trace` (~173 tokens)

Trace messages through the Proofpoint mail flow. Search by sender, recipient, subject, or message ID to track delivery status and processing history.

Input parameters:

- `endDate` (string): End date in ISO 8601 format
- `message_id` (string): Internet Message-ID header to search for
- `page` (number): Page number (default: 1)
- `per_page` (number): Results per page (default: 50)
- `recipient` (string): Recipient email address to search for
- `sender` (string): Sender email address to search for
- `startDate` (string): Start date in ISO 8601 format
- `status` (string): Filter by delivery status (default: all)
- `subject` (string): Subject line to search for (partial match)

### `proofpoint_smart_search_get_message` (~44 tokens)

Get detailed information about a specific message including headers, processing log, and delivery details.

Input parameters:

- `message_id` (string, required): The Proofpoint internal message ID

### `proofpoint_smart_search_get_headers` (~37 tokens)

Get the full email headers for a specific message.

Input parameters:

- `message_id` (string, required): The Proofpoint internal message ID

### `proofpoint_policy_list` (~37 tokens)

List all email security policies. Returns policy names, types, and enabled status.

Input parameters:

- `type` (string): Filter by policy direction

### `proofpoint_policy_get` (~38 tokens)

Get detailed information about a specific policy including rules, conditions, and actions.

Input parameters:

- `policy_id` (string, required): The policy ID to retrieve

### `proofpoint_policy_list_routes` (~57 tokens)

List email routing rules/routes. Shows how mail is routed based on policy configuration.

Input parameters:

- `page` (number): Page number (default: 1)
- `per_page` (number): Results per page (default: 50)

### `proofpoint_url_decode` (~79 tokens)

Decode one or more Proofpoint URL Defense rewritten URLs back to the original URLs. Proofpoint rewrites URLs in emails for click-time protection; this tool reverses that encoding.

Input parameters:

- `urls` (array, required): Array of Proofpoint-encoded URLs to decode (e.g., https://urldefense.proofpoint.com/v2/url?...)

### `proofpoint_url_analyze` (~40 tokens)

Analyze a URL for threats. Returns threat classification, risk score, and associated campaigns.

Input parameters:

- `url` (string, required): URL to analyze for threats

### `proofpoint_events_list` (~119 tokens)

List spam, phishing, and malware detection events. Returns events where Proofpoint detected and acted on threats.

Input parameters:

- `disposition` (string): Filter by disposition (what happened to the message)
- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceSeconds` (number): Number of seconds ago to fetch events from (max 3600)
- `sinceTime` (string): ISO 8601 date/time to fetch events since
- `threatType` (string): Filter by threat type

### `proofpoint_events_get_details` (~42 tokens)

Get detailed information about a specific detection event, including full threat analysis and message metadata.

Input parameters:

- `event_id` (string, required): The event ID to look up

### `proofpoint_events_get_stats` (~91 tokens)

Get detection event statistics. Returns counts of spam, phishing, malware, and impostor detections over a time period.

Input parameters:

- `interval` (string): Predefined interval: "PT30M" or "PT1H"
- `sinceSeconds` (number): Number of seconds ago (max 3600)
- `sinceTime` (string): ISO 8601 date/time to get stats since

### `proofpoint_reports_org_summary` (~50 tokens)

Get organization security summary. Returns high-level metrics: total messages processed, threats blocked, quarantined, and delivered.

Input parameters:

- `window` (number): Time window in days (default: 30)

### `proofpoint_reports_threat_summary` (~71 tokens)

Get threat summary report. Breakdown of threats by type (spam, phishing, malware, impostor) with counts and trends.

Input parameters:

- `threatType` (string): Focus on a specific threat type (default: all)
- `window` (number): Time window in days (default: 30)

### `proofpoint_reports_mail_flow` (~66 tokens)

Get mail flow report. Shows email volume over time with breakdown by disposition (delivered, blocked, quarantined).

Input parameters:

- `granularity` (string): Data point granularity (default: daily)
- `window` (number): Time window in days (default: 7)

### `proofpoint_reports_executive_summary` (~56 tokens)

Get executive summary report. High-level security posture overview suitable for management reporting. Includes threat trends, top targeted users, and effectiveness metrics.

Input parameters:

- `window` (number): Time window in days (default: 30)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/wyre-technology-proofpoint-mcp/ghcr-io-wyre-technology-proofpoint-mcp-v1-1-4#diagnostics

## Score history

- 2026-08-22: 46
- 2026-08-21: 45
- 2026-08-20: 45
- 2026-08-19: 41
- 2026-08-18: 41
- 2026-08-17: 41
- 2026-08-16: 41
- 2026-08-15: 41
- 2026-08-14: 41
- 2026-08-13: 41

## Links

- Repository: https://github.com/wyre-technology/proofpoint-mcp
- Changelog RSS feed: https://verifymcp.io/servers/wyre-technology-proofpoint-mcp/ghcr-io-wyre-technology-proofpoint-mcp-v1-1-4.xml
- Changelog JSON feed: https://verifymcp.io/servers/wyre-technology-proofpoint-mcp/ghcr-io-wyre-technology-proofpoint-mcp-v1-1-4.json
- HTML version of this page: https://verifymcp.io/servers/wyre-technology-proofpoint-mcp/ghcr-io-wyre-technology-proofpoint-mcp-v1-1-4