Connects Claude to Ironscales email security for phishing investigation and incident response. You get five main domains: allowlist management for controlling email filtering, email investigation and classification tools, incident triage and management, remediation actions including quarantine operations, and security statistics. Requires an Ironscales API key and company ID. If you're running an MSP shop and need to let Claude help with phishing ticket triage, email threat hunting, or bulk remediation decisions, this bridges the gap. Part of Wyre Technology's broader MSP tooling ecosystem. Works via stdio or HTTP transport, ships as an npm package or Docker container.
A Model Context Protocol (MCP) server for Ironscales email security. Enables AI assistants to investigate phishing incidents, manage email classification, execute remediations, and view security statistics.
This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Ironscales environment.
Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.
npm install @wyre-technology/ironscales-mcp
Set the following environment variables:
| Variable | Required | Description |
|---|---|---|
IRONSCALES_API_KEY | Yes | Your Ironscales API key |
IRONSCALES_COMPANY_ID | Yes | Your Ironscales company ID |
MCP_TRANSPORT | No | Transport mode: stdio (default) or http |
Add to your Claude Desktop claude_desktop_config.json:
{
"mcpServers": {
"ironscales-mcp": {
"command": "npx",
"args": ["@wyre-technology/ironscales-mcp"],
"env": {
"IRONSCALES_API_KEY": "your-ironscales-api-key"
"IRONSCALES_COMPANY_ID": "your-ironscales-company-id"
}
}
}
}
claude mcp add ironscales-mcp \
-e IRONSCALES_API_KEY=your-value \
-e IRONSCALES_COMPANY_ID=your-value \
-- npx -y @wyre-technology/ironscales-mcp
docker build -t ironscales-mcp .
docker run \
-e IRONSCALES_API_KEY=your-value \
-e IRONSCALES_COMPANY_ID=your-value \
-p 8080:8080 ironscales-mcp
Manage email allowlists and blocklists
Email investigation and classification
Phishing incident management and triage
Execute email remediations and quarantine
Security statistics and reporting
# Clone the repository
git clone https://github.com/wyre-technology/ironscales-mcp.git
cd ironscales-mcp
# Install dependencies
npm install
# Build
npm run build
# Run tests
npm test
Contributions are welcome! Please see CONTRIBUTING.md if present, or open an issue to discuss changes.
Licensed under the Apache License, Version 2.0. See LICENSE for details.
IRONSCALES_API_KEY*secretIronscales API key
IRONSCALES_COMPANY_ID*Ironscales company (tenant) identifier
MCP_TRANSPORTdefault: stdioTransport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
AUTH_MODEdefault: envCredential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
LOG_LEVELdefault: infoLog verbosity: debug, info, warn, error
io.github.infoinlet-marketplace/mcp-observability
betterdb-inc/monitor
com.mcparmory/datadog
thotischner/observability-mcp
io.github.tantiope/datadog-mcp
io.github.us-all/datadog