Эта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал
MCP server for Proofpoint TAP and Essentials APIs — threat intelligence, email tracing, and MSP org management
Обзор
A Model Context Protocol (MCP) server for Proofpoint TAP and Essentials APIs. Enables AI assistants to investigate threats, trace emails, manage quarantine, access threat intelligence, and perform URL defense operations. This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Proofpoint environment. — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs. Copy .env.example and set the variables below. The stdio transport reads PROOFPOINT_* and does not use HTTP service-to-service auth. /health and /healthz stay unauthenticated and do not read credentials. With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t= ,v1= , where the hex is HMAC-SHA256 of the literal string t= keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock.
README
Показан фрагмент оригинального README. Открыть оригинал.
Proofpoint MCP Server
A Model Context Protocol (MCP) server for Proofpoint TAP and Essentials APIs. Enables AI assistants to investigate threats, trace emails, manage quarantine, access threat intelligence, and perform URL defense operations.
This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Proofpoint environment.
Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.
Installation
npm install @wyre-ai/proofpoint-mcp
Configuration
Copy .env.example and set the variables below. The stdio transport reads PROOFPOINT_* and does not use HTTP service-to-service auth.
| Variable | Required | Description |
|---|---|---|
PROOFPOINT_SERVICE_PRINCIPAL |
For stdio and AUTH_MODE=env |
Proofpoint TAP service principal |
PROOFPOINT_SERVICE_SECRET |
For stdio and AUTH_MODE=env |
Proofpoint TAP service secret |
PROOFPOINT_BASE_URL |
No | API host. Defaults to https://tap-api-v2.proofpoint.com. Not a credential. |
MCP_TRANSPORT |
No | stdio (default) or http |
AUTH_MODE |
No | gateway (Docker image and Compose) or env. Gateway mode requires X-Proofpoint-Service-Principal and X-Proofpoint-Service-Secret on each /mcp request and never falls back to PROOFPOINT_*. env uses those variables only after S2S auth succeeds. Unset means env (stdio and single-tenant HTTP). |
CONDUIT_S2S_SECRET |
Yes for HTTP | Service-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder (changeme, secret, replace-me, your-s2s-secret, and the other example values). Generate one with openssl rand -hex 32. Compose will not start without it. The value is never logged. |
MCP_ALLOW_INSECURE_DEV |
No | Set to exactly 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A wider MCP_HTTP_HOST (including 0.0.0.0) is ignored and the override is logged. A known placeholder secret still refuses to start. |
MCP_HTTP_HOST |
No | Bind address when a real CONDUIT_S2S_SECRET is set. Unset defaults to 127.0.0.1. The container image and Compose set 0.0.0.0 inside the container. |
MCP_HTTP_PORT |
No | HTTP port. Defaults to 8080. |
/health and /healthz stay unauthenticated and do not read credentials.
HTTP authentication
Установка
npx @wyre-ai/proofpoint-mcpКонфигурация
{
"mcpServers": {
"proofpoint-mcp": {
"command": "npx",
"args": ["@wyre-ai/proofpoint-mcp"],
"env": {
"PROOFPOINT_SERVICE_PRINCIPAL": "your-proofpoint-service-principal"
"PROOFPOINT_SERVICE_SECRET": "your-proofpoint-service-secret"
}
}
}
}