Abnormal MCP Server

io.github.GregDog/mcp-server-abnormal

Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "mcp-server-abnormal": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/gregdog/mcp-server-abnormal:v1.1.0"
      ],
      "env": {
        "ABNORMAL_API_TOKEN": "<your ABNORMAL_API_TOKEN>",
        "ABNORMAL_BASE_URL": "https://api.abnormalplatform.com/v1",
        "ABNORMAL_ALLOW_RESPONSE": "false",
        "ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD": "false",
        "ABNORMAL_MAX_EVIDENCE_BYTES": "10485760"
      }
    }
  }
}
Environment variables
  • ABNORMAL_API_TOKENrequiredsecretAbnormal REST API bearer token
  • ABNORMAL_BASE_URLAbnormal API base URL
  • ABNORMAL_ALLOW_RESPONSEEnable response MCP tools (remediation)
  • ABNORMAL_ALLOW_EVIDENCE_DOWNLOADEnable evidence download MCP tools (EML and attachments)
  • ABNORMAL_MAX_EVIDENCE_BYTESMax bytes per evidence download from Abnormal

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
1.1.0
Registry
active
Published
9/17/2026
Browse all Developer Tools →

Add the badge to your site

Show visitors that Abnormal MCP Server is listed here — it’s also the link we check for a free listing.

Abnormal MCP Server — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-gregdog-mcp-server-abnormal?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="Abnormal MCP Server — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![Abnormal MCP Server — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-gregdog-mcp-server-abnormal?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.