Proofpoint MCP
Pull Proofpoint TAP threats, very attacked persons, clickers, and IOCs into your agent with a local threat store for faster triage.
Overview
Proofpoint MCP is an MCP server for the Operate phase that surfaces Proofpoint TAP threats, VAPs, clickers, and IOCs from the terminal with a local threat store.
What is this MCP server?
- Proofpoint Targeted Attack Protection (TAP) threat data accessible from terminal-oriented MCP and CLI workflows
- Local threat store for retaining and querying IOCs without re-fetching every thread
- Coverage themes: threats, VAPs (very attacked persons), clickers, and indicators
- stdio mcpb v0.1.0 with PROOFPOINT_API_SECRET and PROOFPOINT_SERVICE_PRINCIPAL credentials
- Published from Servosity msp-skills with pinned release artifact SHA256
- Server version 0.1.0
- Two required secret env vars: PROOFPOINT_API_SECRET, PROOFPOINT_SERVICE_PRINCIPAL
- Transport: stdio mcpb package
Community signal: 1 GitHub stars.
What problem does it solve?
Proofpoint alert context lives in vendor UIs and ad-hoc API scripts, so it is slow to correlate TAP events and IOCs while you are debugging or responding from your dev environment.
Who is it for?
Small teams with Proofpoint TAP who want CLI and MCP-native threat lookups while building internal security automations.
Skip if: Organizations without Proofpoint licensing, or builders who only need generic phishing awareness content with no live TAP API.
What do I get? / Deliverables
Your agent can query Proofpoint threat data and reuse a local threat store so follow-up triage questions stay in one conversational thread.
- Agent tools for Proofpoint TAP threat, VAP, clicker, and IOC queries
- Local threat store backing repeat triage without redundant API round-trips
Recommended MCP Servers
Journey fit
Email-threat visibility is production security operations—something you run continuously after you ship, not a one-time launch checklist item. TAP feeds, VAPs, and IOC correlation are ongoing monitoring tasks aligned with watching attacker behavior against your domain.
How it compares
Vendor-specific security MCP bridge, not a generic phishing-detection coding skill.
Common Questions / FAQ
Who is Proofpoint MCP for?
It is for technical founders, MSPs, and developers who operate Proofpoint TAP and want IOC and clicker intelligence inside Claude Code or another MCP client.
When should I use Proofpoint MCP?
Use it during incident triage, weekly threat reviews, or when correlating VAP and clicker activity before updating detection rules or customer communications.
How do I add Proofpoint MCP to my agent?
Add the proofpoint-mcp mcpb stdio server to your MCP configuration and set PROOFPOINT_API_SECRET and PROOFPOINT_SERVICE_PRINCIPAL as required secrets on the host.