Skip to content

Client API MCP Server (Beta)#

Connect AI assistants — Claude, Cursor, and other MCP-compatible tools — directly to your PhishFort account. Once connected, your assistant can look up your incidents, check takedown progress, and answer questions like "what is still open?" or "is this domain being handled?" from your live incident data.

This is not the docs server

This server connects to your account data and requires you to sign in. For the unauthenticated server that only searches this documentation, see Docs MCP Server.

Endpoint#

https://client-mcp.phishfort.com/mcp

The server uses the standard streamable HTTP transport with OAuth 2.0 authorization. There is no API key to configure — when your assistant first connects, your browser opens the PhishFort dashboard, you sign in with your dashboard account, and you approve the connection on a consent screen.

What a connection can do#

  • Read-only by default. A new connection can look up and read incidents — nothing else. It cannot report new threats or approve takedowns — do those in the dashboard or via the REST API (Report Incident, Approve a Takedown).
  • Commenting is a separate opt-in. The consent screen offers adding comments to your incidents as an unticked checkbox. It is granted only if you tick it, and any comment your assistant adds is attributed to the dashboard account that approved the connection.
  • Scoped to your account. The connection sees the incidents your dashboard account can see: your account and its sub-clients. Use the whoami tool to check exactly what a connection covers.
  • Tied to the approving user. If the dashboard account that approved a connection is disabled, the connection stops working.
Scope Granted Allows
mcp:incidents:read Always Listing, counting, searching and reading incidents
mcp:incidents:write Only if you opt in Adding comments to existing incidents

Connecting#

  1. Go to Settings → Connectors → Add custom connector
  2. Name it e.g. PhishFort and enter the URL https://client-mcp.phishfort.com/mcp
  3. Save, then click Connect — your browser opens the PhishFort dashboard to sign in and approve
claude mcp add --transport http phishfort https://client-mcp.phishfort.com/mcp

Then run /mcp inside Claude Code to complete the sign-in in your browser.

codex mcp add phishfort --url https://client-mcp.phishfort.com/mcp
codex mcp login phishfort

The second command opens your browser to sign in and approve.

{
    "mcpServers": {
        "phishfort": {
            "url": "https://client-mcp.phishfort.com/mcp"
        }
    }
}

Your client will prompt you to authorize in the browser on first use.

Available Tools#

Tool Description
whoami Shows which account the connection reads, the sub-clients included, and whether commenting is enabled.
list_incidents Lists incidents newest first, with filters for status, open-only, incident type, sub-client, date range, and monitored executive.
count_incidents Counts incidents without transferring them — totals and per-status breakdowns.
find_incident Finds incidents by what is under attack — a domain, URL, social profile, email address, phone number or IP — or by an inc_ reference.
get_incident Full detail of one incident: what it is, current status, recent activity, attachments, and which blocking partners list it.
get_incident_history The running activity timeline of one incident — what happened, when, and what it is waiting on. Each entry carries a kind (status, comment, takedown_approval_response, update) so approvals can be counted without parsing message text.
get_incident_insights Technical findings from the most recent examination of the threat: domain age and registrar, certificate, DNS records, hosting, and page content. Not every incident has a capture.
add_comment (requires the commenting opt-in) Sends a message to the PhishFort analyst handling the incident, attributed to the account holder who approved the connection.

Incident statuses returned by these tools are the same as the REST API's — see the Incident Lifecycle.

Example prompts#

Once connected, ask your assistant questions in plain language — it picks the right tools and filters for you.

Staying on top of open work

  • "Which of our incidents are still open? Is anything waiting on us?"
  • "What changed across our incidents this week?"
  • "Show me the open incidents for our brand Acme Payments." (sub-clients work too — ask "what does this connection cover?" to see them)

Reporting and numbers

  • "How many incidents were detected last month, broken down by status?"
  • "How many takedowns were completed for us this quarter?"

Checking a specific threat

  • "Is login-mybrand.example being handled? What's the latest on it?"
  • "Why is the takedown for inc_a1b2c3d4 taking so long?"

Digging into the technical detail

  • "How new is the domain behind incident inc_a1b2c3d4, and who hosts it?"
  • "Which blocking partners have listed that site?"

Talking to the analyst (requires the commenting opt-in)

  • "Tell the analyst on that incident that we've confirmed the customer report."

Getting good answers

  • Include a timeframe ("last month", "since July 1st") when asking for counts or summaries.
  • Refer to incidents by the incident ID shown in the dashboard, or simply by the domain or URL under attack — both work.
  • If your account has sub-clients, name the brand you mean, or ask about all of them at once.

Disconnecting#

Remove the connector from your AI tool to stop it making new requests. If you need a connection revoked on the PhishFort side — for example for a tool you no longer control — contact support at support@phishfort.com.