loading…
Investigate this phishing report from finance
/api/mcp/srv-email-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Submit email attachment for deep malware analysis and threat detection
{
"type": "object",
"required": [
"attachment_hash"
],
"properties": {
"priority": {
"enum": [
"low",
"normal",
"high"
],
"type": "string",
"default": "normal"
},
"message_id": {
"type": "string",
"description": "Associated email message ID"
},
"analysis_type": {
"enum": [
"static",
"dynamic",
"full"
],
"type": "string",
"default": "static"
},
"attachment_hash": {
"type": "string",
"description": "SHA256 hash of attachment file"
}
}
}Submit URL for reputation analysis and threat detection using security engines
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string"
},
"force_rescan": {
"type": "boolean",
"default": false
},
"sandbox_analysis": {
"type": "boolean",
"default": true
},
"include_screenshot": {
"type": "boolean",
"default": false
}
}
}Add sender email address or domain to block list with specified block type and duration
{
"type": "object",
"required": [
"sender",
"block_type",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"sender": {
"type": "string"
},
"block_type": {
"enum": [
"temporary",
"permanent",
"domain",
"ip_range"
],
"type": "string"
},
"duration_hours": {
"type": "integer"
},
"apply_retroactively": {
"type": "boolean",
"default": false
}
}
}Create data loss prevention incident for email containing sensitive data
{
"type": "object",
"required": [
"message_id",
"policy_violated",
"data_types"
],
"properties": {
"notes": {
"type": "string",
"description": "Additional incident notes"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string",
"default": "medium"
},
"data_types": {
"type": "array",
"items": {
"enum": [
"pii",
"phi",
"pci",
"confidential",
"restricted"
],
"type": "string"
}
},
"message_id": {
"type": "string",
"description": "Email message identifier"
},
"assigned_to": {
"type": "string",
"description": "Security analyst email address"
},
"policy_violated": {
"type": "string",
"description": "DLP policy name that was violated"
}
}
}Retrieve email security incident details including related messages, timeline, and response actions
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
},
"include_messages": {
"type": "boolean",
"default": true
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_response_actions": {
"type": "boolean",
"default": false
}
}
}Retrieve detailed message information including headers, body, attachments, and threat analysis results
{
"type": "object",
"required": [
"message_id"
],
"properties": {
"message_id": {
"type": "string"
},
"include_body": {
"type": "boolean",
"default": false
},
"include_headers": {
"type": "boolean",
"default": true
},
"include_attachments": {
"type": "boolean",
"default": false
},
"include_threat_analysis": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed analysis of a specific email message including headers, attachments, and threat verdicts
{
"type": "object",
"required": [
"message_id"
],
"properties": {
"message_id": {
"type": "string",
"description": "Unique message identifier"
},
"include_headers": {
"type": "boolean",
"default": true
},
"include_attachments": {
"type": "boolean",
"default": true
},
"include_url_analysis": {
"type": "boolean",
"default": true
}
}
}Retrieve email security statistics and threat summary for a specific user mailbox
{
"type": "object",
"required": [
"user_email"
],
"properties": {
"time_range": {
"enum": [
"24h",
"7d",
"30d",
"90d"
],
"type": "string",
"default": "30d"
},
"user_email": {
"type": "string",
"description": "User email address"
},
"include_threat_breakdown": {
"type": "boolean",
"default": true
},
"include_policy_violations": {
"type": "boolean",
"default": true
}
}
}List quarantined messages with filtering by quarantine reason, sender domain, and time period
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"enum": [
"quarantined",
"released",
"deleted"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"sender_domain": {
"type": "string"
},
"recipient_domain": {
"type": "string"
},
"quarantine_reason": {
"enum": [
"malware",
"phishing",
"spam",
"policy_violation",
"suspicious_attachment"
],
"type": "string"
}
}
}List quarantined email messages with filtering by quarantine reason and time range
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 500
},
"status": {
"enum": [
"quarantined",
"released",
"deleted"
],
"type": "string",
"default": "quarantined"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string",
"default": "24h"
},
"quarantine_reason": {
"enum": [
"malware",
"phishing",
"policy_violation",
"suspicious_content",
"bulk_mail"
],
"type": "string"
}
}
}List current threat indicators including malicious URLs, file hashes, and sender reputation data
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000
},
"confidence": {
"enum": [
"low",
"medium",
"high"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string",
"default": "24h"
},
"threat_type": {
"enum": [
"malware",
"phishing",
"spam",
"c2",
"botnet"
],
"type": "string"
},
"indicator_type": {
"enum": [
"url",
"file_hash",
"ip_address",
"domain",
"email_address"
],
"type": "string"
}
}
}List detected email threats with filtering by threat type, severity, and detection engine
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"status": {
"enum": [
"detected",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"threat_type": {
"enum": [
"malware",
"phishing",
"spam",
"bec",
"credential_harvesting",
"suspicious_link"
],
"type": "string"
},
"detection_engine": {
"enum": [
"sandbox",
"url_reputation",
"attachment_analysis",
"content_filter",
"ml_classifier"
],
"type": "string"
}
}
}Search email messages using filters for sender, recipient, subject, attachments, and threat indicators
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"query": {
"type": "string",
"description": "Search query string"
},
"sender": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"recipient": {
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"threat_level": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"has_attachments": {
"type": "boolean"
},
"subject_contains": {
"type": "string"
}
}
}Release quarantined messages back to recipient mailboxes with optional notification
{
"type": "object",
"required": [
"message_ids"
],
"properties": {
"message_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"release_reason": {
"type": "string"
},
"override_policy": {
"type": "boolean",
"default": false
},
"notify_recipient": {
"type": "boolean",
"default": false
}
}
}Release quarantined email messages to their intended recipients
{
"type": "object",
"required": [
"message_ids"
],
"properties": {
"message_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of quarantined message IDs to release"
},
"release_reason": {
"type": "string",
"description": "Justification for release"
},
"notify_recipients": {
"type": "boolean",
"default": false
}
}
}Search email messages using filters for sender, recipient, subject, content, and threat indicators
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000
},
"query": {
"type": "string",
"description": "Email content search query"
},
"sender": {
"type": "string",
"description": "Sender email address or domain"
},
"subject": {
"type": "string",
"description": "Subject line contains text"
},
"recipient": {
"type": "string",
"description": "Recipient email address or domain"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"90d"
],
"type": "string",
"default": "24h"
},
"threat_types": {
"type": "array",
"items": {
"enum": [
"malware",
"phishing",
"spam",
"suspicious_attachment",
"url_threat"
],
"type": "string"
}
}
}
}Update email security policy rules for content filtering, attachment handling, and threat response
{
"type": "object",
"required": [
"policy_id",
"rule_type",
"action"
],
"properties": {
"action": {
"enum": [
"allow",
"block",
"quarantine",
"tag",
"encrypt"
],
"type": "string"
},
"enabled": {
"type": "boolean"
},
"priority": {
"type": "integer"
},
"policy_id": {
"type": "string"
},
"rule_type": {
"enum": [
"content_filter",
"attachment_policy",
"sender_policy",
"dlp_rule"
],
"type": "string"
},
"conditions": {
"type": "object"
}
}
}