Abnormal Security

The materials show it requires ABNORMAL_API_TOKEN, which is a sensitive API credential; if exposed, it could be used to access Abnormal Security-related detection, case, or remediation capabilities. AUTH_MODE, MCP_TRANSPORT, and LOG_LEVEL appear to be configuration values rather than highly sensitive secrets.

No remote host is listed in the objective materials, but the tool is clearly intended for Abnormal Security services and uses an API token, which normally implies communication with service-related endpoints. Because the README and endpoint details are absent, the exact egress targets and data scope cannot be confirmed and should be verified during deployment.

The system checks indicate that the tool executes code or starts a local process, which is standard behavior for MCP tools. The materials do not show requests for unusual system privileges, nor do they describe obviously unrelated high-risk execution capabilities.

Based on the description, its primary access scope is likely Abnormal Security data related to email threat detection, cases, and remediation. The materials do not specify local file read/write behavior or broad filesystem access, so over-privilege is not established, but it should be assumed to handle business-sensitive security incident data.

There are meaningful positive supply-chain signals: it is listed in an official registry, has a public open-source repository, and was updated within the last year, making the code auditable. Although the repository does not declare a license and has low star count, those factors warrant review rather than a high-risk rating based on the available evidence.