Abnormal MCP Server for VS Code
io.github.gregdog/mcp-server-abnormal
Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.
client:VS Code
transport:stdio
runtime:oci
Install Abnormal MCP Server in VS Code
.vscode/mcp.json
{
"inputs": [
{
"type": "promptString",
"id": "abnormal-api-token",
"description": "ABNORMAL_API_TOKEN",
"password": true
},
{
"type": "promptString",
"id": "abnormal-base-url",
"description": "ABNORMAL_BASE_URL",
"password": true
},
{
"type": "promptString",
"id": "abnormal-allow-response",
"description": "ABNORMAL_ALLOW_RESPONSE",
"password": true
},
{
"type": "promptString",
"id": "abnormal-allow-evidence-download",
"description": "ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD",
"password": true
},
{
"type": "promptString",
"id": "abnormal-max-evidence-bytes",
"description": "ABNORMAL_MAX_EVIDENCE_BYTES",
"password": true
}
],
"servers": {
"mcp-server-abnormal": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/gregdog/mcp-server-abnormal:v1.1.0"
],
"env": {
"ABNORMAL_API_TOKEN": "${input:abnormal-api-token}",
"ABNORMAL_BASE_URL": "${input:abnormal-base-url}",
"ABNORMAL_ALLOW_RESPONSE": "${input:abnormal-allow-response}",
"ABNORMAL_ALLOW_EVIDENCE_DOWNLOAD": "${input:abnormal-allow-evidence-download}",
"ABNORMAL_MAX_EVIDENCE_BYTES": "${input:abnormal-max-evidence-bytes}"
}
}
}
}VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs