Security MCP Server 🐳 Docker

Avanan MCP

MCP server for Check Point Avanan (Harmony Email & Collaboration) — email security events, anti-phishing actions, exception management, and threat search.

🔗 Companion Plugin

Pair this MCP server with the Checkpoint Avanan plugin for skills, commands, and API knowledge alongside direct API access.

Installation

Run the MCP server with npx:

npx @wyre-technology/avanan-mcp

Or install the package:

npm install @wyre-technology/avanan-mcp

MCPB Bundle (Claude Desktop)

Download the .mcpb bundle from GitHub Releases for a zero-config Claude Desktop install. No Node.js or terminal required — just open the bundle in Claude Desktop via Settings → MCP Servers → Install from file. Requires Claude Desktop 0.10+.

Claude Desktop Configuration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "avanan": {
      "command": "npx",
      "args": [
        "@wyre-technology/avanan-mcp"
      ],
      "env": {
        "CHECKPOINT_CLIENT_ID": "your-checkpoint-client-id",
        "CHECKPOINT_CLIENT_SECRET": "your-checkpoint-client-secret",
        "CHECKPOINT_REGION": "your-checkpoint-region"
      }
    }
  }
}

Authentication

Variable	Required	Description
`CHECKPOINT_CLIENT_ID`	Yes	Check Point Infinity Portal API key (Client ID)
`CHECKPOINT_CLIENT_SECRET`	Yes	Check Point Infinity Portal API secret
`CHECKPOINT_REGION`	Yes	Check Point region (e.g., us, eu, ap)

Getting Credentials

⚠️ Portal verification pending

The instructions below are our best understanding of the vendor's credential-acquisition flow but have not been verified hands-on against the current portal. If you hit a step that doesn't match what you see, please let us know — we'll update the docs.

Vendor portal: https://portal.checkpoint.com/

Prerequisites

Check Point Infinity Portal account with API access enabled

Steps

Sign in to the Check Point Infinity Portal.
Navigate to Global Settings → API Keys.
Generate a new API key (Client ID + Secret).
Set CHECKPOINT_CLIENT_ID, CHECKPOINT_CLIENT_SECRET, and CHECKPOINT_REGION (us, eu, ap).

Architecture

Single TypeScript MCP server with flat tool exposure, authenticating via Check Point Infinity Portal OAuth client credentials.

Available Tools (7)

Tools are organized into 4 domains:

Events

Email security events — phishing, malware, BEC, DLP detections.

Tool	Description
`List events`	List Avanan security events with filters
`Get event`	Get details for a specific event

Actions

Take action on detected threats — quarantine, release, restore.

Tool	Description
`Quarantine message`	Quarantine an email message
`Release message`	Release a quarantined message

Exceptions

Manage allowlist / blocklist exception rules.

Tool	Description
`List exceptions`	List exception rules
`Create exception`	Create a new exception rule

Search

Search messages and events across the tenant.

Tool	Description
`Search messages`	Search messages by sender, subject, recipient, time range