🧪 Community ✓ Claude Code ✓ Claude Desktop 🔌 Requires MCP Server • Ironscales

Ironscales

Claude plugins for IRONSCALES - AI-powered anti-phishing, incident triage, email classification, and crowdsourced threat intelligence

🔌 Recommended MCP Server

Pair this plugin with the Ironscales MCP for direct API access alongside skills and commands.

Installation

Install this plugin individually:

/plugin marketplace add wyre-technology/msp-claude-plugins --plugin ironscales

Or install all MSP plugins at once:

/plugin marketplace add wyre-technology/msp-claude-plugins

Features

Incident Management

Skills

This plugin provides 2 skills that teach Claude about Ironscales:

Skill	Description
`incidents`	Ironscales phishing incidents end to end: incident statuses and severities, the five remediation actions and which of them are irreversible, the stateless AI email-classification tool and the message content it exports, allowlist entries for email/domain/IP, daily-triage and campaign workflows, and the failure modes — already-closed incidents, partial remediation, and allowlist scope.
`api-patterns`	Ironscales MCP fundamentals: API-key plus company-ID header authentication and the per-tenant scoping that follows from it, the nine tools this server registers and what each one actually changes, offset/limit pagination without a total count, rate-limit behavior, and how API failures surface to the model.

Agents

This plugin provides 2 agents for autonomous task execution:

Agent	Description
`crowdsourced-intel-harvester`	Use this agent when harvesting and analyzing crowdsourced threat intelligence from IRONSCALES' global network — identifying trending attack types, surfacing indicators seeing increased reports, comparing client threat profiles to industry peers, and generating intelligence briefings from the collective signal.
`phishing-responder`	Use this agent when responding to user-reported phishing emails in IRONSCALES, triaging the incident queue, investigating incidents, coordinating quarantine and remediation, or reviewing security statistics for MSP clients.

Commands

Available slash commands:

Command	Description
`/classify-email`	Get an Ironscales AI verdict on a raw email, then act on it with a remediation action
`/triage-incidents`	Triage open Ironscales phishing incidents — list by status and severity, investigate, and remediate

API Reference

Base URL
Authentication
Rate Limit
Documentation

Example Usage

Get an Ironscales AI verdict on a raw email, then act on it with a remediation action

/classify-email

Triage open Ironscales phishing incidents — list by status and severity, investigate, and remediate

/triage-incidents

Using Skills

/skill ironscales:incidents

Ironscales phishing incidents end to end: incident statuses and severities, the five remediation actions and which of them are irreversible, the stateless AI email-classification tool and the message content it exports, allowlist entries for email/domain/IP, daily-triage and campaign workflows, and the failure modes — already-closed incidents, partial remediation, and allowlist scope.