Phished
by Phished
Run a security-awareness platform from your AI assistant: recipients, simulation templates, SSO and administrators. Ninety-six tools, thirteen of them deletes, and Anthropic's directory record carries no permissions label at all.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Phished via MCP
https://mcp.phished.io/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Phished Tools & Capabilities (96)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- One OAuth scope,
mcp:use, over all 96 tools. Consent cannot be narrowed to reads. Phished's REST API has per-operation scopes; the MCP grant does not expose them. - Anthropic's directory record carries no permissions field at all. Not read-only, not read-and-write — the key is absent. This is the largest unlabelled surface in this catalogue.
- Thirteen delete tools, reaching administrators, SSO configurations, SMTP profiles, landing pages, target lists, departments, locations and recipient records.
send-simulation-template-testmails up to 50 real employees per call. Phished documents it as a test send that does not launch a campaign; it still delivers simulated phishing to colleagues.delete-recipient-by-emailandupdate-recipient-by-emailact on a typed address, with no identifier-resolution step in between.create-administratorcan grant access immediately, without an invitation, when the email already administrates another organisation of the same partner.- Repeated
create-administratorcalls silently update permissions rather than failing — safe for bulk import, quiet about privilege changes. - No campaign-creation tool. The REST API documents manual-campaign creation; MCP omits it. Campaign launch stays a human action in the Phished UI.
- An active plan is required. Phished states its API is unavailable to organisations without one.
- We could not verify which admin role mints a token. Phished's help-centre article on authentication tokens redirects to a login wall, which we did not pass.
- No prompts are listed in Anthropic's snapshot.
- We did not read the live schemas. The endpoint returned 401 to an anonymous handshake, so tool names come from Anthropic's directory snapshot and their behaviour from Phished's published API reference — not from a wire response, and with no safety annotations available at all. No tool on this page can be described as annotated read-only or annotated destructive, because we could not read the annotations. Treat every write-shaped name as acting.
Frequently asked questions
Can the Phished MCP server launch a phishing simulation at my employees?
It cannot launch a campaign, but one tool does put simulated phishing mail in real inboxes. Phished documents the test-send endpoint as delivering a template to up to fifty existing recipients, and states plainly that it does not launch a real campaign. No tool creates or schedules a campaign — the REST API has a create-manual-campaign operation and the MCP list omits it.
How many of the 96 Phished MCP tools destroy or change things?
Thirty-nine act, and thirteen of those delete. Counted mechanically from Anthropic's directory snapshot: thirteen create, thirteen delete, thirteen update, plus one send, one validate and one access-limiting tool. The remaining fifty-four read — twenty get and thirty-four list. So roughly two in five tools write, and one in seven destroys something.
What can the Phished MCP administrator tools actually do?
They manage who administers your security-awareness tenant. Phished documents the create endpoint as adding an administrator with per-area permissions, including an owner flag and a permission to view reports containing personal data. An existing Phished user at a sibling partner organisation gains access immediately; anyone else receives an invitation. The delete and update tools reach the same accounts.
Does the Phished connector let you restrict an agent to read-only access?
No. The OAuth metadata advertises exactly one scope, and it is not split by verb. Every grant that reaches the read tools also reaches the thirteen deletes and the test-send. Phished's underlying REST API does use granular per-operation scopes, but nothing in the MCP consent flow lets a user hold back write access at authorisation time.
What employee personal data does the Phished MCP server reach?
Staff directory records. Phished's API reference shows a recipient carrying first name, last name, email address, phone number, job function, language and active status, plus department and location identifiers. Phished's privacy policy describes itself as a processor acting for the customer organisation, which remains the controller of that employee data.
Does Anthropic's directory say what permissions the Phished connector needs?
No. The directory record has no permissions field at all — not a read-only label, not a read-and-write one. That absence sits over ninety-six tools including administrator and SSO management, which makes it the largest unlabelled surface in this catalogue. Read the verb census on this page rather than relying on the listing.
What do you need to enable the Phished MCP connector?
An active Phished plan and an organisation token. Phished's API reference states that an organisation needs an active plan to use the API at all, and that requests authenticate with an organisation-level bearer token. Token creation is documented in Phished's help centre, which sits behind a login wall we did not pass, so we could not verify which admin role mints one.
Sources
- Phished developer portal — https://developer.phished.io/ (fetched 2026-08-19; the
documentationURL in Anthropic's directory. A Stoplight-hosted SPA publishing three separate API references: Legacy Phished API, Phished API, Phished Power BI API) · retrieved 2026-08-19 - Phished API reference overview — https://developer.phished.io/docs/api/7rh8o1fc8jtiy-phished-api (fetched 2026-08-19; version v2023-07-07, base URL
https://api.phished.io, bearer organisation token, active plan required. Group list used for the coverage comparison, including the manual-campaign operations absent from MCP) · retrieved 2026-08-19 - Send a test simulation from a template — https://developer.phished.io/docs/api/2405a5448a2c9-send-a-test-simulation-from-a-template (fetched 2026-08-19; sends to existing recipients, at most 50 per request, per-recipient
sent/recipient_not_found/send_failedresults, required scopesimulation-templates:send, documented as not launching a real campaign) · retrieved 2026-08-19 - Create an administrator for the organisation — https://developer.phished.io/docs/api/1fb7cb7ad451d-create-an-administrator-for-the-organisation (fetched 2026-08-19;
is_ownerand per-area permissions includingcan_view_reports_with_pii; immediate access for a sibling partner organisation, invitation otherwise; repeat calls update permissions; required scopeadministrators:create) · retrieved 2026-08-19 - Create an SSO configuration — https://developer.phished.io/docs/api/dd62a039b8180-create-an-sso-configuration (fetched 2026-08-19; SAML entity ID, login/logout URLs,
idp_x509_cert,application_typeof ACADEMY or CLIENT; required scopesso-configurations:create) · retrieved 2026-08-19 - Get recipient by id — https://developer.phished.io/docs/api/28553368f1a5b-get-recipient-by-id (fetched 2026-08-19; recipient fields and required scope
recipients:read) · retrieved 2026-08-19 - Phished privacy policy — https://phished.io/privacy-policy (fetched 2026-08-19; Phished processes personal data on behalf of the customer organisation, which is the controller) · retrieved 2026-08-19
- Phished help centre, creating an authentication token — https://helpcenter.phished.io/hc/en-us/articles/7882759768861-How-to-create-an-authentication-token (attempted 2026-08-19; returns 403 to a direct fetch and redirects a browser to a Phished sign-in page. Not read — we did not authenticate) · retrieved 2026-08-19
developer.phished.io/robots.txtisUser-agent: *with no disallow rules and noContent-Signalheader (fetched 2026-08-19).llms.txtandsitemap.xmlboth return the SPA shell with HTTP 404, so the page inventory came from the rendered portal navigation · retrieved 2026-08-19- Live RFC 9728 protected-resource descriptor — https://mcp.phished.io/.well-known/oauth-protected-resource/mcp (fetched 2026-08-19; the form named by the
www-authenticateheader. Authorization serverhttps://app.phished.io,scopes_supportedis["mcp:use"]. The root form also returns 200 with the same scope and a differentresourcevalue; the path-insert form returns an HTML 404) · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://mcp.phished.io/.well-known/oauth-authorization-server (fetched 2026-08-19; issuer
https://app.phished.io,authorization_codeandrefresh_tokengrants, PKCE S256, aregistration_endpointfor dynamic client registration,scopes_supported["mcp:use"]) · retrieved 2026-08-19 - Live anonymous probe — 2026-08-19: an anonymous initialize POST to
https://mcp.phished.io/mcpreturned HTTP 401 withwww-authenticate: Bearer realm="mcp", resource_metadata="https://mcp.phished.io/.well-known/oauth-protected-resource/mcp". No tool was ever called and no authentication was attempted · retrieved 2026-08-19 - Anthropic connector directory — https://claude.ai/directory/dca5e54b-c05e-4c7f-8a00-bf01c9e74b71 (snapshot 2026-08-16; 96 tool names, no prompts, no permissions field on the record, author Phished BV, partner tier) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Phished
- Tools
- 96
- Domain
- mcp.phished.io
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.