Phished

Run a security-awareness platform from your assistant: recipients, simulation templates, SSO, admins.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Phished connector does

The Phished MCP server connects Claude, ChatGPT or any MCP client to Phished, a security-awareness platform that mails simulated phishing to a company's own staff. Ninety-six tools manage recipients, simulation templates, landing pages, SSO configurations and administrators. Thirteen delete things. Anthropic's directory record carries no permissions label at all.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Phished tools (96)

  • create-administrator
  • create-allow-block-list-entry
  • create-button-response
  • create-department
  • create-domain
  • create-email-branding-template
  • create-landing-page
  • create-location
  • create-recipient
  • create-simulation-template
  • create-smtp-profile
  • create-sso-configuration
  • create-target-list
  • delete-activation-report
  • delete-administrator
  • delete-allow-block-list-entry
  • delete-button-response
  • delete-department
  • delete-email-branding-template
  • delete-landing-page
  • delete-location
  • delete-recipient
  • delete-recipient-by-email
  • delete-smtp-profile
  • delete-sso-configuration
  • delete-target-list
  • get-academy-settings
  • get-activation-report
  • get-administrator
  • get-departments-brs
  • get-email-branding-template
  • get-landing-page
  • get-recipient
  • get-recipient-brs
  • get-recipient-brs-history
  • get-recipient-default-module-stats
  • get-recipient-progression
  • get-recipient-progression-expired
  • get-recipient-summary
  • get-recipient-training-session-stats
  • get-recipient-upcoming-simulation-send
  • get-recipients
  • get-simulation-settings
  • get-simulation-template
  • get-sso-configuration
  • get-target-list
  • limit-recipient-access
  • list-academy-modules
  • list-activation-report-emails
  • list-activation-report-links
  • list-activation-report-logs
  • list-activation-reports
  • list-administrators
  • list-allow-block-list-entries
  • list-automated-simulation-sends
  • list-button-responses
  • list-departments
  • list-domains
  • list-email-branding-templates
  • list-landing-pages
  • list-level-progression
  • list-locations
  • list-manual-simulation-sends
  • list-organisation-events
  • list-organisation-events-history
  • list-recipient-events
  • list-recipient-events-history
  • list-recipient-my-apps-and-devices-completion
  • list-recipient-simulation-events
  • list-recipient-threat-alerts-completion
  • list-recipients
  • list-recipients-with-tags
  • list-reply-templates
  • list-scheduled-simulations
  • list-simulation-domains
  • list-simulation-events
  • list-simulation-templates
  • list-smtp-profiles
  • list-sso-configurations
  • list-target-lists
  • list-training-progression
  • send-simulation-template-test
  • update-academy-application-branding-settings
  • update-academy-settings
  • update-activation-report
  • update-administrator
  • update-button-response
  • update-email-branding-template
  • update-landing-page
  • update-recipient
  • update-recipient-by-email
  • update-simulation-settings
  • update-smtp-profile
  • update-sso-configuration
  • update-target-list
  • validate-domain

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • One OAuth scope, mcp:use, over all 96 tools. Consent cannot be narrowed to reads. Phished's REST API has per-operation scopes; the MCP grant does not expose them.
  • Anthropic's directory record carries no permissions field at all. Not read-only, not read-and-write — the key is absent. This is the largest unlabelled surface in this catalogue.
  • Thirteen delete tools, reaching administrators, SSO configurations, SMTP profiles, landing pages, target lists, departments, locations and recipient records.
  • send-simulation-template-test mails up to 50 real employees per call. Phished documents it as a test send that does not launch a campaign; it still delivers simulated phishing to colleagues.
  • delete-recipient-by-email and update-recipient-by-email act on a typed address, with no identifier-resolution step in between.
  • create-administrator can grant access immediately, without an invitation, when the email already administrates another organisation of the same partner.
  • Repeated create-administrator calls silently update permissions rather than failing — safe for bulk import, quiet about privilege changes.
  • No campaign-creation tool. The REST API documents manual-campaign creation; MCP omits it. Campaign launch stays a human action in the Phished UI.
  • An active plan is required. Phished states its API is unavailable to organisations without one.
  • We could not verify which admin role mints a token. Phished's help-centre article on authentication tokens redirects to a login wall, which we did not pass.
  • No prompts are listed in Anthropic's snapshot.
  • We did not read the live schemas. The endpoint returned 401 to an anonymous handshake, so tool names come from Anthropic's directory snapshot and their behaviour from Phished's published API reference — not from a wire response, and with no safety annotations available at all. No tool on this page can be described as annotated read-only or annotated destructive, because we could not read the annotations. Treat every write-shaped name as acting.

Frequently asked questions

Can the Phished MCP server launch a phishing simulation at my employees?

It cannot launch a campaign, but one tool does put simulated phishing mail in real inboxes. Phished documents the test-send endpoint as delivering a template to up to fifty existing recipients, and states plainly that it does not launch a real campaign. No tool creates or schedules a campaign — the REST API has a create-manual-campaign operation and the MCP list omits it.

How many of the 96 Phished MCP tools destroy or change things?

Thirty-nine act, and thirteen of those delete. Counted mechanically from Anthropic's directory snapshot: thirteen create, thirteen delete, thirteen update, plus one send, one validate and one access-limiting tool. The remaining fifty-four read — twenty get and thirty-four list. So roughly two in five tools write, and one in seven destroys something.

What can the Phished MCP administrator tools actually do?

They manage who administers your security-awareness tenant. Phished documents the create endpoint as adding an administrator with per-area permissions, including an owner flag and a permission to view reports containing personal data. An existing Phished user at a sibling partner organisation gains access immediately; anyone else receives an invitation. The delete and update tools reach the same accounts.

Does the Phished connector let you restrict an agent to read-only access?

No. The OAuth metadata advertises exactly one scope, and it is not split by verb. Every grant that reaches the read tools also reaches the thirteen deletes and the test-send. Phished's underlying REST API does use granular per-operation scopes, but nothing in the MCP consent flow lets a user hold back write access at authorisation time.

What employee personal data does the Phished MCP server reach?

Staff directory records. Phished's API reference shows a recipient carrying first name, last name, email address, phone number, job function, language and active status, plus department and location identifiers. Phished's privacy policy describes itself as a processor acting for the customer organisation, which remains the controller of that employee data.

Does Anthropic's directory say what permissions the Phished connector needs?

No. The directory record has no permissions field at all — not a read-only label, not a read-and-write one. That absence sits over ninety-six tools including administrator and SSO management, which makes it the largest unlabelled surface in this catalogue. Read the verb census on this page rather than relying on the listing.

What do you need to enable the Phished MCP connector?

An active Phished plan and an organisation token. Phished's API reference states that an organisation needs an active plan to use the API at all, and that requests authenticate with an organisation-level bearer token. Token creation is documented in Phished's help centre, which sits behind a login wall we did not pass, so we could not verify which admin role mints one.

Sources

  • Phished developer portal — https://developer.phished.io/ (fetched 2026-08-19; the documentation URL in Anthropic's directory. A Stoplight-hosted SPA publishing three separate API references: Legacy Phished API, Phished API, Phished Power BI API) · retrieved 2026-08-19
  • Phished API reference overview — https://developer.phished.io/docs/api/7rh8o1fc8jtiy-phished-api (fetched 2026-08-19; version v2023-07-07, base URL https://api.phished.io, bearer organisation token, active plan required. Group list used for the coverage comparison, including the manual-campaign operations absent from MCP) · retrieved 2026-08-19
  • Send a test simulation from a template — https://developer.phished.io/docs/api/2405a5448a2c9-send-a-test-simulation-from-a-template (fetched 2026-08-19; sends to existing recipients, at most 50 per request, per-recipient sent / recipient_not_found / send_failed results, required scope simulation-templates:send, documented as not launching a real campaign) · retrieved 2026-08-19
  • Create an administrator for the organisation — https://developer.phished.io/docs/api/1fb7cb7ad451d-create-an-administrator-for-the-organisation (fetched 2026-08-19; is_owner and per-area permissions including can_view_reports_with_pii; immediate access for a sibling partner organisation, invitation otherwise; repeat calls update permissions; required scope administrators:create) · retrieved 2026-08-19
  • Create an SSO configuration — https://developer.phished.io/docs/api/dd62a039b8180-create-an-sso-configuration (fetched 2026-08-19; SAML entity ID, login/logout URLs, idp_x509_cert, application_type of ACADEMY or CLIENT; required scope sso-configurations:create) · retrieved 2026-08-19
  • Get recipient by id — https://developer.phished.io/docs/api/28553368f1a5b-get-recipient-by-id (fetched 2026-08-19; recipient fields and required scope recipients:read) · retrieved 2026-08-19
  • Phished privacy policy — https://phished.io/privacy-policy (fetched 2026-08-19; Phished processes personal data on behalf of the customer organisation, which is the controller) · retrieved 2026-08-19
  • Phished help centre, creating an authentication token — https://helpcenter.phished.io/hc/en-us/articles/7882759768861-How-to-create-an-authentication-token (attempted 2026-08-19; returns 403 to a direct fetch and redirects a browser to a Phished sign-in page. Not read — we did not authenticate) · retrieved 2026-08-19
  • developer.phished.io/robots.txt is User-agent: * with no disallow rules and no Content-Signal header (fetched 2026-08-19). llms.txt and sitemap.xml both return the SPA shell with HTTP 404, so the page inventory came from the rendered portal navigation · retrieved 2026-08-19
  • Live RFC 9728 protected-resource descriptor — https://mcp.phished.io/.well-known/oauth-protected-resource/mcp (fetched 2026-08-19; the form named by the www-authenticate header. Authorization server https://app.phished.io, scopes_supported is ["mcp:use"]. The root form also returns 200 with the same scope and a different resource value; the path-insert form returns an HTML 404) · retrieved 2026-08-19
  • Live RFC 8414 authorization-server metadata — https://mcp.phished.io/.well-known/oauth-authorization-server (fetched 2026-08-19; issuer https://app.phished.io, authorization_code and refresh_token grants, PKCE S256, a registration_endpoint for dynamic client registration, scopes_supported ["mcp:use"]) · retrieved 2026-08-19
  • Live anonymous probe — 2026-08-19: an anonymous initialize POST to https://mcp.phished.io/mcp returned HTTP 401 with www-authenticate: Bearer realm="mcp", resource_metadata="https://mcp.phished.io/.well-known/oauth-protected-resource/mcp". No tool was ever called and no authentication was attempted · retrieved 2026-08-19
  • Anthropic connector directory — https://claude.ai/directory/dca5e54b-c05e-4c7f-8a00-bf01c9e74b71 (snapshot 2026-08-16; 96 tool names, no prompts, no permissions field on the record, author Phished BV, partner tier) · retrieved 2026-08-16

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Phished to work.

Connect Phished once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio