IRONSCALES API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited IRONSCALES API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The Ironscales MCP server provides AI tool integration with the Ironscales anti-phishing platform. It exposes tools for listing and triaging phishing incidents, classifying emails, taking remediation actions, managing sender allowlists, and accessing company-wide phishing statistics. Authentication uses an API key and company ID passed as request headers.
Ironscales uses a static API key combined with a company ID for authentication. The MCP Gateway injects these via headers:
| Header | Description |
|---|---|
X-Ironscales-API-Key | Your Ironscales API key |
X-Ironscales-Company-ID | Your Ironscales company (tenant) ID |
Generate credentials at: Ironscales Platform > Settings > API
Environment Variables (self-hosted):
export IRONSCALES_API_KEY="your-api-key"
export IRONSCALES_COMPANY_ID="your-company-id"IMPORTANT: Never hardcode credentials. Always use environment variables or the MCP Gateway.
The Company ID scopes all API requests to a specific tenant. MSPs managing multiple clients require a separate API key and company ID per client.
| Tool | Description |
|---|---|
ironscales_list_incidents | List phishing incidents with status and type filters |
ironscales_get_incident | Get detailed information for a specific incident |
ironscales_classify_email | Classify an incident's email as phishing, spam, or legitimate |
ironscales_remediate_incident | Take a remediation action on a confirmed incident |
| Tool | Description |
|---|---|
ironscales_get_company_stats | Get company-wide phishing statistics and dashboard metrics |
| Tool | Description |
|---|---|
ironscales_manage_allowlist | Add, remove, or list sender allowlist entries |
The Ironscales API uses offset-based pagination:
offset and limit parameters to paginate resultslimit is typically 50 records per pagetotal — the total number of matching recordsExample response with pagination:
{
"incidents": [...],
"total": 148,
"offset": 0,
"limit": 50
}Pagination workflow:
offset=0 and limit=50total > offset + limit, call again with offset=50limit until all records are retrievedIronscales enforces per-endpoint rate limits.
| Code | Meaning | Resolution |
|---|---|---|
| 400 | Bad Request | Check required parameters and classification values |
| 401 | Unauthorized | Verify API key and company ID |
| 403 | Forbidden | API key lacks permissions for this operation |
| 404 | Not Found | Incident ID or resource does not exist |
| 429 | Rate Limited | Wait and retry with exponential backoff |
| 500 | Server Error | Retry; contact Ironscales support if persistent |
{
"error": "INVALID_API_KEY",
"message": "The provided API key is invalid.",
"code": 401
}companyId in all requests (handled automatically by the MCP server)open, closed) to focus on actionable incidentsoffset pagination with status filters to efficiently process large incident backlogsironscales_get_company_stats weekly to track phishing trends and identify anomalies~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.