Fallax

Fallax MCP server: connect Claude or ChatGPT

The Fallax MCP server exposes one workspace's phishing-simulation results to Claude, ChatGPT and any other MCP client. Read-only apart from two stop controls, OAuth 2.1, no API key, and twelve tools documented here.

The Fallax MCP server answers questions about one workspace's phishing-simulation programme: rates over time, which departments and lures perform worst, what has been launched, and which applications the tenant actually uses.

• Endpoint: https://app.fallax.io/mcp
• Per workspace: https://app.fallax.io/mcp/{workspace-slug}, which is what somebody who belongs to several workspaces connects one at a time. The bare endpoint works when you belong to exactly one.
• Authentication: OAuth 2.1 with PKCE and dynamic client registration. Discovery starts at https://app.fallax.io/.well-known/oauth-protected-resource, and an unauthenticated call answers 401 with a WWW-Authenticate header naming it.

Connecting

• Turn the server on for the workspace. An owner or admin enables assistant access in Fallax under Settings. Until then the endpoint answers every caller with a refusal, so a workspace that has not asked for this cannot be read by an assistant.
• Add the URL to the assistant. In Claude add it as a custom connector, in ChatGPT as a developer-mode connector, and in any other MCP client as a remote server. The URL is the whole configuration: there is no API key to mint, copy or rotate.
• Sign in once. The client opens an OAuth flow, you sign in with the Google or Microsoft account you already use for Fallax, and you approve the connection. Membership of the workspace is rechecked on every single call afterwards, not captured at connect time.

How it behaves

• Read-only by default. Ten of the twelve tools only read. The two that write can pause the continuous programme or take one person out of it, which are both ways of making Fallax do less. Nothing here can create, launch or schedule a simulation.
• Person-level data is opt-in. Tools that name individuals stay hidden unless the workspace has allowed person-level access, and the call path rechecks that rather than trusting the client to hide them.
• Transport. Streamable HTTP, JSON in and JSON out, no session state. Protocol revisions 2025-06-18, 2025-03-26 and 2024-11-05 are accepted.

Tools

• get_program_summary (read-only): Headline results of the phishing-simulation programme for a period: how many people were tested, and the open, click, credential-submit and report rates, each compared with the previous period of the same length. Start here for questions like 'how are we doing' or 'has our click rate improved'.
• get_resilience_trend (read-only): The same rates over time, bucketed by week (30d and 90d windows) or by month (12m and all time), so an assistant can describe or chart the direction of travel rather than a single snapshot.
• get_breakdowns (read-only): The same period cut four ways: by department, by template, by send language, and by campaign. This is what answers 'which team is most at risk', 'which lure worked', and 'do our Dutch speakers click more'. Ask for one cut with by, or omit it for all four.
• list_campaigns (read-only): Every simulation campaign in the workspace, newest first, with its status and its funnel (delivered, opened, clicked, submitted, reported). Unlike the reporting tools this includes drafts and scheduled campaigns that have never been launched.
• get_campaign (read-only): One campaign in full: which template and landing page it used, which audience and sending domain, its schedule, and its funnel with rates. Accepts either the campaign id or its name.
• list_discovered_apps (read-only): The SaaS applications the customer's own Google or Microsoft tenant says its people actually use, with how many distinct users were seen and whether Fallax ships a lure that impersonates that app. The single best predictor of whether a simulation is plausible, and the right input when suggesting what to simulate next. Returns nothing unless the workspace turned app discovery on.
• get_setup_status (read-only): What this workspace has and has not set up: people in the directory, audiences, templates, landing pages, verified domains, connected mailbox tenants, whether any simulation has actually been delivered, and whether the continuous programme is running. Use it to answer 'are we ready to run a simulation' or to explain why a report is empty.
• get_evidence_bundle (read-only, person-level access required): The ISO 27001 A.6.3 audit trail: one row per person per campaign, with their email address, department, the language they were sent, and the timestamps of every interaction. This is the export an auditor asks for. It names individuals, so the workspace must have turned person-level access on.
• get_programme_status (read-only): Whether the continuous simulation programme is running, how many people are enrolled, how the workspace's security score is distributed, and what it has queued to send next. This is the 'is our security training actually running' question, and it is the one nobody logs in to check.
• explain_send (read-only, person-level access required): Why one person got the simulation they got, when they got it: their security band and score, the rule that chose the lure, and the cadence that chose the moment. Answered from what was recorded at planning time, not recomputed. Use it for 'why did we phish Anna last Tuesday'.
• pause_programme (write, owner or admin only): Stop the continuous simulation programme and drop everything it had queued. Nothing further will be sent until an owner or admin restarts it in Fallax. Use this when somebody wants simulations to stop: an incident, an outage, a sensitive week. Restarting cannot be done from here.
• exclude_person (write, person-level access required, owner or admin only): Stop the continuous programme from ever simulating against one person, and drop anything already queued for them. Use it for someone on leave, mid-onboarding, or who must not be tested. Putting somebody back into the programme has to be done in Fallax.

Reading the numbers

Click rate and credential-submit rate should fall over time, and report rate should rise. Rates are percentages of messages delivered, not of people in the directory. A campaign belongs to a period by its launch date, so one campaign is never split across two periods.

---

Canonical HTML: https://fallax.io/docs/mcp Site index for agents: https://fallax.io/llms.txt