Autonomous Phishing Triage Platform (MCP-Powered)

An enterprise-grade, autonomous security platform designed to automate Tier 1–3 SOC phishing triage, investigation, and reporting. Powered by Large Language Models (LLMs) orchestrated via the Model Context Protocol (MCP), the platform ingests suspicious emails, hunts for zero-day threats using heuristic reasoning, correlates alerts across SIEM/EDR telemetry, and produces actionable incident reports without manual overhead.

---

🎯 Key Highlights

• Automated SOC Triage: Acts as an autonomous analyst daemon polling inbound mail, extracting artifacts (headers, URLs, attachments), and prioritizing incidents.
• Model Context Protocol (MCP) Sandboxing: Strict security boundary separating AI reasoning from sensitive APIs. The LLM orchestrator never accesses raw credentials or direct databases; it requests discrete tools from an isolated MCP gateway server.
• Heuristic Zero-Day Detection: Goes beyond static threat intelligence feeds by using LLM heuristics (typosquatting, urgency framing, sender-domain divergence) to catch freshly staged infrastructure.
• Cross-Telemetry Correlation: Automatically maps email recipients to endpoint assets and queries mock SIEM/EDR logs to calculate blast radius and determine if URLs were clicked or payloads executed.
• Interactive Analyst Dashboard: Clean Flask web interface visualizing active cases, severity scoring, artifact traces, and historical trends.

---

🏗️ System Architecture

flowchart TD
    A["Inbound Mail Source / Mailpit"] -->|REST API Poll| B["Autonomous Orchestrator Daemon"]
    
    subgraph Intelligence ["🧠 Intelligence Layer"]
        B <-->|Reasoning & Planning| C["LLM (Gemini / Llama 3)"]
    end
    
    subgraph Gateway ["🛡️ Security Gateway Layer"]
        B <-->|SSE + Bearer Auth| D["MCP Security Gateway"]
    end
    
    subgraph Execution ["⚙️ Execution & Tooling Layer"]
        D <-->|Local Tool Calls| E["Phishing MCP Tool Server"]
        E --> F["VirusTotal API (Reputation)"]
        E --> G["SIEM / EDR Telemetry (Blast Radius)"]
    end
    
    subgraph Storage ["💾 Data Layer"]
        B --> H[("Normalized SOC SQLite DB")]
        E -->|Case Reports| H
        H --> I["Analyst Web Dashboard (Flask)"]
    end

Loading

---

🔒 Why the Model Context Protocol (MCP)?

In traditional LLM integrations, models are given direct database connections or broad API tokens, exposing environments to prompt injections or hallucinated destructive queries.

This platform implements a strict Client-Server MCP Architecture:

1. The Brain (Orchestrator Client): Directs the investigation strategy based on threat observations.
2. The Hands (MCP Server): Holds the actual API keys for SIEM, EDR, and threat intelligence. It strictly validates tool parameters before execution.
3. Least Privilege: The LLM cannot execute raw arbitrary SQL or shell commands; it can only request scoped actions (e.g., query_proxy_logs(user, domain)).

---

📁 Repository Structure

├── app.py                         # Flask analyst web dashboard
├── config.py                      # System configuration & environment variables
├── custom_mcp_client.py           # MCP Client adapter for orchestrator
├── db_init.py                     # Database schema setup & seed data
├── gateway_config.json            # Gateway routing rules & rate limits
├── mcp_gateway.py                 # MCP Security Gateway daemon
├── phishing_mcp.py                # MCP Tool server (VT, SIEM/EDR lookups)
├── requirements.txt               # Project dependencies
├── send_test_emails.py            # Test email harness for triage validation
├── Others/
│   ├── Ground Truth.txt           # Evaluation ground truth cases
│   └── generate_sample_data.py    # Log & telemetry generator
└── sample logs/                   # Mock EDR, Proxy, and Endpoint telemetry

---

🚀 Quick Start

1. Prerequisites

• Python 3.10+
• Virtual environment (venv or conda)

2. Installation

# Clone the repository
git clone https://github.com/souradeepdutta/MCP-Project.git
cd MCP-Project

# Create and activate virtual environment
python3 -m venv .venv
source .venv/bin/activate

# Install dependencies
pip install -r requirements.txt

3. Initialize Database & Mock Telemetry

python db_init.py

4. Start the MCP Services & Dashboard

# Terminal 1: Launch MCP Security Gateway
python mcp_gateway.py

# Terminal 2: Launch Analyst Dashboard
python app.py

Access the analyst web interface at http://localhost:5000.

---

📊 Sample Investigation Flow

1. Email Ingestion: A suspicious email regarding an "Urgent IT Password Expiration" arrives.
2. Artifact Extraction: Sender [email protected] and embedded link http://paypa1-update.com/login are parsed.
3. Threat Intel: MCP queries VirusTotal; domain is freshly registered (no hits yet).
4. Heuristic Trigger: LLM identifies typosquatting and urgency indicators.
5. SIEM Correlation: MCP queries proxy logs for user workstation WKSTN-412. Identifies that the employee clicked the link at 14:22 UTC.
6. Report Generation: Automatically tags severity as HIGH / ZERO-DAY, generates containment recommendations, and presents case details on the dashboard.

---

📜 License

This project is licensed under the MIT License.