# Phishnoo Sandbox

Phishnoo is a security awareness and phishing simulation platform. This separate integration sandbox shows aggregate scores, campaign results, training progress, and threat reporting using synthetic data. [Phishnoo homepage](https://phishnoo.com).

## Connect

Base: https://api.phishnoo.nl. Send the operator-issued sandbox key as `Authorization: Bearer <key>`. Reviewers should receive it privately through the platform's test-credential field. A key identifies a single shared demo company; use synthetic data only.

| Route | What it does |
| --- | --- |
| GET /health | Public liveness |
| GET /v1/me | Confirm demo company and sandbox status |
| GET /v1/scores | Human Shield and P-Shield scores out of 100 |
| GET /v1/campaigns | Aggregate campaign results |
| GET /v1/progress | Aggregate training assignment and completion |
| GET /v1/threats | Latest 50 reports |
| POST /v1/threats | Save a report and return its ID with HTTP 201 |

POST JSON: `{"title":"Example account notice","url":"https://example.invalid/notice"}`. The title is required. An optional URL must use a reserved example host and omit credentials, query, and fragment. The service never visits reported URLs. Missing or invalid keys return 401. The sandbox key allows 120 requests per minute.

OpenAPI: https://api.phishnoo.nl/openapi.json

## MCP

Configure Streamable HTTP at https://api.phishnoo.nl/mcp and set the same Authorization header via the client's secret settings. Available tools: `get_me`, `get_scores`, `get_campaigns`, `get_progress`, `get_threats`, `report_threat`. OAuth discovery is unavailable.

## Privacy and retention

The extension stores the key locally until you select **Forget key**. It sends the key and explicitly submitted example fields only to the sandbox service. It does not read tabs, emails, or browsing history. The service stores the latest 250 submitted reports plus a seed example in SQLite. Holders of the shared sandbox key can read recent submissions. No customer systems, analytics, or simulation-sending capability are connected. The operator can clear submitted reports by stopping the service and removing the sandbox database before restarting.