Version 1.54
In version 1.54, we’re delighted to bring you two big and heavily-requested new ways to interact with Material as part of your AI-powered security system:
An MCP server
A limited release of API v1 created from scratch specifically for customer use
We’re also continuing to make it easier to investigate and action issues in the UI. This release adds a consolidated AI investigation card, bulk phishing actions via the all actions (⌘K) menu, and a new feedback option for ambiguous detections, alongside several fixes that sharpen analyst and admin workflows.
🥳 New
MCP server
Material now has an MCP (Model Context Protocol) server! The Material MCP server connects AI clients like Claude Code and Cursor to Material. It lets you query your data in Material, in plain language without leaving your AI workspace.
Use it to investigate threats, pull account and message context, combine Material data with signals from the rest of your stack, and design your own workflows and uses entirely!
API v1 (Limited Release)
Material API v1 is now available in limited release. It gives you programmatic access to Material threat detection and email analysis data, so you can use it outside the product.
This isn't just a new version of our beta API. We rebuilt API v1 from the ground up around common developer workflows.
The first release focuses on Email Threat use cases. We’ll keep expanding the API based on customer needs. If you want early access or have feedback, contact support. Learn more about API v1.
New "Analysis Unclear" feedback option
Feedback on email threat issues and their related messages now includes the option: "The analysis of this message is unclear."
Previously, feedback was limited to false positive or missed detection. This was useful for clear-cut errors, but not in cases where Material's assessment is ambiguous or hard to interpret.
This new option gives you a precise way to flag edge cases, helping Material's detection team identify and tune assessments that need more clarity rather than just a correction. We've recently surfaced a lot of the reasoning for the verdict, so now you have a way to provide feedback on those explanations.
Bulk email threat message actions via all actions menu
Use the All actions menu (⌘K) to take bulk actions on messages directly from an email threat issue, including viewing message details and removing messages from an issue.
When triaging a high-volume email threat campaign, this eliminates the need to click into each message individually.
✨ Enhancements
AI investigation summary consolidated into a single card
Agent investigation results, including decision reasoning, assessment steps, and risk factors, now appear as a single unified card instead of separate cards spread across the view.
The investigation reads as a coherent narrative, making it easier to follow Material's reasoning and understand what evidence contributed to a threat assessment.
"Mark Suspicious" action always visible for selected messages
The Mark Suspicious action (previously labeled "Create new Material issue") is now pinned to the top of message action menus and always visible, regardless of message state.
Trusted Entity settings now document reporter response behavior
We improved Trusted Entity help text to clarify the relationship between issue creation and reporter response automations:
"Set this to 'Don't create phishing issues' if you don't want reporter responses."
Admins now have additional context when configuring Trusted Entities.
Clearer language for email threat remediation settings
Default Account Settings for Email Threat Remediation now use clearer language: Allow Material to remediate replaces Should Material remediate, and the UI notes that these settings apply only when Email Threat Remediation is enabled.
🐛 Fixes
Suspicious messages now explain why no issue was created: When a message is flagged as suspicious but doesn't generate an issue (because the sender is a Trusted Entity, an exemption rule matched, or another configured condition applied) the message detail view now shows the reason directly (e.g., "Trusted Entity", "Exemption Rule: Sender Address"). Investigators no longer have to guess whether a missing issue is a bug or expected behavior.
Resolving issues no longer counts against the issue status update rate limit: Changing an issue's status to Resolved is now excluded from the issue update rate limiter. During large incident cleanups, bulk-resolving issues could previously trigger the rate limit at exactly the wrong moment. Resolved is now always available.
Admin "Mark as Malicious" now respects configured remediation settings: When an admin marks a message as malicious from message search, Material now applies the tenant's configured
IssueTriageremediation settings, including per-entity overrides, instead of a hardcoded default. Previously, admin-initiated cases ignored customer-configured overrides, which could produce unexpected remediation actions for exempt domains or entities.Browser tab titles now show the current page first: Tab titles now follow standard order, with the page name first (for example, "Issue Details | Material Security"). This makes it easier to identify the right tab when running Material alongside other tools.
Simulation breakdown pie charts restored: A regression caused pie charts in the email threat simulation breakdown side panel to stop rendering. They're back.
📚 New and Updated Documentation
New Deployment Guide tutorials
Last updated
Was this helpful?