MCP server for Rubiscout — AI-powered email header analysis for phishing, spoofing, and BEC detection. Exposes Rubiscout's forensic analysis as tools for Claude Code, Claude Desktop, Cursor, and any other MCP-compatible agent.
npx rubiscout-mcpOr install globally:
npm install -g rubiscout-mcpRelated MCP server: mailX tools
Get a free API key at rubiscout.com/dashboard, then add to your MCP client config (e.g. ~/.claude/settings.json or Claude Desktop config):
{
"mcpServers": {
"rubiscout": {
"command": "npx",
"args": ["-y", "rubiscout-mcp"],
"env": {
"RUBISCOUT_API_KEY": "rbs_live_..."
}
}
}
}Alternatively, set RUBISCOUT_API_KEY as a system environment variable and omit the env block.
Tool | Description |
| Submit a raw email string for full forensic analysis. Returns verdict, risk score, authentication results (SPF/DKIM/DMARC/ARC), IP reputation, routing trace, and recommendations. |
| Retrieve a previously stored analysis by UUID. |
| List recent analyses, optionally filtered by risk score. |
Once configured, ask your agent directly:
"Analyze this email for me and tell me if it's a phishing attempt" [paste email]
"Get my last 5 analyses and summarize the threat patterns"
"Analyze all .eml files in this directory and flag any Critical or High risk ones"
npm install
npm run build
npm startdocker build -t rubiscout-mcp .
docker run -i -e RUBISCOUT_API_KEY=rbs_live_... rubiscout-mcpMIT
Analyze an email for phishing, spoofing, and authentication failures. Accepts raw email headers or a full RFC 2822 email (headers + body). Returns a full forensic verdict with SPF/DKIM/DMARC results, IP reputation, routing path, risk score, and recommendations.
Inputs: email (required).
Retrieve a previously stored Rubiscout analysis by its UUID. Returns the full analysis result including verdict, risk score, authentication results, IP reputation, and recommendations.
Inputs: id (required).
List recent Rubiscout analyses, ordered by most recent first. Optionally filter by risk score.
Inputs: page, per_page, risk_score.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 3 tools
Each tool targets a distinct operation: analyzing a new email, retrieving a specific analysis by UUID, and listing recent analyses. There is no functional overlap.
All tool names follow a consistent verb_noun pattern with lowercase and underscores (analyze_email, get_analysis, list_analyses), making them predictable.
With 3 tools, the server is scoped tightly to email analysis. While minimal, it covers the primary use cases without unnecessary bloat.
The server provides core CRUD-like operations (create, read, list) for email analyses. Missing update and delete are minor gaps, but the essential workflow for analysis is complete.
Email safety MCP server. Detects phishing, prompt injection, CEO fraud for AI agents.
Email intelligence MCP: MX/SPF/DKIM/DMARC, score, enrichment. x402 on emailiq.dev/mcp.
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Email posture for any domain: can it receive mail, can it be spoofed? MX, SPF and DMARC.
