# rubiscout-mcp

MCP server for [Rubiscout](https://rubiscout.com) — AI-powered email header analysis for phishing, spoofing, and BEC detection. Exposes Rubiscout's forensic analysis as tools for Claude Code, Claude Desktop, Cursor, and any other MCP-compatible agent.

## Install

```bash
npx rubiscout-mcp
```

Or install globally:

```bash
npm install -g rubiscout-mcp
```

## Configuration

Get a free API key at [rubiscout.com/dashboard](https://rubiscout.com/dashboard), then add to your MCP client config (e.g. `~/.claude/settings.json` or Claude Desktop config):

```json
{
  "mcpServers": {
    "rubiscout": {
      "command": "npx",
      "args": ["-y", "rubiscout-mcp"],
      "env": {
        "RUBISCOUT_API_KEY": "rbs_live_..."
      }
    }
  }
}
```

Alternatively, set `RUBISCOUT_API_KEY` as a system environment variable and omit the `env` block.

## Tools

| Tool | Description |
|---|---|
| `analyze_email` | Submit a raw email string for full forensic analysis. Returns verdict, risk score, authentication results (SPF/DKIM/DMARC/ARC), IP reputation, routing trace, and recommendations. |
| `get_analysis` | Retrieve a previously stored analysis by UUID. |
| `list_analyses` | List recent analyses, optionally filtered by risk score. |

## Example usage

Once configured, ask your agent directly:

> "Analyze this email for me and tell me if it's a phishing attempt" [paste email]

> "Get my last 5 analyses and summarize the threat patterns"

> "Analyze all .eml files in this directory and flag any Critical or High risk ones"

## Development

```bash
npm install
npm run build
npm start
```

## Docker

```bash
docker build -t rubiscout-mcp .
docker run -i -e RUBISCOUT_API_KEY=rbs_live_... rubiscout-mcp
```

## Links

- [Full documentation](https://rubiscout.com/docs#mcp)
- [REST API reference](https://rubiscout.com/api-reference)
- [Get an API key](https://rubiscout.com/dashboard)

## License

MIT