check_email
Read-onlyIdempotent
Analyze emails for phishing threats by checking sender domains, email headers (SPF/DKIM/DMARC), brand impersonation, embedded URLs, and phone numbers to identify potential scams.
Instructions
Analyze an email for phishing indicators. Checks sender domain, email headers (SPF/DKIM/DMARC), brand impersonation, embedded URLs and phone numbers. Returns unified risk score with detailed header and sender analysis.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| email_body | Yes | Email body content to analyze (max 20000 characters) | |
| sender_email | No | Sender email address | |
| subject | No | Email subject line | |
| raw_headers | No | Raw email headers for SPF/DKIM/DMARC analysis |
Implementation Reference
- src/index.ts:224-252 (handler)The `check_email` tool registration and handler implementation. It analyzes email content, sender, subject, and headers using the `/api/v1/email/analyze` endpoint.
server.tool( 'check_email', 'Analyze an email for phishing indicators. Checks sender domain, email headers (SPF/DKIM/DMARC), brand impersonation, embedded URLs and phone numbers. Returns unified risk score with detailed header and sender analysis.', { email_body: z.string().describe('Email body content to analyze (max 20000 characters)'), sender_email: z.string().optional().describe('Sender email address'), subject: z.string().optional().describe('Email subject line'), raw_headers: z.string().optional().describe('Raw email headers for SPF/DKIM/DMARC analysis'), }, { title: 'Analyze Email', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, }, async ({ email_body, sender_email, subject, raw_headers }) => { try { const body: Record<string, unknown> = { email_body }; if (sender_email) body.sender_email = sender_email; if (subject) body.subject = subject; if (raw_headers) body.raw_headers = raw_headers; const data = await apiPost('/api/v1/email/analyze', body); return jsonResult(data); } catch (err) { return errorResult(err instanceof Error ? err.message : 'Email analysis failed'); } }, );