Rubiscout Email Analysis Server

MCP server for Rubiscout — AI-powered email header analysis for phishing, spoofing, and BEC detection. Exposes Rubiscout's forensic analysis as tools for Claude Code, Claude Desktop, Cursor, and any other MCP-compatible agent.

Install

npx rubiscout-mcp

Or install globally:

npm install -g rubiscout-mcp

Configuration

Get a free API key at rubiscout.com/dashboard, then add to your MCP client config (e.g. ~/.claude/settings.json or Claude Desktop config):

{
  "mcpServers": {
    "rubiscout": {
      "command": "npx",
      "args": ["-y", "rubiscout-mcp"],
      "env": {
        "RUBISCOUT_API_KEY": "rbs_live_..."
      }
    }
  }
}

Alternatively, set RUBISCOUT_API_KEY as a system environment variable and omit the env block.

Tools

Tool	Description
analyze_email	Submit a raw email string for full forensic analysis. Returns verdict, risk score, authentication results (SPF/DKIM/DMARC/ARC), IP reputation, routing trace, and recommendations.
get_analysis	Retrieve a previously stored analysis by UUID.
list_analyses	List recent analyses, optionally filtered by risk score.

Example usage

Once configured, ask your agent directly:

"Analyze this email for me and tell me if it's a phishing attempt" [paste email]

"Get my last 5 analyses and summarize the threat patterns"

"Analyze all .eml files in this directory and flag any Critical or High risk ones"

Development

npm install
npm run build
npm start

Docker

docker build -t rubiscout-mcp .
docker run -i -e RUBISCOUT_API_KEY=rbs_live_... rubiscout-mcp

Links

• Full documentation
• REST API reference
• Get an API key

License

MIT