Rubiscout Docs

Paste — Headers or Full Email

Open any email in your client, find the "Show Original" or "View Source" option, copy everything, and paste it into the input box.

Forward to analyze@rubiscout.com

Forward any suspicious email to analyze@rubiscout.com and receive a complete analysis reply within seconds — verdict, risk score, authentication badges, routing hops, recommendations, and a link to the full interactive report.

Drag & Drop .eml Files

Drag an .eml file from your file manager directly onto the input area. Rubiscout reads the full file and populates the input automatically — supports full MIME emails including attachments.

Browser Bookmarklet

Install the Rubiscout bookmarklet once from the Features page. When you open an email's raw source in your browser, click the bookmarklet — Rubiscout opens in a new tab with the headers pre-filled.

This works on Gmail's "Show original" page, Outlook's message source view, and any page that displays raw email text.

Getting Started

After running an analysis, the bench panel appears on the right side of the results. Four questions tailored to the specific risk signals found are pre-generated — click any to start immediately, or type your own question.

What to Ask

Drafting Security Content

The bench can produce complete, copy-paste-ready documents based on the analysis context:

• — IT security alerts and all-staff warnings
• — HR notices for BEC / CEO fraud attempts
• — Phishing incident reports (internal ticketing)
• — Fraud reports for financial institutions
• — CISO briefings with technical and business impact
• — End-user security awareness training snippets

Bench via API

The bench experience is powered by the POST /api/v1/investigate endpoint. For SOC integration and automation, use the API directly — see the Streaming Investigation Agent section below.

Authentication

Include your API key in the Authorization header.

Authorization: Bearer rbs_live_...

Request

POST https://rubiscout.com/api/v1/analyze
Content-Type: application/json
Authorization: Bearer rbs_live_...

{
  "header": "Delivered-To: ...\nReceived: from ...\n..."
}

The header field accepts the full raw email text including body, or headers only. Max 500 KB.

Response

{
  "id": "a1b2c3d4-...",          // UUID — use with GET /analyses/:id
  "verdict": "High",
  "summary": "This email...",
  "riskScore": "High",
  "riskReasoning": [
    "SPF hard fail — originating IP not authorized",
    "Reply-To domain differs from From domain",
    "DMARC p=none — no enforcement"
  ],
  "fields": {
    "from": "support@paypal.com",
    "returnPath": "bounce@malicious.xyz",
    "replyTo": "collect@attacker.net",
    "messageId": "<abc@malicious.xyz>",
    "subject": "Your account has been suspended"
  },
  "routingPath": ["mail.malicious.xyz", "mx.example.com"],
  "hops": [...],
  "recommendations": [
    "Do not click any links in this email",
    "Report to your IT security team immediately"
  ],
  "spf_result": "fail",
  "dkim_result": "none",
  "dmarc_result": "fail",
  "dnsCheck": { "spf": true, "dmarc": true, "mtaSts": false, ... },
  "ipBlacklist": { "listed": true, "lists": ["Spamhaus ZEN"] },
  "ipCountry": { "code": "RU", "name": "Russia" },
  "bodyAnalysis": {             // null if no body submitted
    "hasBody": true,
    "spamScore": { "total": 6.8, "level": "High", "rules": [...] },
    "mimeStructure": { ... },
    "compliance": [...],
    "preview": { "text": "...", "html": "..." }
  }
}

curl Example

curl -X POST https://rubiscout.com/api/v1/analyze \
  -H "Authorization: Bearer rbs_live_..." \
  -H "Content-Type: application/json" \
  -d '{"header": "'"$(cat suspicious.eml)"'"}'

What the Agent Does

The agent has access to five live tools it calls autonomously:

Request

POST https://rubiscout.com/api/v1/investigate
Content-Type: application/json
Authorization: Bearer rbs_live_...
Accept: text/event-stream

{
  "email": "From: support@paypal.com\r\nReceived: from...\r\n\r\nDear customer..."
}

The email field must be the full RFC 2822 email string. Both \\r\\n and \\n line endings are accepted. Max 2 MB.

SSE Stream Format

The response is a stream of text/event-stream events. Each event has a type field in the JSON data.

event: tool_call
data: {"type":"tool_call","tool":"dns_lookup","input":{"domain":"paypal.com","record_type":"TXT"}}

event: tool_result
data: {"type":"tool_result","tool":"dns_lookup","result":{"records":["v=spf1 ip4:..."],"error":null}}

event: tool_call
data: {"type":"tool_call","tool":"ip_intel","input":{"ip":"185.234.219.47"}}

event: tool_result
data: {"type":"tool_result","tool":"ip_intel","result":{"listed":true,"lists":["Spamhaus ZEN"],"country":"RU","asn":"AS12345 MALICIOUS-HOSTING"}}

event: reasoning
data: {"type":"reasoning","text":"The originating IP 185.234.219.47 is listed on Spamhaus ZEN and geolocates to Russia. The From domain paypal.com has a valid SPF record, but the sending IP fails SPF — meaning this server is not authorized to send on behalf of paypal.com. Combined with the Reply-To pointing to a .xyz domain registered 3 days ago..."}

event: complete
data: {"type":"complete","report":{...}}

Event Types

Complete Report Structure

The complete event payload contains:

{
  "type": "complete",
  "report": {
    "id": "a1b2c3d4-...",           // Stored analysis UUID
    "verdict": "Critical",
    "risk_score": 9,                 // 0–10
    "risk_reasoning": "...",         // Paragraph summary of key signals
    "summary": "...",                // Plain-English one-sentence summary

    "email": {
      "from": "support@paypal.com",
      "subject": "Your account has been suspended",
      "originating_ip": "185.234.219.47",
      "spf": "fail",
      "dkim": "none",
      "dmarc": "fail"
    },

    "iocs": {
      "ips":     ["185.234.219.47"],
      "domains": ["malicious-collect.xyz", "paypa1.com"],
      "urls":    ["https://malicious-collect.xyz/verify"],
      "emails":  ["collect@malicious-collect.xyz"]
    },

    "ttps": [
      {
        "id": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access"
      },
      {
        "id": "T1598.003",
        "name": "Phishing for Information: Spearphishing Link",
        "tactic": "Reconnaissance"
      }
    ],

    "recommendations": [
      "Block sending IP 185.234.219.47 at your email gateway",
      "Add malicious-collect.xyz to DNS blocklist",
      "Submit to APWG eCrime exchange: https://apwg.org/ecx/"
    ],

    "investigated_at": "2026-07-02T10:23:44.000Z"
  }
}

MITRE ATT&CK TTP Mapping

The agent maps observed behaviors to MITRE ATT&CK for Enterprise technique IDs. Tactics covered include Initial Access (T1566.x), Reconnaissance (T1598.x), Collection (T1114.x), and Command & Control (T1071.x). Each TTP includes the technique ID, full name, and parent tactic.

curl Example

# Stream the investigation to stdout
curl -N -X POST https://rubiscout.com/api/v1/investigate \
  -H "Authorization: Bearer rbs_live_..." \
  -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" \
  -d '{"email": "'"$(cat suspicious.eml)"'"}'

Python Example (streaming)

import httpx, json

with httpx.stream(
    "POST", "https://rubiscout.com/api/v1/investigate",
    headers={
        "Authorization": "Bearer rbs_live_...",
        "Content-Type": "application/json",
    },
    json={"email": open("suspicious.eml").read()},
    timeout=120,
) as r:
    for line in r.iter_lines():
        if line.startswith("data: "):
            event = json.loads(line[6:])
            if event["type"] == "reasoning":
                print(event["text"], end="", flush=True)
            elif event["type"] == "tool_call":
                print(f"\n[tool] {event['tool']}({event['input']})")
            elif event["type"] == "complete":
                report = event["report"]
                print(f"\n\nVerdict: {report['verdict']}")
                print(f"IOCs: {report['iocs']}")
                print(f"TTPs: {[t['id'] for t in report['ttps']]}")

SOAR / Webhook Integration

For SOAR pipelines, listen for the complete event only — discard the intermediate events or log them separately. The report's iocs object maps directly to STIX indicator objects. The ttps array maps to STIX attack-pattern objects with ATT&CK IDs.

Installation

npm install -g rubiscout

Configuration

rubiscout config set-key rbs_live_...

Stores your API key at ~/.config/rubiscout/config.json. Can also be set via the RUBISCOUT_API_KEY environment variable.

Commands

# Analyze from a file
rubiscout analyze suspicious.eml

# Analyze from stdin
cat suspicious.eml | rubiscout analyze -

# JSON output (for piping)
rubiscout analyze suspicious.eml --json

# List recent analyses
rubiscout list

# Get a specific analysis
rubiscout get a1b2c3d4-...

Installation

No clone or build step required — npx fetches and runs it on demand:

npx rubiscout-mcp

Or install it globally:

npm install -g rubiscout-mcp

Configuration — Claude Desktop / Claude Code

// ~/.claude/settings.json or Claude Desktop config
{
  "mcpServers": {
    "rubiscout": {
      "command": "npx",
      "args": ["-y", "rubiscout-mcp"],
      "env": {
        "RUBISCOUT_API_KEY": "rbs_live_..."
      }
    }
  }
}

Get your key from /dashboard first. Alternatively, set RUBISCOUT_API_KEY as a system environment variable and omit the env block.

Available Tools

Example Usage in Claude

Once configured, you can ask Claude Code or Claude Desktop directly: