Check whether an email or a supplier's bank-detail change is genuine before you trust it or pay.
Reads public DNS and domain registration records to check SPF, DKIM and DMARC setup, find lookalike domains, and analyse raw email headers or signatures. Muse can explain why a message was flagged as spam or fraud, and weigh a supplier's bank-detail change request before you pay it.
Try asking Muse: "A supplier emailed me new bank details, can you check whether the request is really from them?"
Source: Found in the official MCP Registry (com.psychevus/email-security) · First listed November 11, 2026
Each bar is one check, every 15 minutes. Green means it answered. Last checked 54 min ago.
What Muse can see: It does not ask you to sign in, so it cannot see your accounts. It only sees what Muse sends it from your request.
Before it acts: Read what Muse plans to do before you approve it, and remove the app from Muse when you stop using it.
musedirectory.ai is not part of Meta. More about how Muse handles your information
Not in Muse's Connectors list yet, but Muse can still use it. Copy the request below and paste it into Muse. Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.
https://psychevus.com/api/mcpNot in Muse's Connectors list yet. Muse can still use it: its page gives you a request to paste into Muse.
Psychevus Email Security is a remote MCP server, so any assistant that can add a custom connector by link can use it. Same link, same tools.
In ChatGPT, open Settings, then Connectors (called Apps & Connectors on some accounts).
Under Advanced settings, switch on Developer mode. That is what lets you add a connector by link.
Choose Create, give it a name, paste the link as the MCP server URL, and save. If it needs a sign-in, ChatGPT asks for it here.
Start a chat, open the tools menu, pick the connector, and ask. ChatGPT asks before it runs a tool the first time.
Custom connectors need a paid ChatGPT plan, and on Team, Enterprise and Edu accounts only an admin can add them. Our "Working" label means the server answered us; it cannot tell whether your plan lets you add it. All connectors that work in ChatGPT
In Claude, open Settings, then Connectors.
Choose Add custom connector, give it a name, and paste the link.
If it needs a sign-in, Claude sends you to it. Then turn the connector on in a chat from the tools menu and ask.
Custom connectors are available on paid Claude plans; on Team and Enterprise accounts an admin may need to add them. Our "Working" label means the server answered us; it cannot tell whether your plan lets you add it. All connectors that work in Claude
https://psychevus.com/api/mcpResponse time at the last check: 153ms. Worked in n/a of checks over 30 days.
Screened, no issues found
Screening looks for known threats and hidden instructions at the time of the check, and runs again weekly and whenever the tool list changes. It cannot see the server's code, so only connect what you need and review what Muse asks to do. How screening works.
check_email_domainAssess, from public DNS, whether a domain's email is set up to be trusted by inboxes and to resist impersonation. It can't see a provider's spam filtering or the domain's sending reputation. Reads the domain's public SPF, DKIM and DMARC records and returns plain-language answers find_lookalike_domainsLook for registered lookalikes of a domain that could be used to impersonate it (other endings, look-alike characters like rn for m, an added word such as -billing, typos). Generates about 70 candidates, reads public DNS and registry (RDAP) data for them, and reports which exist,analyze_email_headersRead what the mail servers recorded about one received email, to help explain why it was trusted, filed as spam or looks fraudulent: SPF, DKIM and DMARC results with alignment, Microsoft SCL and SpamAssassin verdicts, a Reply-To pointing at another domain, each delivery hop with verify_email_signatureVerify the DKIM signatures of one raw email (headers and body, as copied from Gmail's Show original or a .eml file): recomputes the body hash, canonicalises the signed headers and checks each signature against the key the signing domain publishes in DNS (RFC 6376, 8301, 8463). Recount_spf_lookupsCount the DNS lookups an SPF record would cost with the given include hostnames, nested includes resolved live, against the RFC 7208 limit of 10. Use it before proposing a merged SPF record.check_payment_change_requestWeigh an email asking to change a supplier's (vendor's) bank details, one of the costliest forms of business email compromise. Compares the sender (and Reply-To) with the supplier's real domain for lookalike tricks (other endings, look-alike or other-alphabet characters, typos, acheck_payment_policyRead a business's payment-policy.txt (https://<domain>/.well-known/payment-policy.txt): how it changes bank details (for example never by email), which domains its invoices come from, and fingerprints of the accounts it is paid into. Pass an account to check whether it is on the assess_callback_recordCheck the facts of a callback that verified a supplier's bank-detail change against the rules auditors and social-engineering insurance usually require: the number called came from a source that predates the request, never from the request itself (pass requestText and every phoneverify_callback_recordVerify a callback record file saved by https://psychevus.com/tools/payment-check/callback-record. It answers three questions separately (layers): integrity (both digests, the sealed verdict, the approval refers to this exact record), history (both timestamps against this site's ptimestamp_digestGet a signed timestamp (compact JWS, EdDSA, verifiable with https://psychevus.com/.well-known/psychevus-proof-keys.json) stating that psychevus.com saw this SHA-256 digest at this second. Use it to make an audit record (a callback record, an approval) tamper-evident: hash the cancheck_dns_propagationAfter a DNS change, check whether four public resolvers (Cloudflare, Google, NextDNS, AdGuard) already return the new SPF, DMARC, DKIM, MTA-STS, TLS-RPT or BIMI record, and how long caches may keep the old one. Pass the value just published as expect to compare.https://psychevus.com/api/mcpNot in Muse's Connectors list yet, but Muse can still use it. Paste this into Muse: "Use Psychevus Email Security to help me. It is a free service with an MCP server at https://psychevus.com/api/mcp. It does not need an API key. Ask me before you share anything with it." Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.
At the last check (November 11, 2026, 13:56 UTC) the endpoint was working, answering in 153ms. It is checked every 15 minutes.
It was screened on November 11, 2026 with the result "screened, no issues found". Screening checks the domain against threat feeds and reads the tools for hidden instructions and requests for passwords or card numbers. It cannot see the server's code, so grant only the access you need.
It exposes 11 tools, including check_email_domain, find_lookalike_domains, analyze_email_headers, verify_email_signature. For example, you could ask Muse: "A supplier emailed me new bank details, can you check whether the request is really from them?"
This listing was added from public sources (Found in the official MCP Registry (com.psychevus/email-security)). If you build Psychevus Email Security, claim it to correct the details and get your badge.
Paste this on your site or README. It always shows the latest check.
<a href="https://musedirectory.ai/connector/psychevus-email-security"><img src="https://musedirectory.ai/badge/psychevus-email-security.svg" alt="Psychevus Email Security on musedirectory.ai" width="236" height="40"></a>