# Psychevus Email Security Muse connector

From musedirectory.ai, the independent directory of Meta Muse connectors. Not affiliated with Meta.

## Psychevus Email Security

Check whether an email or a supplier's bank-detail change is genuine before you trust it or pay.

- Record: https://musedirectory.ai/connector/psychevus-email-security
- Category: Finance & Bills
- Developer: Psychevus (https://psychevus.com/tools)
- Muse status: Extra setup. Not in Muse's Connectors list yet. Muse can still use it: its page gives you a request to paste into Muse.
- Health: Working, 153ms, checked 2026-11-11T13:56:13Z
- Endpoint: https://psychevus.com/api/mcp
- Auth: No account needed; Pricing: unknown
- Screening: Screened, no issues found (2026-11-11T13:56:13Z)
- Source: Found in the official MCP Registry (com.psychevus/email-security) https://registry.modelcontextprotocol.io/v0/servers?search=com.psychevus%2Femail-security

Reads public DNS and domain registration records to check SPF, DKIM and DMARC setup, find lookalike domains, and analyse raw email headers or signatures. Muse can explain why a message was flagged as spam or fraud, and weigh a supplier's bank-detail change request before you pay it.

Example request: "A supplier emailed me new bank details, can you check whether the request is really from them?"

How to connect: Not in Muse's Connectors list yet, but Muse can still use it. Paste this into Muse: "Use Psychevus Email Security to help me. It is a free service with an MCP server at https://psychevus.com/api/mcp. It does not need an API key. Ask me before you share anything with it." Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.

Tools:
- check_email_domain: Assess, from public DNS, whether a domain's email is set up to be trusted by inboxes and to resist impersonation. It can't see a provider's spam filtering or the domain's sending reputation. Reads the domain's public SPF, DKIM and DMARC records and returns plain-language answers 
- find_lookalike_domains: Look for registered lookalikes of a domain that could be used to impersonate it (other endings, look-alike characters like rn for m, an added word such as -billing, typos). Generates about 70 candidates, reads public DNS and registry (RDAP) data for them, and reports which exist,
- analyze_email_headers: Read what the mail servers recorded about one received email, to help explain why it was trusted, filed as spam or looks fraudulent: SPF, DKIM and DMARC results with alignment, Microsoft SCL and SpamAssassin verdicts, a Reply-To pointing at another domain, each delivery hop with 
- verify_email_signature: Verify the DKIM signatures of one raw email (headers and body, as copied from Gmail's Show original or a .eml file): recomputes the body hash, canonicalises the signed headers and checks each signature against the key the signing domain publishes in DNS (RFC 6376, 8301, 8463). Re
- count_spf_lookups: Count the DNS lookups an SPF record would cost with the given include hostnames, nested includes resolved live, against the RFC 7208 limit of 10. Use it before proposing a merged SPF record.
- check_payment_change_request: Weigh an email asking to change a supplier's (vendor's) bank details, one of the costliest forms of business email compromise. Compares the sender (and Reply-To) with the supplier's real domain for lookalike tricks (other endings, look-alike or other-alphabet characters, typos, a
- check_payment_policy: Read a business's payment-policy.txt (https://<domain>/.well-known/payment-policy.txt): how it changes bank details (for example never by email), which domains its invoices come from, and fingerprints of the accounts it is paid into. Pass an account to check whether it is on the 
- assess_callback_record: Check the facts of a callback that verified a supplier's bank-detail change against the rules auditors and social-engineering insurance usually require: the number called came from a source that predates the request, never from the request itself (pass requestText and every phone
- verify_callback_record: Verify a callback record file saved by https://psychevus.com/tools/payment-check/callback-record. It answers three questions separately (layers): integrity (both digests, the sealed verdict, the approval refers to this exact record), history (both timestamps against this site's p
- timestamp_digest: Get a signed timestamp (compact JWS, EdDSA, verifiable with https://psychevus.com/.well-known/psychevus-proof-keys.json) stating that psychevus.com saw this SHA-256 digest at this second. Use it to make an audit record (a callback record, an approval) tamper-evident: hash the can
- check_dns_propagation: After a DNS change, check whether four public resolvers (Cloudflare, Google, NextDNS, AdGuard) already return the new SPF, DMARC, DKIM, MTA-STS, TLS-RPT or BIMI record, and how long caches may keep the old one. Pass the value just published as expect to compare.

Screening checks:
- MCP handshake: pass (Answered in 153ms)
- Domain against threat feeds (Cloudflare security DNS): pass (psychevus.com not flagged)
- Published packages against the OSV malicious-package database: n/a (No npm or PyPI package published)
- Hidden instructions or invisible characters in tool text: pass (11 tools read, nothing found)
- Inputs asking for passwords, card numbers or seed phrases: pass (None found)
- Domain and redirects: pass (Domain registered 11 days ago)
- AI review of purpose and tool behavior: pass (No concerns)