Email Header Analyzer

Security REST API MCP

Return a structured analysis of raw email headers: sender, recipient, subject, date, message id, the Received hop chain with per-hop delays, SPF/DKIM/DMARC results, every public IP seen, and suspicious-routing flags.

This page documents the MCP tool findutils:email_header_analyzer. See the REST reference →

Use in the browser View as Markdown

Call it over MCP

Tool name findutils:email_header_analyzer · no API keys · 120 requests/min per IP

Claude Code

claude mcp add findutils --transport http https://mcp.findutils.com/

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "findutils": {
      "url": "https://mcp.findutils.com/"
    }
  }
}

Raw JSON-RPC (any MCP client) — verified example

curl -X POST https://mcp.findutils.com/ \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "email_header_analyzer",
      "arguments": {
        "headers": "Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"
      }
    }
  }'

Input schema

Argument	Type	Required	Description
headers	string	yes	The raw email headers (the "Show original" / "View source" block), including every Received: line.

Example arguments (verified)

{
  "headers": "Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: [email protected]\nTo: [email protected]\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <[email protected]>"
}

Also a REST endpoint

The same tool answers plain HTTP at POST /api/tools/email-header-analyzer/execute — no key, 60 requests/min.

Open the REST reference for Email Header Analyzer →

More Security tools

Base32 Encode

Encode UTF-8 text to RFC 4648 base32 (uppercase, "=" padding).

Data Sanitizer

Sanitize untrusted text and return the cleaned output, a list of changes made, and a risk level.

Dnpm Configurator

Returns the five files of a hardened Docker-based npm wrapper (the ./dnpm bash script, .dnpm/Dockerfile, docker-compose.node.yml, .dnpm/secc

Hash Comparison Tool

Hash text with SHA-1, SHA-256, SHA-384, or SHA-512 and compare the hex digest with an expected hash.

Jwt Decode

Decode a JWT header + payload.

Jwt Generator

Generate a signed JWT (HS256, HS384, or HS512 via HMAC) and return the token plus the decoded header and payload.

Jwt Security Validator

Decode a JWT and return a list of security checks (algorithm strength, expiration, not-before, issued-at, issuer, audience, subject, signatu

Password Breach Checker

Return whether a password appears in known data breaches and how many times, using the Have I Been Pwned k-anonymity range API.