emailsecops
Menu
MCP server · Claude · ChatGPT · Cursor · VS Code

Delegate your email security ops to an AI agent.

Connect your assistant to EmailSecOps. It checks SPF, DKIM and DMARC on any domain, audits the DKIM keys of everything you monitor, explains DMARC failures from your reports, tells you what drifted and hands you the exact DNS records to fix it.

Connect your agent Try it with no account

Read-only by default. It can never change your DNS.

Claude · EmailSecOps connected

10 tools
Audit DKIM across all our client domains. Anything I should rotate this month?
→ list_domains · list_dkim_selectors ×6

Three keys need attention:

  • harbor-dental.example · selector1 is RSA 1024, Microsoft 365 hosted: rotate it in Defender.
  • summit-realty.example · google key first seen 214 days ago.
  • pinecrest-law.example · SES signs with d=amazonses.com, so DKIM doesn't align. Want the CNAMEs?

Hand off the jobs nobody has time for

Ask in plain language. The agent picks the tools, reads live DNS and your monitoring data, and answers with records you can paste.

Morning triage

“What changed on our domains overnight, and does any of it need action today?”

list_domain_changes · list_alerts

DKIM key audit

“Which of our DKIM keys are older than six months or under 2048 bits? Give me a rotation order.”

list_dkim_selectors

Enforcement call

“Is pinecrest-law.example ready for p=reject? If not, which senders are holding it back?”

dmarc_advice

New client intake

“Check harbor-dental.example and write the DNS changes their IT person needs, record by record.”

check_domain

Spam-folder mystery

“This message landed in spam. Here is the raw source: did DKIM verify, and if not, why?”

verify_dkim_signature

Vendor onboarding

“We just added Amazon SES. Add its DKIM selectors to monitoring and tell me when they resolve.”

add_dkim_selector · check_dkim

Try it now, no account

The public server runs the same DNS checks as the free tools, rate-limited per IP. Add it to your assistant and ask it to check any domain.

  • check_domain
  • check_dkim
  • verify_dkim_signature
  • check_email

Try: “Check example.com's email security and tell me the first three things to fix.”

Server URL
https://emailsecops.com/mcp/public
Claude claude.ai and the Claude desktop app
  1. Open Settings → Connectors and choose Add custom connector.
  2. Name it EmailSecOps and paste the URL above.
  3. Click Connect; there is nothing to sign in to. Then turn it on in a chat from the tools menu.
ChatGPT chatgpt.com with developer mode
  1. Open Settings → Apps & Connectors → Advanced and turn on Developer mode.
  2. Create a connector named EmailSecOps with the URL above and authentication None.
  3. Add it to a chat from the tools menu.
Claude Code the terminal
  1. Add the server:
    claude mcp add --transport http emailsecops-public https://emailsecops.com/mcp/public
  2. Start Claude Code and ask it to check a domain.
Cursor ~/.cursor/mcp.json
  1. Add the server to the file:
    {"mcpServers":{"emailsecops-public":{"url":"https://emailsecops.com/mcp/public"}}}
  2. Enable it under Settings → MCP.
VS Code .vscode/mcp.json
  1. Add the server to the file:
    {"servers":{"emailsecops-public":{"type":"http","url":"https://emailsecops.com/mcp/public"}}}
  2. Start it from the file.

Connect your team's server

Sign in once with OAuth and the agent works on your monitored domains: drift, alerts, DKIM key inventory and history, DMARC report evidence and enforcement advice.

  • Acts for your team. The connection uses the team selected in your dashboard and counts against its plan quota.
  • Read-only for members. Only owners and admins (or tokens with write access) can let it add selectors to monitoring.
  • Never touches DNS. Fixes come back as records for a person to publish.
  • Logged and revocable. Every call is metered; remove the connector or the token to cut it off.

Included in Starter, Pro and Enterprise. See plans · Scripts and CI can use a team token instead (docs).

Server URL
https://emailsecops.com/mcp
Claude claude.ai and the Claude desktop app
  1. Open Settings → Connectors and choose Add custom connector.
  2. Name it EmailSecOps and paste the URL above; leave the OAuth fields empty.
  3. Click Connect, sign in to EmailSecOps and choose Allow. Then turn it on in a chat from the tools menu.
ChatGPT chatgpt.com with developer mode
  1. Open Settings → Apps & Connectors → Advanced and turn on Developer mode.
  2. Create a connector named EmailSecOps with the URL above and authentication OAuth.
  3. Sign in to EmailSecOps when asked and choose Allow.
Claude Code the terminal
  1. Add the server:
    claude mcp add --transport http emailsecops https://emailsecops.com/mcp
  2. Run /mcp, pick emailsecops and choose Authenticate. Or skip the browser and add --header "Authorization: Bearer eso_live_…" with a team token.
Cursor ~/.cursor/mcp.json
  1. Add the server to the file:
    {"mcpServers":{"emailsecops":{"url":"https://emailsecops.com/mcp"}}}
  2. Cursor lists it as Needs login: click it, sign in and choose Allow.
VS Code .vscode/mcp.json
  1. Add the server to the file:
    {"servers":{"emailsecops":{"type":"http","url":"https://emailsecops.com/mcp"}}}
  2. Start it from the file, sign in and choose Allow.

Every tool your agent gets

Same engine as the dashboard and the API: every check runs live on our resolvers, nothing is guessed.

list_domains
List the team's monitored domains with score, grade, DMARC policy and verification state.
check_domain public
Run a live email sender-policy check (SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, reverse DNS, DNS blacklists) for any domain and return score, grade, records and prioritised recommendations with exact DNS fixes.
check_dkim public
Live DKIM lookup for any domain. With selectors: checks exactly those. Without: scans the default selectors of every major provider. Per selector: key type, bits and SHA-256 fingerprint, CNAME delegation and the owning p...
list_dkim_selectors
For a domain the team monitors: every DKIM selector we know (discovered, added, or seen signing in DMARC reports) with status, health, provider, key type/bits/fingerprint, key age and age bucket, rotation count and key h...
verify_dkim_signature public
Cryptographically re-verify every DKIM-Signature in a raw RFC 5322 message (all headers, a blank line, then the body exactly as received): canonicalization, body hash (bh=), RSA or Ed25519 signature (b=) against the key...
add_dkim_selector write
Add a DKIM selector to a monitored domain so every check watches it (needed for selectors that cannot be discovered, e.g. Amazon SES tokens or dated Postmark keys). Looks it up immediately and returns its status. Require...
list_domain_changes
What changed between consecutive checks of a monitored domain, newest first: records added/removed/changed (SPF, DMARC, BIMI, MTA-STS, TLS-RPT, MX), DMARC policy changes, DKIM selectors added/removed, DKIM key rotations...
list_alerts
The team's alerts, newest first: DNS drift (SPF/DKIM/DMARC/MX changes), score drops, blacklist listings, DMARC failure spikes, expiring registrations or certificates, and DKIM findings (keys due for rotation, failing or...
dmarc_advice
For a monitored domain, summarise DMARC aggregate-report data (alignment rate, top sources, failing known senders) and say whether it is safe to move to p=quarantine / p=reject, with the exact record to publish.
check_email public
Introduction/KYC-style check of a single email address: syntax, MX, provider, free/disposable/role flags, the domain's SPF/DKIM/DMARC strength, and a risk score with reasons.

Questions about agents

Which AI assistants work?+
Any MCP client: Claude (claude.ai, desktop and Claude Code), ChatGPT with developer mode, Cursor, VS Code, Windsurf and your own agents. Clients that support sign-in use OAuth; others send a team token.
Can the agent change my DNS or my settings?+
It cannot touch DNS at all. The only write tool adds a DKIM selector to monitoring, and only for team owners and admins or tokens with write access.
What does it cost?+
The public server is free with no account, limited per IP. The team server is part of the Starter, Pro and Enterprise plans and shares the plan's monthly API quota.
Where does my data go?+
Tool results go to the AI provider you connected, under that provider's terms. EmailSecOps only answers the tools your agent calls and logs each call for your team.
Do I need the API too?+
No. The MCP server and the REST API run the same checks; use the API from code and MCP from an assistant.

Give your agent the email security beat.

Start free with DNS checks for one domain; connect your agent on any paid plan.

Start monitoring →

No card for the free plan · Billing by Stripe · We never send mail on your behalf · Privacy