Forward an email. Get a calibrated phishing verdict in under a second.
Send the suspicious message to your MailVerdict inbox, call the REST endpoint from Power Automate, or ask your Copilot Studio agent. Raw .eml is best: headers give us SPF, DKIM and DMARC.
Deterministic header and URL checks run first. Then Jev, a purpose-built judge model by TypeSafe, returns a calibrated probability plus attack type: credential harvest, payment fraud, malware, executive impersonation.
PHISHING, SUSPICIOUS or LEGITIMATE, the probability behind it, ranked indicators, and a plain-language explanation for the grey zone. Structured JSON for automation, a card for humans.
paypal.com but points to paypa1-secure.comcurl -X POST https://your-deploy.vercel.app/v1/analyze \
-H "x-api-key: $MAILVERDICT_API_KEY" \
-H "content-type: application/json" \
-d '{"subject":"Account suspended",
"from":"PayPal <alerts@paypa1-secure.com>",
"body":"Sign in within 24h: https://paypa1-secure.com/login"}'
{ "label": "PHISHING",
"probability": 0.93,
"attackType": "credential_harvest",
"indicators": [ ... ],
"explanation": "...",
"latencyMs": 640 }
Same result over MCP at /mcp for Copilot Studio: tools analyze_email, explain_verdict, get_policy.
When Jev says 93%, roughly 93 of 100 such emails are phishing. That lets you pick thresholds (auto-quarantine above 0.9, ask a human between 0.1 and 0.9) and know the trade-off you are making.
General chat models drift with prompt wording and are confidently wrong on edge cases. A dedicated judge answers the same fixed questions every time. The LLM only writes the explanation, and only when the verdict needs one.
One judge call per email, sub-second latency, no giant prompts. Deterministic checks (auth results, link mismatch, dangerous attachments) surface as indicators alongside the model's view.
Prefer to run it yourself? Self-host free (MIT) on GitHub.