Get Started

Install the extension and try a live demo scan

Connecting…

Live Demo — Scan any email content

No account required. Results are powered by the same ML + AI pipeline used in production.

Live
Method
Installation Guide

Choose your email client

ThreatWatch AI for Gmail Chrome Extension · Manifest V3 · Gmail only
GitHub Releases Download ZIP
1
Download the extension

Click Download ZIP above, then extract the archive. The chrome-extension/ folder is the extension directory you need.

2
Open Chrome Extensions

In Chrome, navigate to chrome://extensions or open the menu → More tools → Extensions.

3
Enable Developer Mode

Toggle Developer mode in the top-right corner of the Extensions page. This is required to load unpacked extensions.

Developer mode does not affect other installed extensions and can be toggled back off after installation.
4
Load Unpacked

Click Load unpacked and select the chrome-extension/ folder you extracted in Step 1. The ThreatWatch AI for Gmail card should appear.

5
Configure the API endpoint

Click the extension card → Details → Extension options. The API URL should already point to https://threatwatch-ai.nusabyte.cloud. Change it only if you are self-hosting.

Set Scan mode to AI for the full 4-agent pipeline, or Standard for fast rule-based-only analysis.

6
Open Gmail and scan

Go to mail.google.com, open any email, and click the ThreatWatch AI button that appears above the message body. A verdict badge will be overlaid on the email.

The extension only activates on Gmail. It does not read emails you do not explicitly scan.

No native Outlook extension yet. ThreatWatch AI is currently Gmail-first. The options below let you scan emails from Outlook Web (OWA) and Outlook Desktop via the dashboard or a bookmarklet.

Option A — Dashboard paste

Easiest
1
Copy email text

In Outlook (web or desktop), open the suspicious email and select all text — Ctrl+A then Ctrl+C.

2
Go to the Scan page

Open ThreatWatch AI dashboard → Scan tab.

3
Paste & scan

Paste the copied text into the email body field and click Scan. Results appear within seconds.

Option B — Bookmarklet

OWA only
1
Add the bookmarklet

Drag the button below to your bookmarks bar:

Right-click → Bookmark this link if drag doesn't work in your browser.
2
Open OWA and click the bookmarklet

Go to Outlook Web, open an email, then click TW: Scan Email in your bookmarks bar.

3
Review the result

A popup will open showing the ThreatWatch AI verdict. Results are also saved to your scan history on the dashboard.

The bookmarklet cannot run on pages that block injected scripts (CSP). In that case use Option A.
Outlook Desktop (Win/Mac)
Copy the full email text and paste it into the dashboard Scan tab. Alternatively, forward the email to yourself and open it in OWA to use the bookmarklet.

No Thunderbird add-on yet. Thunderbird uses its own add-on system (WebExtensions). Until a native add-on ships, use the dashboard-paste workflow or the View Source method below.

Option A — Copy & Paste

Simplest
1
Open the email in Thunderbird

Select the suspicious email in your inbox.

2
Copy all content

Press Ctrl+A (select all) then Ctrl+C to copy the visible email body. For subject lines: copy just the subject from the header area.

3
Paste into the demo scanner above

Scroll up to the Live Demo widget, paste your text and click Scan Now — no login required.

Option B — View Source scan

Headers + URLs
1
Open raw source

With an email open in Thunderbird, press Ctrl+U (or View → Message Source). This shows the full email including headers and all URLs.

2
Copy suspicious URLs or headers

Look for From:, Reply-To:, and any http links. Copy those lines.

3
Scan via API or dashboard

Paste into the dashboard → Scan or use the demo widget above. The scanner is optimised for detecting suspicious links and spoofed senders.

Pasting raw headers gives the AI more signals (e.g. spoofed Reply-To, unusual sending domains).
Roadmap
A native Thunderbird WebExtension is planned. It will integrate directly into the Thunderbird message pane using the same API as the Chrome extension. Star the GitHub repo to get notified when it ships.
Developers

Direct API access

API Docs

Authenticate with your API key and POST any email content for a machine-readable verdict.

curl -X POST https://threatwatch-ai.nusabyte.cloud/api/v1/scan \
  -H "X-API-Key: <your-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "Urgent: verify your account",
    "body": "Click here to avoid suspension...",
    "mode": "ai"
  }'
Response shape
{
  "verdict": "scam",
  "score": 0.94,
  "confidence": "high",
  "flags": ["urgent_language", "suspicious_link"],
  "explanation": "...",
  "scan_mode": "ai"
}
Scan modes
standard — ML ensemble + rule engine, <100 ms
ai — full 4-agent LLM pipeline, ~3-15 s