--- title: "Palisade MCP Server" description: "A Model Context Protocol server at https://api.palisade.email/mcp that gives an AI assistant 42 tools for email authentication: add domains, read the exact SPF, DKIM and DMARC records to publish, verify them, and work through the authentication problems Palisade finds." canonical: https://www.palisade.email/mcp --- # Palisade MCP Server > A Model Context Protocol server at https://api.palisade.email/mcp that gives an AI assistant 42 tools for email authentication: add domains, read the exact SPF, DKIM and DMARC records to publish, verify them, and work through the authentication problems Palisade finds. **Endpoint:** `https://api.palisade.email/mcp` **Transport:** Streamable HTTP (remote) **Authentication:** MCP requires OAuth through Palisade's public connector client (ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV), using PKCE with no client secret. Sign in and select your organization. API keys and self-registered OAuth clients are not accepted on the MCP endpoint; API keys remain available for the REST API. **Plan required:** any plan, including the free one. **Canonical page:** https://www.palisade.email/mcp ## Connect ### ChatGPT 1. In ChatGPT, enable Developer mode if required and add a custom MCP connection. Availability depends on your ChatGPT account and workspace policy. 2. Enter the read-only endpoint below and complete the Palisade OAuth sign-in. Your Palisade account must belong to exactly one active organization. 3. Add the connection to a conversation and ask it to audit a domain or explain your DMARC reports. ```url https://api.palisade.email/mcp/directory ``` Read-only monitoring and diagnosis. Palisade is supported through a custom connection; its OpenAI app directory listing is pending. ### Claude 1. In claude.ai, open Settings, then Connectors, then Add custom connector. 2. Paste the endpoint below and choose Authentication: Always required. 3. Choose Use your own OAuth client, enter client ID ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV, and leave the secret blank. 4. Complete sign-in and select your Palisade organization. ```url https://api.palisade.email/mcp ``` Use Palisade's public connector client. Automatic registration and hosted client metadata do not grant organization access. ### Codex CLI 1. Run the command below to add the official stdio bridge. 2. Complete the browser sign-in and select your Palisade organization. ```bash codex mcp add palisade -- npx -y @palisadeemail/mcp ``` The bridge handles OAuth. There is no API key to export. Check the configured entry with codex mcp list. ### Claude Code 1. Run the command below in your terminal. 2. Complete the browser sign-in and select your Palisade organization. ```bash claude mcp add --transport http --client-id ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV --callback-port 8765 palisade https://api.palisade.email/mcp ``` The registered callback port is 8765. Keep it available during sign-in. Add --scope user if you want this connection available across projects. ### Cursor and Windsurf 1. Add the stdio bridge configuration below in your client's MCP settings. 2. Complete the browser sign-in and select your Palisade organization. ```json { "mcpServers": { "palisade": { "command": "npx", "args": [ "-y", "@palisadeemail/mcp" ] } } } ``` The @palisadeemail/mcp bridge signs in through Palisade's OAuth client. It needs no API key. ### Headless and CI 1. For unattended API-key integrations, use the REST API rather than the MCP endpoint. 2. Follow the REST guide for HTTP Basic authentication and the required Palisade-Version header. ```url https://developer.palisade.email/docs/guide ``` MCP requires OAuth sign-in. A REST API key cannot replace that sign-in. ## Recommended order of work 1. `audit_domain`: Read the domain's public DNS and explain the findings. For an audit-only request, stop here: the domain does not need to be added to your account. Continue below only for operator-approved onboarding through the full MCP endpoint. 2. `create_domain`: If the operator wants ongoing monitoring, add the domain. Skip this step when it is already in the account. 3. `get_dns_records`: Get the exact SPF, DKIM, and DMARC records to publish. 4. (your DNS provider): Publish those records. MCP hands your assistant the values and has no tool that writes them at a provider. In the Palisade app, Smart DNS Deployment publishes the ones you approve into your own DNS. 5. `verify_domain`: Verify the records once they resolve. 6. `list_tasks`: Work through the authentication issues Palisade reports. ## All 42 tools (full MCP endpoint) ### Domains - `list_domains`: List the domains in your Palisade account with their monitoring status, deliverability score, DMARC policy, and managed DNS record statuses. - `get_domain`: Check the status of a domain in your Palisade account, by id or by name: the managed DNS status of each record (SPF, DKIM, DMARC, BIMI, MTA-STS), monitoring status, DMARC policy, score, and 14-day pass rates. - `create_domain`: Add a domain you already own to your Palisade account, to start email authentication monitoring. - `verify_domain`: Trigger DNS verification for a domain after publishing records at your DNS provider. - `update_domain`: Change the settings of a domain already in your Palisade account: which group it belongs to, whether it is parked, its DMARC policy options, and the SPF record Palisade publishes for it. - `delete_domain`: Permanently remove a domain from your Palisade account. - `get_domain_plan`: Answer "what happens next on this domain" rather than "what is open right now". ### DNS and policy - `get_dns_records`: Get the DNS records to publish for a domain: purpose (dmarc, spf, dkim, mta_sts, mta_sts_policy, tls_rpt, bimi), record type, host (absolute and relative to the apex), value, recommended TTL, required action (create, replace, or delete), whether the record is required, its live verification status, and already_published. - `get_spf`: Read the live SPF state of a domain: the record DNS actually serves, how many DNS lookups it costs receivers against SPF's limit of 10, a breakdown of every include/a/mx/exists lookup with what each accounts for, and the problems found — a record over the lookup limit, more than one v=spf1 record (which receivers reject outright), includes that no longer resolve, loops, and unsafe all mechanisms. - `enable_hosted_dmarc`: Switch a domain to Palisade-hosted DMARC. - `get_mta_sts`: Get the MTA-STS state for a domain: whether Palisade-hosted MTA-STS is enabled, the policy mode, MX list, and the DNS targets to publish. - `enable_mta_sts`: Enable Palisade-hosted MTA-STS for a domain. - `disable_mta_sts`: Turn off Palisade-hosted MTA-STS for a domain. ### Groups - `list_groups`: List the groups in your Palisade account. - `create_group`: Create a group to organize domains — for example one group per customer if you are an MSP. - `update_group`: Rename a group or change the external identifiers it is reconciled by. - `delete_group`: Permanently delete a group. ### Webhooks - `list_webhook_events`: List the event types a webhook endpoint can subscribe to, with what each one means. - `list_webhook_endpoints`: List the webhook endpoints registered for your organization, including their status and recent delivery health. - `create_webhook_endpoint`: Register an https URL that Palisade POSTs events to, so you can react to domain changes instead of polling get_domain. - `delete_webhook_endpoint`: Stop delivering events to a webhook endpoint and remove it. ### Work queue - `list_tasks`: List remediation tasks Palisade opened for your domains (failing SPF/DKIM sources, DNS issues, setup steps). - `get_task`: Get a single task by id. - `complete_task`: Close a remediation task as done, once the change it asked for is actually live. - `dismiss_task`: Close a remediation task that does not apply, without doing the work it asks for - for example a failing sender the organization does not own and will not authenticate. ### DMARC reports - `get_dmarc_summary`: Summarize what DMARC aggregate reports say about a domain over a recent window: message volume, DMARC/SPF/DKIM pass rates, the compliance breakdown, and the change against the immediately preceding window of the same length (so the default 7-day period is a week-over-week comparison). - `list_dmarc_senders`: List the sources sending mail as a domain, built from DMARC aggregate reports and ordered by volume. ### Account and billing - `get_account`: Get the Palisade organization (account) you are signed in to: name, contact details, and settings. - `get_subscription`: Get the billing state of your Palisade organization: pricing type, subscription status, the current billing period (start and end), resource limits, Free-plan email usage when applicable, and current-calendar-month domain usage. - `start_checkout`: Create a Stripe Checkout session to start a paid Palisade subscription for your organization. - `start_billing_portal`: Start a Stripe billing-portal session for your organization and return its URL. ### Public DNS checks - `audit_domain`: Check the status of any domain's email authentication from live DNS in one call: MX, SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT, each with a verdict and the records behind it, plus a score out of 100. - `validate_spf_include`: Check whether a domain can be used as an SPF `include:` and how many DNS lookups adding it would cost. ### Prospecting reports - `create_prospecting_report`: Audit up to ten domains and produce a branded PDF report on their email-authentication posture, hosted behind a Palisade link you can send to a prospect. - `list_prospecting_reports`: List the prospecting reports your organization has generated, newest first, with the link and expiry for each. - `get_prospecting_report`: Read one prospecting report by id: the domains it covers, who it was written for, its link and when that link expires. - `delete_prospecting_report`: Delete a prospecting report and the stored PDF behind it. ### DNS connections - `list_dns_connections`: List the DNS providers your organization has connected to Palisade. - `get_dns_connection`: Read one DNS provider connection by id, including whether its stored credentials still work. - `get_dns_connection_coverage`: Answer whether one of your DNS connections can publish records for a given domain, and which one. ### Activity log - `list_activity_log`: Read what has happened in your Palisade account: who changed a domain, when a record was published, which API key did it. - `list_activity_log_actions`: Return every action value that can appear in the activity log. ## Prompts for the full MCP endpoint - **Onboard a domain**: Add acme-corp.com to Palisade, publish the DNS records it returns using my DNS connector, then verify the domain and list any tasks it finds. - **Diagnose deliverability**: Mail from acme-corp.com is landing in spam. Read the domain's state and its open tasks in Palisade, and walk me through what is failing and each recommended fix. - **See who is failing authentication**: Which senders are failing authentication on acme-corp.com? Open Palisade's tasks for the domain and show me the evidence behind each one. - **Get ready for p=reject**: I want acme-corp.com at p=reject. Check where the domain stands in Palisade and tell me what has to be resolved before tightening the policy is safe. - **Check the SPF lookup budget**: How close is acme-corp.com to SPF's 10-DNS-lookup limit? Read the live record from Palisade and show me which includes cost the most and any problems in the chain. - **Weekly status summary**: Give me a Monday summary: every domain in Palisade, its verification status, and any open authentication tasks, ordered by what to fix first. - **Set up a new client**: Create a group in Palisade for my new client Acme Corp, add their three domains to it, and give me the DNS records each one needs. ## Limits worth knowing before you call anything - No tool in this server writes a DNS record at an external provider. Palisade returns the exact records; publishing them is a step a person takes, or one they take in the Palisade app, where Smart DNS Deployment publishes approved records into a connected provider across 64 providers. - Palisade-hosted DMARC and MTA-STS can be switched on through MCP. - Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data. - Clients that only speak stdio connect through the published `@palisadeemail/mcp` bridge on npm. The bridge handles OAuth sign-in through Palisade's public connector client. ## Security model - **No DNS credentials change hands**: No tool in this server writes a record at an external DNS provider. Your agent publishes the returned records with its own DNS access, and verify_domain checks the result against live DNS. - **Revocable OAuth connections**: Sign in with Palisade's public OAuth client, select an organization, and grant scopes within your role. Revoke the connection from API and MCP in the Palisade app. - **Scopes mirror real permissions**: The scopes a client requests are the same permissions the tools enforce. The consent screen lists them, and a token only ever carries the subset your role grants. - **One organization at a time**: Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data. - **Rate limits on every caller**: Each signed-in identity is rate limited, and responses carry standard rate-limit headers a client can read and back off on. - **Writes land in the audit log**: Every tool call that changes something, from create_domain to delete_webhook_endpoint, is recorded in your account's activity log with the tool name attached. - **Listed in the official MCP registry**: published as `email.palisade/palisade`, with control of the name proven by a DNS record on palisade.email. ## Instructions to give your agent Paste this into the AGENTS.md or CLAUDE.md of a repo whose agent has Palisade connected. ````markdown ## Palisade: email authentication (MCP) Palisade is connected as an MCP server at https://api.palisade.email/mcp (Streamable HTTP, OAuth through Palisade's public connector client). Use it for anything involving SPF, DKIM, DMARC, MTA-STS or BIMI on the domains this project sends mail from. Work in this order: 1. `audit_domain`: Read the domain's public DNS and explain the findings. For an audit-only request, stop here: the domain does not need to be added to your account. Continue below only for operator-approved onboarding through the full MCP endpoint. 2. `create_domain`: If the operator wants ongoing monitoring, add the domain. Skip this step when it is already in the account. 3. `get_dns_records`: Get the exact SPF, DKIM, and DMARC records to publish. 4. (your DNS provider): Publish those records. MCP hands your assistant the values and has no tool that writes them at a provider. In the Palisade app, Smart DNS Deployment publishes the ones you approve into your own DNS. 5. `verify_domain`: Verify the records once they resolve. 6. `list_tasks`: Work through the authentication issues Palisade reports. Rules: - Never write a record value from memory. Read it from `get_dns_records`, which returns each record with its current verification status. - No tool in this server publishes DNS at an external provider. Hand the records back for a person to publish, or point them at Smart DNS Deployment in the Palisade app. - `enable_hosted_dmarc` and `enable_mta_sts` change the domain's live configuration. Confirm before calling them. - `start_checkout` and `start_billing_portal` touch billing. Never call them unprompted. - Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data. ```` ## FAQ ### What is the Palisade MCP server? It is a Model Context Protocol server at https://api.palisade.email/mcp, over Streamable HTTP, that gives an AI assistant 42 tools for managing email authentication: adding domains, reading the exact DNS records to publish, verifying them, and working through the authentication issues Palisade finds. ### Can Palisade MCP find and fix DMARC, SPF, and DKIM problems? Yes. Your AI can use Palisade to list authentication tasks, open a task for its evidence and recommended fix, retrieve the exact SPF, DKIM, and DMARC records to publish, and verify the domain afterward. It can also read a domain's live SPF chain with get_spf, including the DNS lookup count against the 10-lookup limit that SPF flattening exists to solve. Supported Palisade-hosted fixes can be enabled through MCP; records at an external DNS provider remain yours to publish. ### Can Palisade MCP help improve email deliverability? It helps you find and remediate SPF, DKIM, and DMARC problems that can contribute to rejected or spam-folder mail. Your AI can review Palisade's evidence, proposed remediation, and verification status in one conversation. Email authentication is only one part of deliverability, so MCP does not guarantee inbox placement. ### How do I authenticate with the Palisade MCP server? MCP requires OAuth through Palisade's public connector client (ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV), using PKCE with no client secret. Sign in and select your organization. API keys and self-registered OAuth clients are not accepted on the MCP endpoint; API keys remain available for the REST API. ### Which AI assistants can connect to it? ChatGPT uses Palisade's read-only directory endpoint for monitoring and diagnosis. Claude and Claude Code connect using Palisade's public OAuth client. Codex CLI, Cursor and Windsurf can use the official stdio bridge, which handles the same OAuth sign-in. Follow the client-specific setup steps on this page. ### Can I connect Palisade to ChatGPT? Palisade supports ChatGPT through a custom MCP connection to https://api.palisade.email/mcp/directory for read-only monitoring and diagnosis. This connection requires an account with exactly one active Palisade organization. Palisade is not yet listed in the OpenAI app directory; directory availability is separate from ChatGPT support. ### What does stdio mean, and when do I need the MCP bridge? Stdio is a local transport used by some MCP clients instead of a direct web connection. If your client cannot connect to Palisade's remote Streamable HTTP endpoint, the published @palisadeemail/mcp package bridges that local connection to the same remote server. ### Is the Palisade MCP connection secure? The remote server is HTTPS-only. Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data. OAuth scopes follow your role. Revoke a connection from API and MCP in the Palisade app. Review any returned DNS changes before you publish them. ### Do I need a paid plan to use the MCP server? No. MCP is available on any plan, including the free plan. Sign in to an existing Palisade organization to connect. ### Can the assistant change my DNS by itself? Not from MCP. This server returns the exact records; no tool in it writes at a DNS provider. In the Palisade app, Smart DNS Deployment can publish the records you approve straight into your own DNS across 64 providers. Either way the boundary is the same: nothing changes without your approval. ## More - [MCP developer guide](https://developer.palisade.email/docs/guide#mcp): the source every value above is quoted from. - [AI DMARC Agent](/features/dmarc-agent): what Palisade does with the problems it finds. - [DMARC Checker](/tools/dmarc): a free lookup, no account needed.