@palisadeemail/mcp

Connect an MCP client to the Palisade Email Authentication MCP, which monitors and manages SPF, DKIM, DMARC, MTA-STS, and BIMI for your domains.

Palisade's MCP server is remote (Streamable HTTP at `https://api.palisade.email/mcp`). This package is a thin local bridge for stdio-based clients, using `mcp-remote` under the hood. Clients that support remote HTTP MCP servers with a bearer token can point at the URL directly and skip this package.

Get an API key

Create one at app.palisade.email → Settings → API keys, or programmatically via headless signup. See the Palisade MCP guide.

Use it

Set `PALISADE_API_KEY` and run:

PALISADE_API_KEY=secret_... npx -y @palisadeemail/mcp

Client config (stdio)

{
  "mcpServers": {
    "palisade": {
      "command": "npx",
      "args": ["-y", "@palisadeemail/mcp"],
      "env": { "PALISADE_API_KEY": "secret_..." }
    }
  }
}

Direct (clients that support remote HTTP MCP)

{
  "mcpServers": {
    "palisade": {
      "type": "http",
      "url": "https://api.palisade.email/mcp",
      "headers": { "Authorization": "Bearer secret_..." }
    }
  }
}

When `headers.Authorization` is set, the client authenticates with that API key and does not fall back to OAuth. The server replies `401` with a `WWW-Authenticate` challenge whenever credentials are missing or rejected, so a bad key surfaces as a connection error rather than silently starting an OAuth flow. The one exception is API-key-only discovery below, where a client opts out of that challenge on purpose.

API-key-only discovery

Some MCP directories probe an endpoint before they forward a configured API key. For those

clients, use `https://api.palisade.email/mcp?auth=api-key`. It keeps API-key authentication

enabled but omits the OAuth discovery challenge from an unauthenticated probe. Send the same

`Authorization: Bearer secret_...` header after connecting.

If the server connects but the Palisade tools are missing

A session that offers only `authenticate` / `complete_authentication` is using an OAuth-based entry, not your API-key entry. The Palisade server has no reduced tool set: any authenticated caller gets the full list under Tools. Those two tools come from the client's own pending-OAuth state.

This usually means a same-named server is configured somewhere else and is the one in effect. In Claude Code, `--scope local` applies only to the directory it was run in, and a `palisade` entry in user scope (from a previous OAuth connection) applies everywhere else. Check which entry actually wins:

claude mcp get palisade

The reported scope is the one in effect. If it is not the entry holding your API key, remove the other one, for example `claude mcp remove palisade -s user`, or give the API-key entry a distinct name.

Tools

Accounts (`get_account`), domains (`list_domains`, `get_domain`, `create_domain`, `update_domain`, `delete_domain`, `verify_domain`), DNS setup (`get_dns_records`, which returns the exact records to publish at your own DNS provider), SPF diagnostics (`get_spf`, which reads the live record, its DNS lookup count against the 10-lookup limit, and the problems found), hosted DMARC (`enable_hosted_dmarc`), MTA-STS (`get_mta_sts`, `enable_mta_sts`, `disable_mta_sts`), remediation tasks (`list_tasks`, `get_task`, `complete_task`, `dismiss_task`), DMARC reporting (`get_dmarc_summary`, `list_dmarc_senders`, which report aggregate figures and per-source breakdowns rather than raw report XML), groups (`list_groups`, `create_group`, `update_group`, `delete_group`), billing (`get_subscription`, `start_checkout`, `start_billing_portal`), and webhooks (`list_webhook_events`, `list_webhook_endpoints`, `create_webhook_endpoint`, `delete_webhook_endpoint`).

Palisade tells you which DNS records to publish; you apply them at whatever DNS provider hosts the domain. Payment happens on Stripe-hosted pages. Webhooks are the alternative to polling for long-running state changes: `create_webhook_endpoint` returns the signing secret once and never again, so store it when it is issued.

Environment

• `PALISADE_API_KEY` (required) — your Palisade API key.
• `PALISADE_MCP_URL` (optional) — override the server URL (defaults to `https://api.palisade.email/mcp`).