Palisade MCP server

@palisadeemail/mcp

Connect an MCP client to the Palisade Email Authentication MCP, which monitors and manages SPF, DKIM, DMARC, MTA-STS, and BIMI for your domains.

Palisade's MCP server is remote (Streamable HTTP at https://api.palisade.email/mcp). This package is a thin local bridge for stdio-based clients, using mcp-remote under the hood. It signs you in through Palisade's public OAuth client: the browser opens, you pick an organization, and the bridge holds a token scoped to it and to your role. There is no API key to create and nothing to configure.

Use it

npx -y @palisadeemail/mcp

Client config (stdio)

{
  "mcpServers": {
    "palisade": {
      "command": "npx",
      "args": ["-y", "@palisadeemail/mcp"]
    }
  }
}

Codex

codex mcp add palisade -- npx -y @palisadeemail/mcp

Claude Code

Claude Code speaks Streamable HTTP itself, so it does not need the bridge. It signs in with the same client, on a fixed callback port:

claude mcp add --transport http --client-id ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV --callback-port 8765 palisade https://api.palisade.email/mcp

claude.ai

Add a custom connector with the URL, Authentication Always required, and OAuth client Use your own OAuth client with the client ID above and the secret left blank. See the MCP section of the developer guide.

What is refused

API keys are not accepted on the MCP endpoint; they remain the credential for the REST API. A client that registers its own OAuth client, through dynamic registration or a client ID metadata document, is refused too: the authorization server cannot attach an organization to such a client, so the endpoint answers 403 and names the client to use instead.

Without an account

https://api.palisade.email/mcp/public needs no sign-in and no Palisade account. It carries only the two tools that read public DNS for any domain, auditdomain and validatespf_include; everything that reads or changes an organization's records lives on the signed-in endpoint above. Calls are throttled per client address.

Clients that speak Streamable HTTP connect to it directly:

claude mcp add --transport http palisade-audit https://api.palisade.email/mcp/public

For stdio-only clients, point the bridge at it. The endpoint never asks for a token, so no browser opens:

{
  "mcpServers": {
    "palisade-audit": {
      "command": "npx",
      "args": ["-y", "@palisadeemail/mcp"],
      "env": { "PALISADE_MCP_URL": "https://api.palisade.email/mcp/public" }
    }
  }
}

Sign-in

The bridge listens on http://localhost:8765/oauth/callback while you sign in. The port is fixed because the authorization server registers exact redirect URIs; if something else holds that port, free it before connecting.

If the server connects but the Palisade tools are missing

A session that offers only authenticate / complete_authentication has not finished signing in. Those two tools come from the client's own pending-OAuth state, not from Palisade; complete the sign-in in the browser and the full list under Tools appears.

This can also mean a same-named server is configured somewhere else and is the one in effect. In Claude Code, --scope local applies only to the directory it was run in, and a palisade entry in user scope applies everywhere else. Check which entry actually wins:

claude mcp get palisade

Tools

Shortened. The full README is on GitHub.