PowerDMARC MCP

powerdmarcmcp/powerdmarc-mcp

Remote MCP server bridging AI clients with the PowerDMARC email authentication Platform

1

557

powerdmarcmcp/powerdmarc-mcp repository overview

PowerDMARC MCP

A self-hosted MCP server that bridges AI clients with the PowerDMARC⁠ email security API via the Model Context Protocol. It exposes 30+ tools covering DMARC/SPF/DKIM reporting, domain management, DNS lookups, and MSSP operations.

---

Quick Start

Pull and run the pre-built image from Docker Hub:

docker run -d \
  --name powerdmarc-mcp \
  -e MCP_PUBLIC_URL="your-server-domain.com" \
  -p 3001:3001 \
  -v powerdmarc_data:/app/data \
  powerdmarcmcp/powerdmarc-mcp:1.0.0

The server starts on http://localhost:3001⁠. SQLite data is persisted in the powerdmarc_data volume.

Verify it's running

curl http://localhost:3001/health

---

Environment Variables

Variable	Required	Default	Description
MCP_PUBLIC_URL	Recommended	mcp-dmarc.com	Public hostname of this MCP server — used in OAuth WWW-Authenticate headers
PLATFORM_BASE_URL	No	https://app.powerdmarc.com	PowerDMARC API base URL for end-user accounts
PLATFORM_MSSP_BASE_URL	No	falls back to PLATFORM_BASE_URL	PowerDMARC API base URL for MSSP accounts
DATABASE_URL	No	file:/app/data/dev.db	SQLite path (or a postgres:// URL for production)
PORT	No	3001	HTTP port
METRICS_TOKEN	No	—	Secret required in X-Metrics-Token header for POST /metrics (min 32 chars). Generate: openssl rand -hex 32
ALLOWED_ORIGINS	No	https://claude.ai,...	Comma-separated CORS allowed origins
RATE_LIMIT_MAX	No	60	Max requests per window per client
RATE_LIMIT_WINDOW_MS	No	60000	Rate limit window in milliseconds
BLOCKLIST_ENABLED	No	false	Enable token revocation blocklist
LOG_LEVEL	No	info	Pino log level (fatal/error/warn/info/debug/trace)

---

Connecting AI Clients

All clients connect to the /mcp endpoint using a Bearer token obtained via OAuth from app.powerdmarc.com⁠. The server handles OAuth Dynamic Client Registration at /register.

Claude Code (CLI)

claude mcp add powerdmarc \
  --transport http \
  --url http://localhost:3001/mcp \
  --header "Authorization: Bearer <your-powerdmarc-token>"

Or via ~/.claude/claude_code_config.json:

{
  "mcpServers": {
    "powerdmarc": {
      "type": "http",
      "url": "http://localhost:3001/mcp",
      "headers": {
        "Authorization": "Bearer <your-powerdmarc-token>"
      }
    }
  }
}

Claude Desktop

Claude Desktop uses stdio transport. Bridge it to the HTTP server via the MCP proxy:

{
  "mcpServers": {
    "powerdmarc": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-proxy",
        "http://localhost:3001/mcp"
      ]
    }
  }
}

Config file locations:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

VS Code (GitHub Copilot Agent Mode)

Create .vscode/mcp.json in your workspace:

{
  "servers": {
    "powerdmarc": {
      "type": "http",
      "url": "http://localhost:3001/mcp",
      "headers": {
        "Authorization": "Bearer <your-powerdmarc-token>"
      }
    }
  }
}

Cursor

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "powerdmarc": {
      "url": "http://localhost:3001/mcp",
      "headers": {
        "Authorization": "Bearer <your-powerdmarc-token>"
      }
    }
  }
}

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "powerdmarc": {
      "serverUrl": "http://localhost:3001/mcp",
      "headers": {
        "Authorization": "Bearer <your-powerdmarc-token>"
      }
    }
  }
}

---

Available Tools

DMARC Reports

Tool	Description
dmarc_aggregate_detailed_stats	Detailed aggregate stats for a date range
dmarc_aggregate_per_country	Aggregate data grouped by country
dmarc_aggregate_per_host	Aggregate data per sending host
dmarc_aggregate_per_org	Aggregate data per reporting organization
dmarc_aggregate_per_result	Aggregate data grouped by pass/fail result
dmarc_aggregate_per_sending_source	Aggregate data per source IP
dmarc_forensic_data	Forensic (RUF) failure reports

Domain Management

Tool	Description
list_domains	List all registered domains
get_domain	Details for a specific domain
create_domain	Register a new domain
delete_domain	Remove a domain

Hosted Records

Tool	Description
get_hosted_dmarc	Hosted DMARC record for a domain
get_hosted_spf	Hosted SPF record for a domain
get_dkim_selectors	DKIM selectors for a domain
get_hosted_bimi	Hosted BIMI record
get_mta_sts_policy	MTA-STS policy

Analytics

Tool	Description
domain_health	Health score and authentication status
mail_volume_history	Historical mail volume
dkim_analytics	DKIM analytics for a domain

DNS & Power Tools

Tool	Description
dns_lookup	Look up any DNS record type (DMARC, SPF, DKIM, MX, A, AAAA, CNAME, TXT, NS, SOA, CAA, PTR, MTA-STS)
dns_lookup_app	DNS lookup via PowerDMARC platform
whois_lookup	WHOIS registration info
generate_dmarc_record	Generate a DMARC TXT record
generate_spf_record	Generate an SPF TXT record
generate_dkim_record	Generate a DKIM public key record
domain_analyzer	Full domain email security analysis
dmarc_charts_app	DMARC chart data

Audit & MSSP

Tool	Description
get_audit_logs	Retrieve platform audit logs
mssp_list_accounts	List all MSSP customer sub-accounts
mssp_list_members	List MSSP sub-account users
mssp_create_member	Create a user in an MSSP sub-account
mssp_delete_member	Delete a user from an MSSP sub-account
mssp_domain_groups	List MSSP domain groups

---

Endpoints

Path	Method	Description
/mcp	POST	MCP StreamableHTTP transport — main entry point for AI clients
/health	GET	Liveness probe
/metrics	POST	Prometheus metrics (requires X-Metrics-Token header)
/register	POST	OAuth Dynamic Client Registration (proxies to PowerDMARC)

---

Privacy Policy

PowerDMARC is committed to protecting your privacy.

Data collection: The MCP server acts as a proxy between AI clients and the PowerDMARC API. It does not collect, store, or log any email content or DMARC report data beyond what is required to fulfill each individual API request. Structured request/response logs (without sensitive payload contents) may be retained for up to 30 days for debugging purposes.

Data usage and storage: API tokens provided by users are used solely to authenticate requests to the PowerDMARC API on the user's behalf. Tokens are never stored in plaintext beyond the lifetime of a single request session. A token blocklist (hashed identifiers only) is maintained in the server database to prevent use of revoked credentials.

Third-party sharing: No user data, API tokens, or DMARC report contents are shared with any third party. The only outbound connections made by the MCP server are to the PowerDMARC API endpoints configured by the operator.

Data retention: Request logs are retained for a maximum of 30 days and then purged automatically. The token blocklist retains hashed token identifiers indefinitely to prevent reuse of revoked keys.

Contact: For privacy-related questions or data removal requests, contact [email protected]⁠ or visit https://powerdmarc.com/privacy-policy/⁠.

Tag summary

Content type

Image

Digest

sha256:a7759a646…

Size

169 MB

Last updated

3 months ago

docker pull powerdmarcmcp/powerdmarc-mcp