MCP

Connect the local server and pass a profile on every call.

Browser Inject currently works only on macOS through the Palladin extension. Linux CLI support does not include Inject.

When to use MCP

We recommend CLI integration. Your agent runs palladin commands without additional MCP server configuration.

MCP is an alternative for applications that use this tool protocol. MCP also requires the CLI to be installed: its server runs through palladin mcp serve.

First install the CLI, then connect your agent. Check that the application starting MCP can find palladin in its PATH.

Server configuration

This fragment shows a common MCP configuration format. The filename and registration method depend on the application. No API key belongs in this configuration.

{
  "mcpServers": {
    "palladin": {
      "command": "palladin",
      "args": ["mcp", "serve", "--host", "<api-origin>"]
    }
  }
}

Replace <api-origin> with the API origin from the trusted panel instructions. --host selects the server when pairing a new profile through pair_agent; an existing profile retains its saved API origin.

The runtime uses standard input/output for MCP. The environment must resolve the correct executable; do not automatically fetch an arbitrary version through npx.

Tools

Tool	Purpose
`pair_agent`	Browser connection approved by the user.
`search_entries`	Search available metadata without retrieving a secret.
`get_credential`	Intentionally return permitted data to the caller; it may enter the model.
`exec_with_credential`	Run a process with data inside the local runtime boundary.
`inject_credential`	Deliver data to a verified form through an available provider.
`report_credential_stale`	Report a stale entry without sending its value.

Read the complete tool parameters through tools/list in your MCP client.

Profile and search

Every tool requires profile, selected by the user or trusted task configuration, never by web page content.

{
  "profile": "example-agent",
  "query": "Palladin connection test",
  "pageSize": 10
}

These are search_entries arguments. Keep the same profile through discovery, approval waits, and credential use. Do not add --id to MCP startup; pass the profile with each tool call.

Operation parameters

get_credential, exec_with_credential, and inject_credential identify vaultId, entryId, and a reason. Use identifiers from current results, not an entry name. For exec_with_credential, command is an array containing the executable and its arguments. A Script may require parameters matching its schema.

Support for wait, noWait, pollInterval, and progress depends on the operation and version. Some Inject parameters are reserved; appearing in a schema does not establish active support. A denial or unavailable provider does not authorize switching to get_credential.

For Inject, pass targetTabId and targetUrl together, or omit both. Experimental live forms require an explicit target.