# MCP

> Palladin documentation · 1.0 · EN · 2026-10-25


Browser Inject currently works only on macOS through the Palladin extension. Linux CLI support does not include Inject.

## When to use MCP

**We recommend CLI integration.** Your agent runs `palladin` commands without additional MCP server configuration.

MCP is an alternative for applications that use this tool protocol. **MCP also requires the CLI to be installed**: its server runs through `palladin mcp serve`.

First [install the CLI](/docs/developers/installation), then [connect your agent](/docs/developers/connect). Check that the application starting MCP can find `palladin` in its `PATH`.

## Server configuration

This fragment shows a common MCP configuration format. The filename and registration method depend on the application. No API key belongs in this configuration.

```json
{
  "mcpServers": {
    "palladin": {
      "command": "palladin",
      "args": ["mcp", "serve", "--host", "<api-origin>"]
    }
  }
}
```

Replace `<api-origin>` with the API origin from the trusted panel instructions. `--host` selects the server when pairing a new profile through `pair_agent`; an existing profile retains its saved API origin.

The runtime uses standard input/output for MCP. The environment must resolve the correct executable; do not automatically fetch an arbitrary version through `npx`.

## Tools

| Tool | Purpose |
| --- | --- |
| `pair_agent` | Browser connection approved by the user. |
| `search_entries` | Search available metadata without retrieving a secret. |
| `get_credential` | Intentionally return permitted data to the caller; it may enter the model. |
| `exec_with_credential` | Run a process with data inside the local runtime boundary. |
| `inject_credential` | Deliver data to a verified form through an available provider. |
| `report_credential_stale` | Report a stale entry without sending its value. |

Read the complete tool parameters through `tools/list` in your MCP client.

## Profile and search

Every tool requires `profile`, selected by the user or trusted task configuration, never by web page content.

```json
{
  "profile": "example-agent",
  "query": "Palladin connection test",
  "pageSize": 10
}
```

These are `search_entries` arguments. Keep the same profile through discovery, approval waits, and credential use. Do not add `--id` to MCP startup; pass the profile with each tool call.

## Operation parameters

`get_credential`, `exec_with_credential`, and `inject_credential` identify `vaultId`, `entryId`, and a `reason`. Use identifiers from current results, not an entry name. For `exec_with_credential`, `command` is an array containing the executable and its arguments. A Script may require `parameters` matching its schema.

Support for `wait`, `noWait`, `pollInterval`, and `progress` depends on the operation and version. Some Inject parameters are reserved; appearing in a schema does not establish active support. A denial or unavailable provider does not authorize switching to `get_credential`.

For Inject, pass `targetTabId` and `targetUrl` together, or omit both. Experimental live forms require an explicit target.