Suped DMARC for OpenClaw

Homepage: suped.com

Connect OpenClaw to your Suped account for DMARC monitoring and report analysis, SPF/DKIM diagnostics, domain management and authorized MSP client onboarding.

This plugin declares Suped’s existing remote MCP server and includes the Suped DMARC skill. OpenClaw manages the MCP connection and OAuth credentials. The runtime entry registers no additional tools, callbacks or services.

Requirements

• OpenClaw 2026.10.7 or newer. Initial compatibility target: 2026.10.7.
• Node >=24.22.1 <25 or >=26.12.1, matching that OpenClaw release.
• A Suped account with access to the organizations you want to use. Suped service plans and limits apply separately.

Install

Install from ClawHub:

openclaw plugins install clawhub:@suped/dmarc
openclaw plugins enable suped-dmarc

For a local checkout or unpacked development package:

openclaw plugins install ./openclaw-dmarc
openclaw plugins enable suped-dmarc

Use the actual local path when it differs. Follow OpenClaw’s ordinary installation review and reload prompts, then start a new session.

Connect your Suped account

Use the plugin’s native Accounts flow with your normal OpenClaw Gateway running:

1. Open the Control UI on that Gateway’s own HTTPS address or a local loopback HTTP address, such as http://127.0.0.1:18789.
2. Go to Settings → Plugins → Suped DMARC → Accounts → Connect.
3. Sign in to Suped and select Allow access.
4. Return to the plugin page, then start a new conversation and ask “List my Suped organizations” to check the connection.

Use the same Gateway for the Control UI and the OAuth connection. A separately hosted UI or an arbitrary remote HTTP address cannot receive that Gateway’s callback. OpenClaw manages the native callback, dynamic client registration, S256 PKCE and credential storage; no API key, client secret or mcp set command is needed for this UI flow. See OpenClaw’s MCP authorization instructions.

Advanced CLI fallback

OpenClaw 2026.10.7’s mcp login, doctor and probe commands inspect saved operator configuration rather than plugin-contributed defaults. Only when using these CLI commands, save the matching server definition explicitly. The operator entry overrides the plugin default and does not create a second server.

If a saved suped server already exists, inspect it with openclaw mcp show suped. Reuse it when it points to the endpoint below; preserve an unrelated definition instead of overwriting it.

openclaw mcp set suped '{"url":"https://www.suped.com/api/mcp","transport":"streamable-http","auth":"oauth","oauth":{"scope":"suped:write"}}'

Stop the Gateway before the offline CLI login, then run:

openclaw mcp login suped

Follow a complete authorization URL printed by OpenClaw. If the terminal redacts the URL or prints an incomplete URL, stop that attempt, restart the Gateway, and use Settings → Plugins → Suped DMARC → Accounts → Connect instead. Do not reconstruct redacted values.

After a successful CLI login, restart the Gateway. The saved operator definition can be checked with:

openclaw mcp doctor suped --probe

Keep the MCP URL exactly https://www.suped.com/api/mcp so the OAuth resource matches. UI sign-in saves credentials on the selected Gateway; saving credentials alone does not prove that tools work, so make the read-only organization-list request above.

This shared operator login is available to trusted users of that OpenClaw instance. Use OpenClaw’s documented per-requester OAuth setup when different people need separate accounts.

Capabilities and permissions

• List accessible organizations and monitored domains, including archived domains.
• Read saved email authentication issues with open, resolved or dismissed status.
• Analyze DMARC rows for a date range and download original report XML.
• Add or restore domains in Suped when requested; this does not change DNS.
• Create client organizations under an accessible MSP only when the connected user administers that MSP. This tool may be absent for other accounts; each successful call creates a client.

Suped enforces current account permissions on every request. Billing-only membership cannot read domain/report/issue data or add domains. The suped:write scope covers reading and creation; it does not grant access to more organizations.

The seven upstream tools are list_organizations, get_domains, list_issues, get_dmarc_records, download_dmarc_report, create_domain, and permission-gated create_organization. OpenClaw may expose them with a server prefix. The plugin cannot edit DNS, change policy, resolve or dismiss issues, delete data, or change account permissions.

Disconnect

Disable the plugin to stop its contributed Suped connection:

openclaw plugins disable suped-dmarc

Disabling the plugin retains saved OAuth credentials. OpenClaw 2026.10.7’s plugin Accounts page has no disconnect action. If you also saved a suped operator override, remove it with the cleanup below; otherwise it continues to supply the server independently of the plugin.

Remove saved credentials and any operator override

Stop the Gateway before clearing credentials. The CLI requires a saved suped definition, even for credentials originally saved through the plugin UI. Inspect it with openclaw mcp show suped; preserve an unrelated definition instead of overwriting it. If none exists, save the exact matching definition temporarily:

openclaw mcp set suped '{"url":"https://www.suped.com/api/mcp","transport":"streamable-http","auth":"oauth","oauth":{"scope":"suped:write"}}'

Then clear the shared operator credential and remove the saved definition:

openclaw mcp logout suped
openclaw mcp unset suped

Restart the Gateway when finished. To reconnect later, enable the plugin and use its native Accounts flow above. These actions do not delete Suped organizations, domains or reports.

Development and validation

The dependency-free JavaScript entry is the shipped runtime artifact; no TypeScript compilation or custom MCP/OAuth bridge is needed.

node --check index.js
npm pack --dry-run
clawhub package validate . --openclaw-version 2026.10.7
clawhub package publish . --owner suped --dry-run

ClawHub code-plugin publishing also requires the public source repository and exact committed revision. Publish only after reviewing the package and completing the connection test. Package validation and packing do not prove the full OAuth flow.

License and support

The package is UNLICENSED. The existing skills/suped-dmarc/SKILL.md retains its MIT-0 license; see NOTICE.

• Suped MCP documentation
• OpenClaw MCP OAuth
• Privacy policy
• Terms of service
• Support: contact@suped.com