Personal Expulse MCP

One URL. Your identity. Your limits.

Connect trusted AI clients to Expulse without copying a permanent API token into a settings box.

Universal endpoint

https://mcp.expulse.app/mcp

The production URL stays the same for every user. OAuth resolves the person and workspace on every request.

OAuth 2.1 + PKCE

Expulse publishes protected-resource metadata and relies on Auth0 discovery, authorization, consent, rotation, issuer, audience, expiry, and scope validation.

Narrow scopes

expulse:read
expulse:draft
expulse:execute
expulse:enrich

Server-side entitlements

Subscription, billing pause, sender ownership, credits, workspace membership, and per-user idempotency are checked inside Expulse—not trusted to the AI client.

Beta connection policy

Trusted founding users connect through developer mode first. Expulse will submit a universal-URL plugin only after OAuth, disclosures, annotations, tests, and review credentials pass production validation.