Skip to main content

relayshield-mcp

mcp-name: io.github.nzdsf2-gif/relayshield-mcp

RelayShield security intelligence as an MCP server — plug breach detection, SIM swap detection, domain lookalike monitoring, OAuth supply chain watchlist, and URL/file scanning directly into Claude and any MCP-compatible AI agent.

Tools

Tool What it does PAYG price
check_breach Email breach lookup — 13 billion+ records via HIBP $0.10 USDC
check_sim_swap SIM swap / eSIM detection via live carrier data $0.25 USDC
check_domain_lookalikes Typosquat and lookalike domain detection with cert transparency $0.50 USDC
check_oauth_watchlist OAuth-app breach + stolen-token exposure via HIBP + stealer-log corpus $0.30 USDC
check_infostealer Infostealer malware log lookup via Hudson Rock Cavalier $0.15 USDC
scan_wallet EVM wallet on-chain risk check via GoPlus Security $0.10 USDC
scan_url URL malware/phishing scan across 70+ engines (async) $0.05 USDC
scan_file Binary malware scan across 70+ AV engines (async) $0.10 USDC
check_scan_result Poll for verdict after scan_url / scan_file free
check_mcp_registry_risk Typosquat/IOC/registration-age check for MCP servers $0.35 USDC
check_prompt_injection_breach Breach exposure sourced from AI-agent prompt-injection attacks $0.35 USDC
check_supply_chain Up to 10 vendor domains checked for breach/infostealer exposure $0.10 USDC
check_session_risk Active/reusable stolen session (cookie/token) exposure check $0.30 USDC
check_nhi_exposure Non-human-identity credential exposure — API keys, service tokens, PATs $0.40 USDC
check_secret_scan Secrets exposed in public GitHub repositories $0.35 USDC

check_oauth_watchlist, check_supply_chain, check_session_risk, check_nhi_exposure, and check_secret_scan cover related ground — connected-app, session, and machine-credential exposure for an identity or its supply chain — and are a natural set to use together when vetting an agent's current authority, not just a login.

Access modes

Subscription — API key from api.relayshield.net/developers. All 15 tools available. Free tier: 100 calls/month. Paid tiers from $29/month.

Pay-as-you-go — No API key needed. Pay per check in USDC on Base (x402 protocol). Set RELAYSHIELD_X_PAYMENT with your payment proof. All 15 tools available ($0.05–$0.50/check, check_scan_result free). Call a tool with no payment set to receive pricing and payment instructions.

Discovery — Set neither key nor payment. Tool calls return payment requirements and a subscription link.

Install

pip install relayshield-mcp

Or run without installing:

uvx relayshield-mcp

Configure Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

Subscription (RelayShield API key):

{
  "mcpServers": {
    "relayshield": {
      "command": "relayshield-mcp",
      "env": {
        "RELAYSHIELD_API_URL": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod",
        "RELAYSHIELD_API_KEY": "your-relayshield-api-key-here"
      }
    }
  }
}

Pay-as-you-go (x402 USDC on Base):

{
  "mcpServers": {
    "relayshield": {
      "command": "relayshield-mcp",
      "env": {
        "RELAYSHIELD_API_URL": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod",
        "RELAYSHIELD_X_PAYMENT": "your-x402-payment-proof-here"
      }
    }
  }
}

Quit and relaunch Claude Desktop after editing.

Configure Claude Code (CLI)

claude mcp add relayshield \
  --command relayshield-mcp \
  --env RELAYSHIELD_API_URL=https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod \
  --env RELAYSHIELD_API_KEY=your-relayshield-api-key-here

Usage examples

Once configured, ask Claude:

Check whether user@example.com has been breached.
Has there been a SIM swap on +14155551234?
Check acme.com for lookalike domains.
Are any OAuth apps connected to user@example.com in a recent breach?
Scan this URL for malware: https://suspicious-link.example.com

For URL and file scans, Claude automatically polls check_scan_result every 5 seconds until the verdict is ready.

Environment variables

Variable Description
RELAYSHIELD_API_URL API Gateway base URL (required)
RELAYSHIELD_API_KEY RelayShield subscription key (subscription mode) — get one at api.relayshield.net/developers
RELAYSHIELD_X_PAYMENT x402 payment proof — USDC on Base (pay-as-you-go mode)

Set RELAYSHIELD_API_KEY or RELAYSHIELD_X_PAYMENT — not both. API key takes priority if both are set.

Links

Metadata

Release files for relayshield-mcp 0.2.8

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for relayshield-mcp 0.2.8
File Size Uploaded
relayshield_mcp-0.2.8.tar.gz 10.7 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for relayshield-mcp 0.2.8
File Interpreter ABI Platform
relayshield_mcp-0.2.8-py3-none-any.whl Python 3 none any Details

Total release size: 21.6 kB

Release files / relayshield_mcp-0.2.8.tar.gz

Download URL relayshield_mcp-0.2.8.tar.gz
Size 10.7 kB
Tags Source
SHA-256 checksum
How to use checksums
981318a17096c8fa39dc38644aaef761f0b11f289fb74b6e929eea41ca58ee97
BLAKE2b-256 checksum
How to use checksums
3c9eacb3270ad2394f8d6e877b67b79e89b4f1dd00a987614fd7c2da125aae36
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Aug 2, 2026.

Transparency log

Release files / relayshield_mcp-0.2.8-py3-none-any.whl

Download URL relayshield_mcp-0.2.8-py3-none-any.whl
Size 10.9 kB
Tags Python 3
SHA-256 checksum
How to use checksums
dbd27ea7401c18163386c0ed49f1d2c8e806dc9cf0317a8d355347bc1b182f7d
BLAKE2b-256 checksum
How to use checksums
45b891ea45dc73b31f7325fd1f51b775bf9c2bdeae28a1655272ae48ed1b4593
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Aug 2, 2026.

Transparency log

Release history Release notifications | RSS feed

0.3.0

2 release files

0.2.9

2 release files

This release

0.2.8 This release

2 release files

0.2.7

2 release files

0.2.6

2 release files

0.2.5

2 release files

0.2.4

2 release files

0.2.3

2 release files

0.2.2

2 release files

0.2.1

2 release files

0.2.0

2 release files

0.1.0

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page