{
  "markdown": "# relayshield-mcp\n\n<!-- mcp-name: io.github.nzdsf2-gif/relayshield-mcp -->\n\n`mcp-name: io.github.nzdsf2-gif/relayshield-mcp`\n\n[RelayShield](https://relayshield.net) security intelligence as an MCP server — plug breach detection, SIM swap detection, domain lookalike monitoring, OAuth supply chain watchlist, and URL/file scanning directly into Claude and any MCP-compatible AI agent.\n\n## Tools\n\n| Tool | What it does | PAYG price |\n|---|---|---|\n| `check_breach` | Email breach lookup — 13 billion+ records via HIBP | $0.10 USDC |\n| `check_sim_swap` | SIM swap / eSIM detection via live carrier data | $0.25 USDC |\n| `check_domain_lookalikes` | Typosquat and lookalike domain detection with cert transparency | $0.50 USDC |\n| `check_oauth_watchlist` | OAuth-app breach + stolen-token exposure via HIBP + stealer-log corpus | $0.30 USDC |\n| `check_infostealer` | Infostealer malware log lookup via Hudson Rock Cavalier | $0.15 USDC |\n| `scan_wallet` | EVM wallet on-chain risk check via GoPlus Security | $0.10 USDC |\n| `scan_url` | URL malware/phishing scan across 70+ engines (async) | $0.05 USDC |\n| `scan_file` | Binary malware scan across 70+ AV engines (async) | $0.10 USDC |\n| `check_scan_result` | Poll for verdict after `scan_url` / `scan_file` | free |\n| `check_mcp_registry_risk` | Typosquat/IOC/registration-age check for MCP servers | $0.35 USDC |\n| `check_prompt_injection_breach` | Breach exposure sourced from AI-agent prompt-injection attacks | $0.35 USDC |\n| `check_supply_chain` | Up to 10 vendor domains checked for breach/infostealer exposure | $0.10 USDC |\n| `check_session_risk` | Active/reusable stolen session (cookie/token) exposure check | $0.30 USDC |\n| `check_nhi_exposure` | Non-human-identity credential exposure — API keys, service tokens, PATs | $0.40 USDC |\n| `check_secret_scan` | Secrets exposed in public GitHub repositories | $0.35 USDC |\n\n`check_oauth_watchlist`, `check_supply_chain`, `check_session_risk`, `check_nhi_exposure`, and\n`check_secret_scan` cover related ground — connected-app, session, and machine-credential exposure\nfor an identity or its supply chain — and are a natural set to use together when vetting an agent's\ncurrent authority, not just a login.\n\n## Access modes\n\n**Subscription** — API key from [api.relayshield.net/developers](https://api.relayshield.net/developers). All 15 tools available. Free tier: 100 calls/month. Paid tiers from $29/month.\n\n**Pay-as-you-go** — No API key needed. Pay per check in USDC on Base (x402 protocol). Set `RELAYSHIELD_X_PAYMENT` with your payment proof. All 15 tools available ($0.05–$0.50/check, `check_scan_result` free). Call a tool with no payment set to receive pricing and payment instructions.\n\n**Discovery** — Set neither key nor payment. Tool calls return payment requirements and a subscription link.\n\n## Install\n\n```bash\npip install relayshield-mcp\n```\n\nOr run without installing:\n\n```bash\nuvx relayshield-mcp\n```\n\n## Configure Claude Desktop\n\nEdit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n**Subscription (RelayShield API key):**\n```json\n{\n  \"mcpServers\": {\n    \"relayshield\": {\n      \"command\": \"relayshield-mcp\",\n      \"env\": {\n        \"RELAYSHIELD_API_URL\": \"https://api.relayshield.net\",\n        \"RELAYSHIELD_API_KEY\": \"your-relayshield-api-key-here\"\n      }\n    }\n  }\n}\n```\n\n**Pay-as-you-go (x402 USDC on Base):**\n```json\n{\n  \"mcpServers\": {\n    \"relayshield\": {\n      \"command\": \"relayshield-mcp\",\n      \"env\": {\n        \"RELAYSHIELD_API_URL\": \"https://api.relayshield.net\",\n        \"RELAYSHIELD_X_PAYMENT\": \"your-x402-payment-proof-here\"\n      }\n    }\n  }\n}\n```\n\nQuit and relaunch Claude Desktop after editing.\n\n## Configure Claude Code (CLI)\n\n```bash\nclaude mcp add relayshield \\\n  --command relayshield-mcp \\\n  --env RELAYSHIELD_API_URL=https://api.relayshield.net \\\n  --env RELAYSHIELD_API_KEY=your-relayshield-api-key-here\n```\n\n## Usage examples\n\nOnce configured, ask Claude:\n\n```\nCheck whether user@example.com has been breached.\n```\n\n```\nHas there been a SIM swap on +14155551234?\n```\n\n```\nCheck acme.com for lookalike domains.\n```\n\n```\nAre any OAuth apps connected to user@example.com in a recent breach?\n```\n\n```\nScan this URL for malware: https://suspicious-link.example.com\n```\n\nFor URL and file scans, Claude automatically polls `check_scan_result` every 5 seconds until the verdict is ready.\n\n## Environment variables\n\n| Variable | Description |\n|---|---|\n| `RELAYSHIELD_API_URL` | API Gateway base URL (required) |\n| `RELAYSHIELD_API_KEY` | RelayShield subscription key (subscription mode) — get one at [api.relayshield.net/developers](https://api.relayshield.net/developers) |\n| `RELAYSHIELD_X_PAYMENT` | x402 payment proof — USDC on Base (pay-as-you-go mode) |\n\nSet `RELAYSHIELD_API_KEY` **or** `RELAYSHIELD_X_PAYMENT` — not both. API key takes priority if both are set.\n\n## Links\n\n- [Landing page](https://relayshield.net)\n- [Get an API key](https://api.relayshield.net/developers)\n- [GitHub](https://github.com/relayshield/relayshield-mcp)\n",
  "bytes": 5066,
  "sha": "3080b2a5cc3f2c0b40ebab5d2609982819e2f77d3bfdbf071c4c52836f135174",
  "repo_slug": "relayshield/relayshield-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_nzdsf2_gif_relayshield_mcp_c5ab9a56/readme"
}