RelayShield Security Intelligence

io.github.nzdsf2-gifPublished by GitHub account nzdsf2-gifv0.3.0Updated Oct 24, 2026

Breach, SIM swap, infostealer, domain lookalikes, MCP registry risk, prompt-injection detection.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that gives an assistant RelayShield security checks: breach, SIM swap, infostealer, lookalike domain, wallet, URL/file and credential exposure.

What you can do
Look up breach and infostealer exposure for emails, OAuth apps, sessions and non-human credentials, plus secrets in public repositories and supply-chain vendors. Check SIM swap and eSIM status through live carrier data. Detect typosquat and lookalike domains and assess MCP registry risk. Scan URLs and files for malware across many engines, then poll for the verdict. Check EVM wallet on-chain risk and prompt-injection-related breach exposure.
When to use it
Useful when vetting an identity, vendor, domain, MCP server or agent authority before trusting it, or when triaging a suspicious URL, file or wallet. Suited to security and fraud investigations rather than everyday tasks.
Requirements
Runs locally as a Python package (pip install or uvx). Requires RELAYSHIELD_API_URL. Access needs either a RelayShield API key in RELAYSHIELD_API_KEY (free tier 100 calls/month, paid tiers from $29/month) or an x402 payment proof in RELAYSHIELD_X_PAYMENT; set one, not both. Network access to the RelayShield API.
Before you install
Most tools are paid: pay-as-you-go charges USDC on Base per check ($0.05–$0.50), so calls spend money. The payment proof in RELAYSHIELD_X_PAYMENT and the API key in RELAYSHIELD_API_KEY are secrets. Queries send emails, phone numbers, domains, URLs, files and wallet addresses to a third-party API. URL and file scans are asynchronous and polled.

Installation

In SourceWeft

  1. Open RelayShield Security Intelligence in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

relayshield-mcp

mcp-name: io.github.nzdsf2-gif/relayshield-mcp

RelayShield security intelligence as an MCP server — plug breach detection, SIM swap detection, domain lookalike monitoring, OAuth supply chain watchlist, and URL/file scanning directly into Claude and any MCP-compatible AI agent.

Tools

ToolWhat it doesPAYG price
check_breachEmail breach lookup — 13 billion+ records via HIBP$0.10 USDC
check_sim_swapSIM swap / eSIM detection via live carrier data$0.25 USDC
check_domain_lookalikesTyposquat and lookalike domain detection with cert transparency$0.50 USDC
check_oauth_watchlistOAuth-app breach + stolen-token exposure via HIBP + stealer-log corpus$0.30 USDC
check_infostealerInfostealer malware log lookup via Hudson Rock Cavalier$0.15 USDC
scan_walletEVM wallet on-chain risk check via GoPlus Security$0.10 USDC
scan_urlURL malware/phishing scan across 70+ engines (async)$0.05 USDC
scan_fileBinary malware scan across 70+ AV engines (async)$0.10 USDC
check_scan_resultPoll for verdict after scan_url / scan_filefree
check_mcp_registry_riskTyposquat/IOC/registration-age check for MCP servers$0.35 USDC
check_prompt_injection_breachBreach exposure sourced from AI-agent prompt-injection attacks$0.35 USDC
check_supply_chainUp to 10 vendor domains checked for breach/infostealer exposure$0.10 USDC
check_session_riskActive/reusable stolen session (cookie/token) exposure check$0.30 USDC
check_nhi_exposureNon-human-identity credential exposure — API keys, service tokens, PATs$0.40 USDC
check_secret_scanSecrets exposed in public GitHub repositories$0.35 USDC

check_oauth_watchlist, check_supply_chain, check_session_risk, check_nhi_exposure, and check_secret_scan cover related ground — connected-app, session, and machine-credential exposure for an identity or its supply chain — and are a natural set to use together when vetting an agent's current authority, not just a login.

Access modes

Subscription — API key from api.relayshield.net/developers. All 15 tools available. Free tier: 100 calls/month. Paid tiers from $29/month.

Pay-as-you-go — No API key needed. Pay per check in USDC on Base (x402 protocol). Set RELAYSHIELD_X_PAYMENT with your payment proof. All 15 tools available ($0.05–$0.50/check, check_scan_result free). Call a tool with no payment set to receive pricing and payment instructions.

Discovery — Set neither key nor payment. Tool calls return payment requirements and a subscription link.

Install

bash
pip install relayshield-mcp

Or run without installing:

bash
uvx relayshield-mcp

Configure Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

Subscription (RelayShield API key):

json
{  "mcpServers": {    "relayshield": {      "command": "relayshield-mcp",      "env": {        "RELAYSHIELD_API_URL": "https://api.relayshield.net",        "RELAYSHIELD_API_KEY": "your-relayshield-api-key-here"      }    }  }}

Pay-as-you-go (x402 USDC on Base):

json
{  "mcpServers": {    "relayshield": {      "command": "relayshield-mcp",      "env": {        "RELAYSHIELD_API_URL": "https://api.relayshield.net",        "RELAYSHIELD_X_PAYMENT": "your-x402-payment-proof-here"      }    }  }}

Quit and relaunch Claude Desktop after editing.

Configure Claude Code (CLI)

bash
claude mcp add relayshield \  --command relayshield-mcp \  --env RELAYSHIELD_API_URL=https://api.relayshield.net \  --env RELAYSHIELD_API_KEY=your-relayshield-api-key-here

Usage examples

Once configured, ask Claude:

Check whether [email protected] has been breached.
Has there been a SIM swap on +14155551234?
Check acme.com for lookalike domains.
Are any OAuth apps connected to [email protected] in a recent breach?
Scan this URL for malware: https://suspicious-link.example.com

For URL and file scans, Claude automatically polls check_scan_result every 5 seconds until the verdict is ready.

Environment variables

VariableDescription
RELAYSHIELD_API_URLAPI Gateway base URL (required)
RELAYSHIELD_API_KEYRelayShield subscription key (subscription mode) — get one at api.relayshield.net/developers
RELAYSHIELD_X_PAYMENTx402 payment proof — USDC on Base (pay-as-you-go mode)

Set RELAYSHIELD_API_KEY or RELAYSHIELD_X_PAYMENT — not both. API key takes priority if both are set.

Links

Source: README.md at commit 85a11ac

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.3.0LatestSep 27, 2026
  2. v0.2.12Sep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.