RelayShield Security Intelligence

io.github.nzdsf2-gif由 GitHub 账号 nzdsf2-gif 发布v0.3.0更新于 Oct 24, 2026

Breach, SIM swap, infostealer, domain lookalikes, MCP registry risk, prompt-injection detection.

已验证STDIO仅桌面金融安全与监控

概览

AI 生成的概览

本地 MCP 服务器，为助手提供 RelayShield 安全情报查询：泄露、SIM 卡交换、信息窃取、仿冒域名、钱包、URL/文件与凭据暴露。

可以做什么
查询邮箱、OAuth 应用、会话和非人类凭据的泄露与信息窃取记录，以及公开仓库中的密钥和供应链厂商暴露。通过实时运营商数据检查 SIM 卡交换与 eSIM 状态。检测错拼和仿冒域名，并评估 MCP 注册表风险。用多个引擎扫描 URL 和文件的恶意软件，再轮询获取结论。检查 EVM 钱包链上风险及提示注入相关的泄露暴露。
适用场景
适合在信任某个身份、供应商、域名、MCP 服务器或代理权限之前进行核查，也适合排查可疑 URL、文件或钱包。面向安全与欺诈调查，而非日常任务。
运行要求
以 Python 包在本地运行（pip install 或 uvx）。需要 RELAYSHIELD_API_URL。访问需二选一：RELAYSHIELD_API_KEY 中的 RelayShield API 密钥（免费额度每月 100 次，付费方案每月 29 美元起），或 RELAYSHIELD_X_PAYMENT 中的 x402 支付凭证；只设其一。需要访问 RelayShield API 的网络。
安装前请注意
多数工具收费：按次付费以 Base 上的 USDC 计费（每次 0.05–0.50 美元），调用会花钱。RELAYSHIELD_X_PAYMENT 中的支付凭证和 RELAYSHIELD_API_KEY 中的密钥均为机密。查询会把邮箱、电话号码、域名、URL、文件和钱包地址发送给第三方 API。URL 与文件扫描为异步并需轮询。

安装

在 SourceWeft 中

  1. 打开 控制台中的 RelayShield Security Intelligence，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

relayshield-mcp

mcp-name: io.github.nzdsf2-gif/relayshield-mcp

RelayShield security intelligence as an MCP server — plug breach detection, SIM swap detection, domain lookalike monitoring, OAuth supply chain watchlist, and URL/file scanning directly into Claude and any MCP-compatible AI agent.

Tools

ToolWhat it doesPAYG price
check_breachEmail breach lookup — 13 billion+ records via HIBP$0.10 USDC
check_sim_swapSIM swap / eSIM detection via live carrier data$0.25 USDC
check_domain_lookalikesTyposquat and lookalike domain detection with cert transparency$0.50 USDC
check_oauth_watchlistOAuth-app breach + stolen-token exposure via HIBP + stealer-log corpus$0.30 USDC
check_infostealerInfostealer malware log lookup via Hudson Rock Cavalier$0.15 USDC
scan_walletEVM wallet on-chain risk check via GoPlus Security$0.10 USDC
scan_urlURL malware/phishing scan across 70+ engines (async)$0.05 USDC
scan_fileBinary malware scan across 70+ AV engines (async)$0.10 USDC
check_scan_resultPoll for verdict after scan_url / scan_filefree
check_mcp_registry_riskTyposquat/IOC/registration-age check for MCP servers$0.35 USDC
check_prompt_injection_breachBreach exposure sourced from AI-agent prompt-injection attacks$0.35 USDC
check_supply_chainUp to 10 vendor domains checked for breach/infostealer exposure$0.10 USDC
check_session_riskActive/reusable stolen session (cookie/token) exposure check$0.30 USDC
check_nhi_exposureNon-human-identity credential exposure — API keys, service tokens, PATs$0.40 USDC
check_secret_scanSecrets exposed in public GitHub repositories$0.35 USDC

check_oauth_watchlist, check_supply_chain, check_session_risk, check_nhi_exposure, and check_secret_scan cover related ground — connected-app, session, and machine-credential exposure for an identity or its supply chain — and are a natural set to use together when vetting an agent's current authority, not just a login.

Access modes

Subscription — API key from api.relayshield.net/developers. All 15 tools available. Free tier: 100 calls/month. Paid tiers from $29/month.

Pay-as-you-go — No API key needed. Pay per check in USDC on Base (x402 protocol). Set RELAYSHIELD_X_PAYMENT with your payment proof. All 15 tools available ($0.05–$0.50/check, check_scan_result free). Call a tool with no payment set to receive pricing and payment instructions.

Discovery — Set neither key nor payment. Tool calls return payment requirements and a subscription link.

Install

bash
pip install relayshield-mcp

Or run without installing:

bash
uvx relayshield-mcp

Configure Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

Subscription (RelayShield API key):

json
{  "mcpServers": {    "relayshield": {      "command": "relayshield-mcp",      "env": {        "RELAYSHIELD_API_URL": "https://api.relayshield.net",        "RELAYSHIELD_API_KEY": "your-relayshield-api-key-here"      }    }  }}

Pay-as-you-go (x402 USDC on Base):

json
{  "mcpServers": {    "relayshield": {      "command": "relayshield-mcp",      "env": {        "RELAYSHIELD_API_URL": "https://api.relayshield.net",        "RELAYSHIELD_X_PAYMENT": "your-x402-payment-proof-here"      }    }  }}

Quit and relaunch Claude Desktop after editing.

Configure Claude Code (CLI)

bash
claude mcp add relayshield \  --command relayshield-mcp \  --env RELAYSHIELD_API_URL=https://api.relayshield.net \  --env RELAYSHIELD_API_KEY=your-relayshield-api-key-here

Usage examples

Once configured, ask Claude:

Check whether [email protected] has been breached.
Has there been a SIM swap on +14155551234?
Check acme.com for lookalike domains.
Are any OAuth apps connected to [email protected] in a recent breach?
Scan this URL for malware: https://suspicious-link.example.com

For URL and file scans, Claude automatically polls check_scan_result every 5 seconds until the verdict is ready.

Environment variables

VariableDescription
RELAYSHIELD_API_URLAPI Gateway base URL (required)
RELAYSHIELD_API_KEYRelayShield subscription key (subscription mode) — get one at api.relayshield.net/developers
RELAYSHIELD_X_PAYMENTx402 payment proof — USDC on Base (pay-as-you-go mode)

Set RELAYSHIELD_API_KEY or RELAYSHIELD_X_PAYMENT — not both. API key takes priority if both are set.

Links

来源：README.md，提交 85a11ac

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

2
  1. v0.3.0最新Sep 27, 2026
  2. v0.2.12Sep 16, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。