← Back to search

@onrelay/mcp

alimkhann Scanned 1d ago

Relay MCP server for local AI coding tools

npm ↗
D
40 / 100

Versions

0.8.0latest
Jun 10, 2026
0.7.0
May 18, 2026
0.6.1
May 16, 2026
0.6.0
May 15, 2026
0.5.2
May 9, 2026
+ show 19 moreshow less
0.5.1
May 6, 2026
0.5.0
May 2, 2026
0.4.4
Apr 30, 2026
0.4.3
Apr 29, 2026
0.4.2
Apr 23, 2026
0.4.1
Apr 22, 2026
0.4.0
Apr 20, 2026
0.3.5
Apr 19, 2026
0.3.4
Apr 19, 2026
0.3.3
Apr 19, 2026
0.3.2
Apr 15, 2026
0.3.1
Apr 15, 2026
0.3.0
Apr 12, 2026
0.2.3
Apr 11, 2026
0.2.2
Apr 10, 2026
0.2.1
Mar 28, 2026
0.2.0
Mar 23, 2026
0.1.1
Mar 22, 2026
0.1.0
Mar 20, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 3

sources
annotations: verified low

readOnlyHint true destructiveHint false
list_projects
annotations: none low

List all Relay projects you have access to. Returns project IDs, names, slugs, routing keywords, and which project is currently active for this MCP session. Do not call this before the first get_brief unless Relay explicitly reports project ambiguity or resolves to the wrong project.

projectId string
set_current_project
annotations: none low

Switch the current Relay project for this MCP session. Use this when the user is clearly working on a different project than the cached/auto-detected one. The switch persists for the lifetime of the MCP server process. Call list_projects first to find the correct projectId. Personal memory is a kind=

projectId string

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 63

medium
Vulnerable dependency: next@16.1.6 (GHSA-68g3-v927-f742) dependency_analyzer · 95%
info
Tool 'sources' annotations are consistent annotation_checker · 80%
low
Tool 'list_projects' has no annotations annotation_checker · 100%
low
Tool 'set_current_project' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in alimkhann-Relay-cbd67fd/apps/web/src/app/api/auth/google/start/route.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 91 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-markdown dependency_analyzer · 60%
medium
Vulnerable dependency: playwright@1.55.0 (GHSA-7mvr-c777-76hp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.2.4 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.2.4 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-267c-6grr-h53f) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-26hh-7cqf-hhc6) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-2xp9-vwfh-vxw4) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-36qx-fr4f-26g5) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-3g8h-86w9-wvmq) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-3x4c-7xq6-9pq8) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-4633-3j49-mh5q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-492v-c6pp-mqqv) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-4c39-4ccg-62r3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-6gpp-xcg3-4w24) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-89xv-2m56-2m9x) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-8h8q-6873-q5fj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-955p-x3mx-jcvp) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-c4j6-fc7j-m34r) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-ffhc-5mcf-pf4q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-ggv3-7p47-pfv8) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-gx5p-jg67-6x7h) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-h27x-g6w4-24gq) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-h64f-5h5j-jqjh) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-jcc7-9wpm-mj36) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-m99w-x7hq-7vfj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-mg66-mrh9-m8jx) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-mq59-m269-xvcx) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-p293-qw3h-jr36) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-p9j2-gv94-2wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-q4gf-8mx6-v5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-q8wf-6r8g-63ch) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-vfv6-92ff-j949) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-wfc6-r584-vfw7) dependency_analyzer · 95%
medium
Vulnerable dependency: xlsx@0.18.5 (GHSA-4r6h-8v6p-xvw6) dependency_analyzer · 95%
medium
Vulnerable dependency: xlsx@0.18.5 (GHSA-5pgg-2g8v-p4x9) dependency_analyzer · 95%
medium
Vulnerable dependency: wrangler@3.78.0 (GHSA-36p8-mvp6-cv38) dependency_analyzer · 95%
medium
Buffer.from base64 in alimkhann-Relay-cbd67fd/apps/web/src/lib/auth/local-session.ts:41 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: sources manifest_parser · 85%
info
Tool: list_projects manifest_parser · 70%
info
Tool: set_current_project manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (131) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'list_projects': Cross-tool sequencing directive poisoning · 85%
info
SBOM generated: 102 components sbom_generator · 100%
critical
Database URL with Password found in alimkhann-Relay-cbd67fd/docs/memory-v2/HANDOFF.md secret_scanner · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%