relayBLOCK
MCP server with 40 tools for AI agents. Memory, web fetch, search, file ops, screenshots, and multi-agent coordination in one Go binary.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
One MCP server for files, images, PDFs, web, and workflows. Your files stay local. No telemetry. No account. No cloud.
Run it with npx userelay.
[](https://github.com/valtors/relay/actions/workflows/ci.yml) [](https://www.npmjs.com/package/userelay) [](LICENSE) [](https://github.com/valtors/relay/stargazers) [](https://www.npmjs.com/package/userelay) [](https://github.com/valtors/relay/graphs/contributors) [](https://github.com/valtors/relay)
Try it
npx userelay
That opens the setup wizard, downloads the right binary, and configures your editor. No install needed.
If you already have it:
npx userelay- launch the TUI menunpx userelay init- reconfigure your editornpx userelay status- check version and toolsnpx userelay --help- see all commands
How does relay compare?
See the full comparison against standalone MCP servers.
Why Relay?
Every MCP server does one thing. File server. I
fd107b5e7041OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add userelay --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} -- npx -y [email protected]Exposed tools (40)
32 read · 8 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
approval | read | Human checkpoint between phases |
assemble_plan | read | Assemble final plan from phases |
data_csv_to_json | read | Convert CSV to JSON array |
data_json_format | read | Format/pretty-print JSON |
data_json_query | read | Query JSON with JMESPath |
data_json_to_csv | read | Convert JSON array to CSV |
file_hash | read | Compute SHA-256 hash of a file |
file_list | read | List files in a directory |
file_read | read | Read file contents as text |
file_size | read | Get file size in bytes |
file_unzip | read | Extract files from a zip archive |
file_write | write | Write text to a file |
file_zip | write | Create a zip archive from files |
image_convert | read | Convert image format (png, jpg, webp) |
image_crop | read | Crop an image to a region |
image_flip | read | Flip image horizontally or vertically |
image_grayscale | read | Convert image to grayscale |
image_info | read | Get image dimensions, format, size |
image_resize | read | Resize an image to target dimensions |
image_rotate | read | Rotate an image by degrees |
pdf_extract_pages | read | Extract specific pages as new PDF |
pdf_extract_text | read | Extract text from PDF pages |
pdf_info | read | Get PDF metadata and page count |
pdf_merge | write | Merge multiple PDFs into one |
pdf_page_count | read | Count pages in a PDF |
pdf_split | read | Split a PDF into individual pages |
pm_plan | read | Phase 1: PM planning |
run_brand | write | Phase 3: Brand |
run_gtm | write | Phase 5: Go-to-market |
run_research | write | Phase 2: Research |
run_ux | write | Phase 4: UX |
run_workflow | write | Execute a full 5-phase workflow |
text_base64_decode | read | Decode base64 to text |
text_base64_encode | read | Encode text to base64 |
text_extract_regex | read | Extract matches using regex |
text_md_to_html | read | Convert markdown to HTML |
text_replace | read | Find and replace text |
text_word_count | read | Count words, lines, characters |
web_fetch | read | Fetch a URL and return content |
web_status | read | Check HTTP status code of a URL |
Trust audit
BLOCKgrade D · trust 68/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (23)
blocked := []string{"169.254.169.254", "metadata.google.internal", "metadata.aws.internal"}echo "Installing to $INSTALL_DIR (requires sudo)..."
sudo mv "$TMP/relay" "$INSTALL_DIR/relay"
t.Setenv("ANTHROPIC_API_KEY", "sk-ant-test-invalid-on-purpose").all-contributorsrc
.golangci.yml
.goreleaser.yml
.nojekyll
result := callTool(t, FileRead, map[string]any{"path": "../../../etc/passwd"})result := callTool(t, WebFetch, map[string]any{"url": "http://169.254.169.254/latest/meta-data/"})result := callTool(t, WebFetch, map[string]any{"url": "http://127.0.0.1:9999"})result := callTool(t, WebFetch, map[string]any{"url": "http://169.254.169.254/latest/meta-data/"})result := callTool(t, WebFetch, map[string]any{"url": "http://10.0.0.1/"})ink, react, htm, ink-select-input, unicode-animations, cfonts, gradient-string
ink, react, htm, ink-select-input, unicode-animations, cfonts, gradient-string
assets/images/comparison-section.png
assets/images/comparison.png
assets/images/connected.png
assets/images/doodles/arrow.png
assets/images/og-image.png
- Unauthorized access to local files, secrets, or environment variables
curl -fsSL https://raw.githubusercontent.com/valtors/relay/main/scripts/install.sh | sh
system use found in code, not declared in the description
Gates applied: no_behavioural_pass.
fd107b5e7041full audit observations/trust-audit/mcp-server/valtors__relay.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | fd107b5e7041 | BLOCK | D | 68 | first audit |
Questions
What is the relay MCP server?
MCP server with 40 tools for AI agents. Memory, web fetch, search, file ops, screenshots, and multi-agent coordination in one Go binary.
What tools does relay expose?
40 in total: 32 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is relay safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (68/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does relay need?
It reads ANTHROPIC_API_KEY, GH_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does relay run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as userelay-tui at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (fd107b5e7041), read on 2026-10-10. The repository is watched and re-audited when it changes.