← Back to search

@relay-org/relay-mcp

GitHub Actions Scanned 13d ago

Model Context Protocol server for Relay — deploy, inspect, and control apps from any MCP-aware AI tool

C
63.9 / 100

Versions

0.1.105latest
Jul 14, 2026
0.1.104
Jul 14, 2026
0.1.103
Jul 14, 2026
0.1.101
Jun 26, 2026
0.1.100
Jun 18, 2026
+ show 22 moreshow less
0.1.99
Jun 17, 2026
0.1.97
Jun 10, 2026
0.1.95
Jun 9, 2026
0.1.94
Jun 9, 2026
0.1.93
Jun 9, 2026
0.1.92
Jun 9, 2026
0.1.91
Jun 9, 2026
0.1.90
Jun 3, 2026
0.1.89
Jun 1, 2026
0.1.88
May 19, 2026
0.1.87
May 19, 2026
0.1.86
May 19, 2026
0.1.85
May 19, 2026
0.1.84
May 18, 2026
0.1.83
May 8, 2026
0.1.82
May 8, 2026
0.1.79
May 1, 2026
0.1.78
Apr 28, 2026
0.1.77
Apr 28, 2026
0.1.76
Apr 26, 2026
0.1.75
Apr 26, 2026
0.1.0
Apr 11, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 27

list_projects
annotations: none low

List all projects and their environments known to the Relay agent.

list_deploys
annotations: none low

List recent deploys. Filter by app, env, and/or branch. Returns build numbers, statuses, deployed_by, commit messages, and timestamps.

app string env string limit number branch string
get_deploy
annotations: none low

Get a single deploy record by ID including status, logs reference, image tag, and commit info.

id string
get_deploy_logs
annotations: none low

Fetch the stored build and deploy logs for a given deploy ID.

id string
cancel_deploy
annotations: none low

Cancel an in-progress deploy by ID.

id string
rollback
annotations: none low

Roll back the most recent deploy to the previous image for an app/env/branch.

app string env string branch string
start_app
annotations: none low

Start a stopped app container without triggering a new build.

app string env string branch string host_port number expires_at number public_host string ip_allowlist string service_port number webhook_secret string
stop_app
annotations: none low

Stop a running app container.

app string env string branch string host_port number expires_at number public_host string ip_allowlist string service_port number webhook_secret string
restart_app
annotations: none low

Restart a running app container in place without a new build.

app string env string branch string host_port number expires_at number public_host string ip_allowlist string service_port number webhook_secret string
delete_lane
annotations: none low

Delete a lane and remove its container, workspace, and state from the agent.

app string env string branch string host_port number expires_at number public_host string ip_allowlist string service_port number webhook_secret string
get_app_config
annotations: none low

Get the current lane configuration for an app including access_policy, public_host, engine, host_port, service_port, and rollout settings.

app string env string branch string host_port number expires_at number public_host string ip_allowlist string service_port number webhook_secret string
set_app_config
annotations: none low

Update lane configuration for an app. Only supply the fields you want to change.

app string env string branch string host_port number expires_at number public_host string ip_allowlist string service_port number webhook_secret string
list_secrets
annotations: none low

List secret key names (not values) for an app/env/branch.

app string env string key string value string branch string
add_secret
annotations: none low

Add or update a secret value for an app/env/branch. The value is encrypted at rest if RELAY_SECRET_KEY is configured on the agent.

app string env string key string value string branch string
remove_secret
annotations: none low

Delete a secret by key for an app/env/branch.

app string env string key string branch string
list_promotions
annotations: none low

List promotion requests. Shows source/target lane, image, approval state, and post-promote health status.

app string status string
approve_promotion
annotations: none low

Approve a queued promotion request by ID. Requires owner role.

id string
list_users
annotations: none low

List all user accounts with their roles. Requires owner role.

get_audit_log
annotations: none low

Fetch recent audit log entries showing actor, action, target, and timestamp. Requires owner role.

limit number
get_server_config
annotations: none low

Get server-level config: base_domain, dashboard_host, ACME settings, and active theme. Requires owner role.

set_server_config
annotations: none low

Update server-level config. Supply only the fields to change. Requires owner role.

theme_css string theme_name string base_domain string acme_disabled boolean dashboard_host string
list_buildpack_plugins
annotations: none low

List installed buildpack plugins on the agent.

remove_buildpack_plugin
annotations: none low

Remove an installed buildpack plugin by name. Requires RELAY_ENABLE_PLUGIN_MUTATIONS=true on the agent.

name string
get_version
annotations: none low

Get relayd build metadata and Station runtime version details.

create_signed_link
annotations: none low

Generate a time-bounded signed share URL for a lane that uses access_policy=signed-link.

app string env string branch string expires_in number
list_companions
annotations: none low

List managed companion services (databases, caches, etc.) attached to an app lane.

app string env string name string branch string
restart_companion
annotations: none low

Restart a named companion service in place.

app string env string name string branch string

Permissions 4

network medium
Server uses network capabilities via: fetch(), http, https
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, os, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 144

low
Tool 'list_projects' has no annotations annotation_checker · 100%
low
Tool 'list_deploys' has no annotations annotation_checker · 100%
low
Tool 'get_deploy' has no annotations annotation_checker · 100%
low
Tool 'get_deploy_logs' has no annotations annotation_checker · 100%
low
Tool 'cancel_deploy' has no annotations annotation_checker · 100%
low
Tool 'rollback' has no annotations annotation_checker · 100%
low
Tool 'start_app' has no annotations annotation_checker · 100%
low
Tool 'stop_app' has no annotations annotation_checker · 100%
medium
Excessive dependency count: 57 direct dependencies dependency_analyzer · 90%
low
Tool 'restart_app' has no annotations annotation_checker · 100%
low
Tool 'delete_lane' has no annotations annotation_checker · 100%
low
Tool 'get_app_config' has no annotations annotation_checker · 100%
low
Tool 'set_app_config' has no annotations annotation_checker · 100%
low
Tool 'list_secrets' has no annotations annotation_checker · 100%
low
Tool 'add_secret' has no annotations annotation_checker · 100%
low
Tool 'remove_secret' has no annotations annotation_checker · 100%
low
Tool 'list_promotions' has no annotations annotation_checker · 100%
low
Tool 'approve_promotion' has no annotations annotation_checker · 100%
low
Tool 'list_users' has no annotations annotation_checker · 100%
low
Tool 'get_audit_log' has no annotations annotation_checker · 100%
low
Tool 'get_server_config' has no annotations annotation_checker · 100%
low
Tool 'set_server_config' has no annotations annotation_checker · 100%
low
Tool 'list_buildpack_plugins' has no annotations annotation_checker · 100%
low
Tool 'remove_buildpack_plugin' has no annotations annotation_checker · 100%
low
Tool 'get_version' has no annotations annotation_checker · 100%
low
Tool 'create_signed_link' has no annotations annotation_checker · 100%
low
Tool 'list_companions' has no annotations annotation_checker · 100%
low
Tool 'restart_companion' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.10.2 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.10.2 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.10.2 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.9 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.9 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.9 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.9 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.9 (GHSA-v2wj-q39q-566r) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.9 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-2pvr-wf23-7pc7) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-4g3v-8h47-v7g6) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-5ff5-9fcw-vg88) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-7pw4-f3q4-r2p2) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-8hv8-536x-4wqp) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-cq8c-xv66-36gw) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-f48w-9m4c-m7f5) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-fvmw-cj7j-j39q) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-g735-7g2w-hh3f) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-ggxq-hp9w-j794) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-hr2q-hp5q-x767) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-j687-52p2-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-jrpj-wcv7-9fh9) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-w2vj-39qv-7vh7) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-whqg-ppgf-wp8c) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-wrwg-2hg8-v723) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-x3h8-62x9-952g) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-xf8x-j4p2-f749) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@5.3.0 (GHSA-xr5h-phrj-8vxv) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-267c-6grr-h53f) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-26hh-7cqf-hhc6) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-36qx-fr4f-26g5) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-3g8h-86w9-wvmq) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-3x4c-7xq6-9pq8) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-4633-3j49-mh5q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-492v-c6pp-mqqv) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-4c39-4ccg-62r3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-68g3-v927-f742) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-6gpp-xcg3-4w24) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-89xv-2m56-2m9x) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-8h8q-6873-q5fj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-955p-x3mx-jcvp) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-c4j6-fc7j-m34r) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-ffhc-5mcf-pf4q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-ggv3-7p47-pfv8) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-gx5p-jg67-6x7h) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-h27x-g6w4-24gq) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-h64f-5h5j-jqjh) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-jcc7-9wpm-mj36) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-m99w-x7hq-7vfj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-mg66-mrh9-m8jx) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-mq59-m269-xvcx) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-p9j2-gv94-2wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-q4gf-8mx6-v5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-q8wf-6r8g-63ch) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-vfv6-92ff-j949) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.1.6 (GHSA-wfc6-r584-vfw7) dependency_analyzer · 95%
medium
Vulnerable dependency: flask@3.1.0 (GHSA-4grg-w6v8-c28g) dependency_analyzer · 95%
medium
Vulnerable dependency: flask@3.1.0 (GHSA-68rp-wp8r-4726) dependency_analyzer · 95%
medium
Vulnerable dependency: flask@3.1.0 (PYSEC-2026-1377) dependency_analyzer · 95%
medium
Vulnerable dependency: flask@3.1.0 (PYSEC-2026-2151) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/sys@0.33.0 (GO-2026-5024) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GHSA-44p7-9xx4-hf2g) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GHSA-q675-qj96-32m9) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-4815) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-4961) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-4962) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5031) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5032) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5061) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5062) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5066) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-6222) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/text@0.24.0 (GO-2026-5970) dependency_analyzer · 95%
medium
Vulnerable dependency: github.com/klauspost/compress@1.17.6 (GO-2026-5841) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/sys@0.16.0 (GO-2026-5024) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/text@0.29.0 (GO-2026-5970) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: list_projects manifest_parser · 70%
info
Tool: list_deploys manifest_parser · 70%
info
Tool: get_deploy manifest_parser · 70%
info
Tool: get_deploy_logs manifest_parser · 70%
info
Tool: cancel_deploy manifest_parser · 70%
info
Tool: rollback manifest_parser · 70%
info
Tool: start_app manifest_parser · 70%
info
Tool: stop_app manifest_parser · 70%
info
Tool: restart_app manifest_parser · 70%
info
Tool: delete_lane manifest_parser · 70%
info
Tool: get_app_config manifest_parser · 70%
info
Tool: set_app_config manifest_parser · 70%
info
Tool: list_secrets manifest_parser · 70%
info
Tool: add_secret manifest_parser · 70%
info
Tool: remove_secret manifest_parser · 70%
info
Tool: list_promotions manifest_parser · 70%
info
Tool: approve_promotion manifest_parser · 70%
info
Tool: list_users manifest_parser · 70%
info
Tool: get_audit_log manifest_parser · 70%
info
Tool: get_server_config manifest_parser · 70%
info
Tool: set_server_config manifest_parser · 70%
info
Tool: list_buildpack_plugins manifest_parser · 70%
info
Tool: remove_buildpack_plugin manifest_parser · 70%
info
Tool: get_version manifest_parser · 70%
info
Tool: create_signed_link manifest_parser · 70%
info
Tool: list_companions manifest_parser · 70%
info
Tool: restart_companion manifest_parser · 70%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (60) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 841 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%