Security

Relay uses OAuth 2.1 authorization-code flow with PKCE for public agent clients. Access tokens are audience-bound to the Relay MCP resource, limited by explicit scopes, and short-lived. Relay rechecks the backing account session and selected organization membership on every MCP request.

Public skill packages are exported only from immutable published versions. Archives are deterministic and identified by a SHA-256 digest of the actual ZIP bytes. Distribution metadata, license evidence, static security findings, qualification state, and tool requirements stay separate from the skill instructions.

Relay uses encrypted transport, scoped database access, private storage for user files, server-side secrets, audit records, rate limits, and provider-specific authorization. Production changes are qualified before release and verified on their deployed runtime.

Please use the private contact channel below. Include the affected URL or package, reproduction steps, impact, and a safe way to reach you. Do not access other users’ data, degrade service, or publicly disclose an unresolved issue. We will acknowledge and triage good-faith reports as promptly as practical.