Content
# Relay
Agent firewall for AI coding teams.
Relay intercepts AI agent tool calls, terminal commands, API actions, and MCP-style requests before execution - helping teams block dangerous actions, secret exposure, and prompt-injection-driven tool misuse.
[Book a security review →](https://calendar.app.google/hKLUrjYhtijdPeobA)
[](LICENSE)
[](https://www.npmjs.com/package/@relaysecurity-dev/relay-ai)
[](https://www.npmjs.com/package/@relaysecurity-dev/node)
[](https://pypi.org/project/relaysecurity-dev/)
[](https://relay-security-lemon.vercel.app/)
## At a glance
- Pre-execution checks for AI agent actions
- CLI, Node SDK, and Python SDK
- Policy-based allow, deny, and approval decisions
- Audit logs for tool calls and command execution
- Examples for LangGraph, Claude Code, and custom agents
- Built for teams giving AI agents access to real systems
## Why Relay
AI agents are moving from generating text to executing commands. That is powerful, but it also means prompt injection and unsafe tool use can reach repositories, terminals, APIs, MCP servers, and production workflows.
Relay adds a security layer between the agent's decision and the action itself.
## Pilot access
Relay is onboarding teams deploying AI agents across coding, automation, MCP tools, APIs, terminals, GitHub, and production workflows.
If your agents can access repositories, terminals, credentials, internal APIs, MCP tools, or production systems, book a founder-led security review.
During the call, we review your current agent workflows, identify execution risks, and see whether Relay can help add pre-execution controls.
[Book a security review →](https://calendar.app.google/hKLUrjYhtijdPeobA)
## Quickstart
Install the CLI in your agent project:
```bash
npx @relaysecurity-dev/relay-ai init --yes
```
Set your API key:
```bash
export RELAY_API_KEY=relay_sk_your_key_here
```
Wrap a dangerous tool:
```ts
import { createRelay } from "@relaysecurity-dev/node";
const relay = createRelay();
export const deleteRepo = relay.guardTool(
"github_delete_repo",
async ({ repoName }) => {
return github.repos.delete({ repo: repoName });
}
);
```
## How It Works
Relay acts as a security proxy between your agent and your tools.
```mermaid
flowchart TD
A[AI Agent] --> B[Relay]
B --> C{Allowed / Blocked}
C --> D[GitHub]
C --> E[Shell]
C --> F[Database]
C --> G[APIs]
C --> H[MCP]
```
When the agent calls a wrapped tool, Relay checks the tool name and arguments against your policies in real time. You manage the rules in Relay, so the agent code does not need to change every time.
## Framework Integrations
The CLI generates starter files for common stacks:
- `relay-examples/node/` for Node.js and custom agents
- `relay-examples/python/` for Python agents
- `relay-examples/langgraph/` for LangGraph guard nodes
- `relay-examples/claude-code/` for Claude Code command checks
## Optional Sandbox
For shell-based agents, use Docker with `--network none` and an egress allowlist. Relay checks the command first, then the sandbox keeps the runtime isolated.
```mermaid
flowchart LR
A[Agent wants shell command] --> B[Relay policy check]
B --> C{Allowed?}
C -- No --> D[Blocked with reason]
C -- Yes --> E[Docker sandbox]
E --> F[No network by default]
F --> G[Return output safely]
```
Two modes:
- Basic mode: Relay checks the tool call before it runs.
- Sandbox mode: Relay checks the tool call, then runs shell commands inside Docker isolation.
Test Docker before using sandbox mode:
```bash
npx @relaysecurity-dev/relay-ai sandbox test
```
Expected output:
```text
Relay sandbox test
1. Docker CLI found: Docker version 29.5.3
2. Docker engine is running
3. No-network container works
Relay sandbox works
Result: sandbox ready
```
```json
{
"sandbox": {
"type": "docker",
"image": "ubuntu:24.04",
"network": "none",
"egressAllowlist": ["github.com", "api.github.com"]
}
}
```
## Published Packages
- `@relaysecurity-dev/relay-ai`
- `@relaysecurity-dev/node`
- `relaysecurity-dev`
## Project Status
What works today:
- CLI setup
- Node SDK
- Python SDK
- Public website and docs
- Pilot access flow
- Audit logs
- Claude Code and LangGraph examples
## Public Repository Scope
This public repository contains Relay's public-facing website, documentation, examples, and safe integration materials.
The hosted dashboard, policy engine backend, auth, API key management, database migrations, and internal product infrastructure are maintained privately.
## FAQ
**What is Relay?**
Relay is a runtime security layer for AI agents that checks risky tool calls before they run.
**What does Relay work with?**
Relay works with Node, Python, LangGraph, Claude Code, and custom tool-calling agents.
**How does it help with prompt injection?**
It does not trust the prompt. It checks the tool call itself, so harmful actions can still be blocked.
## Feedback
If you are building autonomous agents and worrying about prompt injection, I want your feedback.
- Live demo: https://relay-security-lemon.vercel.app/
- GitHub: https://github.com/aniiketvarshney/Relay-Security
- Twitter/X: https://x.com/AniketVarshne
- Email: aniiketvarshney@gmail.com
[Talk to founder →](https://calendar.app.google/hKLUrjYhtijdPeobA)
Built for teams that want AI agents to move fast without giving them unchecked access to production.
