Protected MCP tool-call governance
Resolve Action Cards through protected MCP before developer-owned execution
Official MCP Registry listing active for com.neurarelay/relay-mcp. Open listing
Run example
Clone relay-action-card
Get sandbox token
Copy one-time access
Connect MCP
Use protected POST /mcp
Keep execution
Your application executes
Connect through protected MCP
Use POST /mcp with bearer auth from Workspace or controlled private access
{ "server_url": "https://www.neurarelay.com/mcp", "transport": "streamable_http", "headers": { "Authorization": "Bearer <RELAY_MCP_TOKEN>" }}Expand full example
{ "server_url": "https://www.neurarelay.com/mcp", "transport": "streamable_http", "headers": { "Authorization": "Bearer <RELAY_MCP_TOKEN>" }, "allowed_tools": ["validate_action_card", "resolve_action_card"], "require_approval": "always"}Five narrow tools
Each tool returns governance proof or safe refs; none executes the downstream action
validate_action_card
Check Action Card shape
Read-only
resolve_action_card
Return receipt and trace refs
Creates proof
get_decision_receipt
Fetch a safe receipt summary
Read-only
get_trace_replay
Fetch redacted trace replay
Read-only
lookup_agent_passport
Check Registry standing
Read-only
Data boundary
Receipts, trace refs, transaction refs, Registry context
Production identity
Registry standing required
Support path
Use GitHub issue templates with safe refs only
Troubleshooting
Keep debugging inside safe refs and status codes
A 401 response means the MCP client needs a valid sandbox token or controlled private access tied to a Registry Agent Passport path. Unauthenticated requests return OAuth discovery metadata for compatible clients.
A 405 response means the method is unsupported for the protected MCP endpoint. Use Streamable HTTP against POST /mcp with the Authorization bearer header.
For support, share receipt refs, trace refs, transaction refs, and Registry refs only. Do not share token values, passwords, private payloads, or secret keys.