Protected MCP tool-call governance
Resolve Action Cards through protected MCP before developer-owned execution
Official MCP Registry listing active: com.neurarelay/relay-mcp
Run the public example
Clone relay-action-card
Activate sandbox MCP
Copy a one-time sandbox token
Connect your MCP client
Use POST /mcp with bearer auth
Keep execution yours
Your application still executes
Connect through protected MCP
Use POST /mcp with bearer auth from Workspace or controlled private access
Endpoint
https://www.neurarelay.com/mcp
Header
Authorization: Bearer <token>
Boundary
401 without auth; GET returns 405
Remote MCP
JSON
{ "server_url": "https://www.neurarelay.com/mcp", "transport": "streamable_http", "headers": { "Authorization": "Bearer <RELAY_MCP_TOKEN>" }}Expand full example
{ "server_url": "https://www.neurarelay.com/mcp", "transport": "streamable_http", "headers": { "Authorization": "Bearer <RELAY_MCP_TOKEN>" }, "allowed_tools": ["validate_action_card", "resolve_action_card"], "require_approval": "always"}Five narrow tools
Each tool returns governance proof or safe refs; none executes the downstream action
validate_action_card
Check Action Card shape
Read-only
resolve_action_card
Return receipt and trace refs
Creates proof
get_decision_receipt
Fetch a safe receipt summary
Read-only
get_trace_replay
Fetch redacted trace replay
Read-only
lookup_agent_passport
Check Registry standing
Read-only
Data boundary
Receipts, trace refs, transaction refs, Registry context
Production identity
Production agents need Registry Agent Passport standing
Support path
Use GitHub issue templates with safe refs only