Use `curl` to download the script and execute it with `sh`:

```console
$ curl -LsSf https://astral.sh/uv/install.sh | sh
```

If your system doesn't have `curl`, you can use `wget`:

```console
$ wget -qO- https://astral.sh/uv/install.sh | sh
```

Request a specific version by including it in the URL:

```console
$ curl -LsSf https://astral.sh/uv/0.8.13/install.sh | sh
```

Use `irm` to download the script and execute it with `iex`:

```pwsh-session
PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
```

Changing the [execution policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4#powershell-execution-policies) allows running a script from the internet.

Request a specific version by including it in the URL:

```pwsh-session
PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.8.13/install.ps1 | iex"
```

The installation script may be inspected before use:

=== "macOS and Linux"

    ```console
    $ curl -LsSf https://astral.sh/uv/install.sh | less
    ```

=== "Windows"

    ```pwsh-session
    PS> powershell -c "irm https://astral.sh/uv/install.ps1 | more"
    ```

Alternatively, the installer or binaries can be downloaded directly from [GitHub](#github-releases).

uv self update

uvx pan-mcp-relay@latest --help

# Installs to $(uv tool dir)/pan-mcp-relay
uv tool install pan-mcp-relay@latest

# Executable symlinked to $(uv tool dir --bin)/pan-mcp-relay
pan-mcp-relay --help

uv tool install https://github.com/PaloAltoNetworks/aisecurity-mcp-relay.git
pan-mcp-relay --help

uv tool install --upgrade pan-mcp-relay

# mcpRelay section is optional.
# Specify API Key, AI Profile and API Endpoint via CLI flags or environment variables.
mcpRelay:
  # Prisma AIRS API Key (required), environment variables supported
  apiKey: |
    ${PRISMA_AIRS_API_KEY}
  # Prisma AIRS AI Profile Name or ID (required), environment variables supported
  aiProfile: |
    your-ai-profile-name-or-id
  # Endpoint Optional, default shown
  # endpoint: |
  #  https://service.api.aisecurity.paloaltonetworks.com

# mcpServers section requires at least one MCP Server.
mcpServers:
  # Example / demo MCP Servers
  homebrew:
    command: brew
    args:
      - mcp-server
    # Optional working directory, supports environment variables
    cwd: "${HOMEBREW_PREFIX}"
    # optional environment variables, inherited from the parent shell
    env:
      HOMEBREW_NO_ENV_HINTS: 1
  fetch:
    command: uvx
    args:
      - mcp-server-fetch

  # filesystem:
  #   command: npx
  #   args:
  #     - -y
  #     - '@modelcontextprotocol/server-filesystem'
  #     - /var/tmp/change/this/path
  #     # Command line arguments support environment variables
  #     - "${XDG_PICTURES_DIR}"

# Required for Prisma AIRS API
PRISMA_AIRS_API_KEY=YOUR_API_KEY
# Required for Prisma AIRS API
PRISMA_AIRS_AI_PROFILE=YOUR_AI_PROFILE_NAME

# Optional, default is https://service.api.aisecurity.paloaltonetworks.com
PRISMA_AIRS_API_ENDPOINT=https://service.api.aisecurity.paloaltonetworks.com
# See https://pan.dev/prisma-airs/scan/api/#scan-api-endpoints for additional regional API endpoints

# Defaults shown for all other Environment Variables
MCP_RELAY_CONFIG_FILE=~/.config/pan-mcp-relay/mcp-relay.yaml
MCP_RELAY_TRANSPORT=stdio
# Host For SSE Transport Mode
MCP_RELAY_HOST=127.0.0.1
# Port for SSE Transport Mode
MCP_RELAY_TOOL_CACHE_TTL=86400
MCP_RELAY_MAX_SERVERS=32
MCP_RELAY_MAX_TOOLS=256
# Path to optional .env file
MCP_RELAY_DOTENV=
# Supports $PATH-style colon-separated list and environment variables. Directory entries will search for a file named `.env`
# MCP_RELAY_DOTENV=$HOME/.env:~/.config/pan-mcp-relay:$PWD

MCP_RELAY_LOG_LEVEL=INFO

{
  "mcpServers": {
    "pan-mcp-relay": {
      "command": "uvx",
      "args": [
        "pan-mcp-relay@latest"
      ]
    }
  }
}

{
  "mcpServers": {
    "pan-mcp-relay": {
      "command": "pan-mcp-relay"
    }
  }
}

{
  "mcpServers": {
    "pan-mcp-relay": {
      "command": "uvx",
      "args": [
        "pan-mcp-relay",
        "--config-file",
        "~/.config/pan-mcp-relay/mcp-relay.yaml"
      ],
      "env": {
        "PRISMA_AIRS_AI_PROFILE": "your-ai-profile",
        "MCP_RELAY_LOG_LEVEL": "WARNING"
      }
    }
  }
}

pan-mcp-relay --help
Usage: pan-mcp-relay [OPTIONS] COMMAND [ARGS]...

  Run the MCP Relay Server.

Options:
  -k, --api-key TEXT              Prisma AIRS API Key [PRISMA_AIRS_API_KEY=]
  -e, --api-endpoint TEXT         Prisma AIRS API Endpoint [PRISMA_AIRS_API_ENDPOINT=]
  -p, --ai-profile TEXT           Prisma AIRS AI Profile Name or ID [PRISMA_AIRS_AI_PROFILE=]
  -c, --config-file FILE          Path to configuration file (yaml, json) [MCP_RELAY_CONFIG_FILE=]
  -t, --transport [stdio|sse|http]
                                  Transport protocol to use [MCP_RELAY_TRANSPORT=]  [default: stdio]
  -h, --host TEXT                 Host for HTTP/SSE server [MCP_RELAY_HOST=]  [default: 127.0.0.1]
  -p, --port INTEGER              Port for HTTP/SSE server [MCP_RELAY_PORT=]  [default: 8000]
  -TTL, --tool-registry-cache-ttl INTEGER
                                  Tool registry cache TTL (in seconds) [MCP_RELAY_TOOL_CACHE_TTL=]  [default: 86400]
  -MS, --max-mcp-servers INTEGER  Maximum number of downstream MCP servers to allow [MCP_RELAY_MAX_SERVERS=]  [default: 32]
  -MT, --max-mcp-tools INTEGER    Maximum number of MCP tools to allow [MCP_RELAY_MAX_TOOLS=]  [default: 256]
  --env TEXT                      Use ./.env file, or specify colon separated path to .env file(s)or directories containing .env files. [MCP_RELAY_DOTENV=]
  --system-ca                     Use System CA instead of Mozilla CA Bundle
  --capath FILE                   Path to Custom Trusted CA bundle
  -d, --debug                     Extremely verbose logging output (DEBUG)
  -v, --verbose                   Verbose logging output (INFO, DEFAULT)
  -q, --quiet                     Minimal logging output (WARNING)
  --show-config, --dump-config    Show configuration and exit [MCP_RELAY_SHOW_CONFIG=]
  -V, --version                   Show the version and exit.
  --help                          Show this message and exit.

Commands:
  json-schema  Print Configuration File JSON Schema, optionally to a file.
  run          Run the MCP Relay Server.
  show-config  Print MCP Relay Configuration and exit.

# Run with stdio transport with automatic configuration detection (default)
uvx pan-mcp-relay

# Specify a configuration file
uvx pan-mcp-relay --config-file ~/.config/pan-mcp-relay/mcp-relay.yaml

# Specify a path to a custom .env file
uvx pan-mcp-relay --env /var/run/secrets/.env

# Run with Streamable transport
pan-mcp-relay --transport=http

# Run with SSE transport
pan-mcp-relay --transport=sse